Техническая информация
- '%HOMEPATH%\in.exe'
- '<SYSTEM32>\wscript.exe' "%TEMP%\1.tmp\3.vbs"
- '<SYSTEM32>\taskkill.exe' /im praetorian.exe
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\bat.bat" "
- %TEMP%\1.tmp\5.vbs
- %TEMP%\1.tmp\4.vbs
- %HOMEPATH%\in.exe
- %TEMP%\1.tmp\in.exe
- %TEMP%\1.tmp\2
- %TEMP%\1.tmp\bat.bat
- %TEMP%\1.tmp\1
- %TEMP%\1.tmp\3.vbs
- 'fi###files.biz':80
- fi###files.biz/api/index
- DNS ASK fi###files.biz
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'