Техническая информация
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 948
- %HOMEPATH%\j5iss52.xls
- %HOMEPATH%\~$5iss52.xls
- %HOMEPATH%\j5iss52.doc
- %HOMEPATH%\~$5iss52.doc
- %HOMEPATH%\j5iss52.pub
- %HOMEPATH%\~$5iss52.pub
- %HOMEPATH%\j5iss52.dll
- %TEMP%\1266228.cvr
- %HOMEPATH%\~$5iss52.xls
- %HOMEPATH%\~$5iss52.doc
- %HOMEPATH%\~$5iss52.pub
- %HOMEPATH%\j5iss52.doc в %HOMEPATH%\~wrl0090.tmp
- %HOMEPATH%\j5iss52.pub в %HOMEPATH%\~wrl0172.tmp
- %HOMEPATH%\j5iss52.doc в %HOMEPATH%\~wrl0336.tmp
- %HOMEPATH%\j5iss52.pub в %HOMEPATH%\~wrl0535.tmp
- %HOMEPATH%\j5iss52.doc в %HOMEPATH%\~wrl0582.tmp
- %HOMEPATH%\j5iss52.pub в %HOMEPATH%\~wrl0636.tmp
- %HOMEPATH%\j5iss52.doc в %HOMEPATH%\~wrl0695.tmp
- %HOMEPATH%\j5iss52.pub в %HOMEPATH%\~wrl0753.tmp
- %HOMEPATH%\j5iss52.doc в %HOMEPATH%\~wrl0808.tmp
- %HOMEPATH%\j5iss52.pub в %HOMEPATH%\~wrl0859.tmp
- %HOMEPATH%\j5iss52.doc в %HOMEPATH%\~wrl0917.tmp
- %HOMEPATH%\~$5iss52.doc
- %HOMEPATH%\~$5iss52.pub
- DNS ASK su####ssasin.xyz
- '<SYSTEM32>\certutil.exe' -decodehex %HOMEPATH%\j5Iss52.xls %HOMEPATH%\j5Iss52.dll
- '<SYSTEM32>\rundll32.exe' %HOMEPATH%\j5Iss52.dll,R1
- '<SYSTEM32>\regsvr32.exe' /i %APPDATA%\uaclbd\uaclbd.dll