Техническая информация
- <SYSTEM32>\tasks\name
- %TEMP%\folder\file.exe
- %TEMP%\9b274dbb640e4d199a826e697ea4f7c6.xml
- %TEMP%\p0ktcwg0gt
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- DNS ASK ma##.##ivateemail.com
- DNS ASK microsoft.com
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN name /XML "%TEMP%\9b274dbb640e4d199a826e697ea4f7c6.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN name /XML "%TEMP%\9b274dbb640e4d199a826e697ea4f7c6.xml"
- '%WINDIR%\syswow64\cmd.exe' /C copy "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "%TEMP%\\p0ktcwg0gt"