Техническая информация
- '<SYSTEM32>\taskkill.exe' /im Betternet.exe /f
- http://www.tr###mity.com/volume license/betternet/betternet.dat as %windir%\temp\betternet.dat
- http://www.tr###mity.com/volume license/betternet/betternet.windows.services.dll as %windir%\temp\betternet.windows.services.dll
- %TEMP%\is64.txt
- %TEMP%\is64.bat
- %TEMP%\is64.fil
- %TEMP%\xtmp\tmp43151.bat
- %TEMP%\xtmp\tmp43671.exe
- http://www.tr###mity.com/Volume%20License/Betternet/Betternet.dat
- http://www.tr###mity.com/Volume%20License/Betternet/Betternet.Windows.Services.dll
- DNS ASK tr###mity.com
- ClassName: '' WindowName: ''
- '%WINDIR%\syswow64\cmd.exe' /c if not exist "%TEMP%\afolder" mkdir "%TEMP%\afolder"
- '%WINDIR%\syswow64\cmd.exe' /c if not exist "%TEMP%\xtmp" mkdir "%TEMP%\xtmp"
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h %TEMP%\xtmp
- '%WINDIR%\syswow64\attrib.exe' +h %TEMP%\xtmp
- '%WINDIR%\syswow64\cmd.exe' /c echo:0>%TEMP%\is64.txt
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\is64.bat
- '%WINDIR%\syswow64\cmd.exe' /c if exist "%TEMP%\xtmp\tmp43151.bat" del "%TEMP%\xtmp\tmp43151.bat"
- '%WINDIR%\syswow64\cmd.exe' /c if exist "%TEMP%\xtmp\tmp43671.exe" del "%TEMP%\xtmp\tmp43671.exe"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\cmd.exe /C %TEMP%\xtmp\tmp43151.bat "<Полный путь к файлу>"
- '<SYSTEM32>\cmd.exe' /C %TEMP%\xtmp\tmp43151.bat "<Полный путь к файлу>"
- '<SYSTEM32>\timeout.exe' /T 3