Техническая информация
- '%APPDATA%\purchasing order2172021.exe'
- %APPDATA%\purchasing order2172021.exe
- %APPDATA%\microsoft\speech\files\userlexicons\sp_14ef5b6ba1264eff9b3f03d7df2a4834.dat
- 're####egifts.com':80
- DNS ASK re####egifts.com
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\WzbmJL" /XML "%TEMP%\tmp1064.tmp"' (со скрытым окном)
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\WzbmJL" /XML "%TEMP%\tmp1064.tmp"