Техническая информация
- soldier.exe
- %TEMP%\ixp000.tmp\namespace.ppt
- %TEMP%\ixp000.tmp\typing.ppt
- %TEMP%\ixp000.tmp\released
- %TEMP%\ixp000.tmp\relatively
- %TEMP%\ixp000.tmp\nor
- %TEMP%\ixp000.tmp\app
- %TEMP%\ixp000.tmp\53007\soldier.exe
- %TEMP%\ixp000.tmp\53007\u
- %TEMP%\ixp000.tmp\53007\u
- %TEMP%\ixp000.tmp\app
- %TEMP%\ixp000.tmp\nor
- %TEMP%\ixp000.tmp\relatively
- %TEMP%\ixp000.tmp\released
- %TEMP%\ixp000.tmp\typing.ppt
- %TEMP%\ixp000.tmp\namespace.ppt
- %TEMP%\ixp000.tmp\53007\soldier.exe
- 'te##gram.me':443
- DNS ASK dQ##########umJDCWrI.dQYlHUZHICYNumJDCWrI
- DNS ASK te##gram.me
- '%TEMP%\ixp000.tmp\53007\soldier.exe' u
- '%TEMP%\ixp000.tmp\53007\soldier.exe'
- '<SYSTEM32>\reg.exe' /dfghskhjdf987347589374a (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c lfdKZFPkQ & type Typing.ppt | %comspec% (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /S /D /c" type Typing.ppt "
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\findstr.exe' /V "Amino" Released