Техническая информация
- '<SYSTEM32>\wscript.exe' %TEMP%\u66llkk:400ddWW.js
- %TEMP%\u66llkk:400ddww.js
- DNS ASK ji###########21612a8dc5c.cloudflareworkers.com
- '<SYSTEM32>\cmd.exe' /S /D /c" echo %OYIIFJJ:;1;=/% 1>%TEMP%\u66llkk:400ddWW.js"
- '<SYSTEM32>\cmd.exe' /S /D /c" call start wscript.exe %TEMP%\u66llkk:400ddWW.js"
- '<SYSTEM32>\cmd.exe' /S /D /c" pause"