Техническая информация
- %TEMP%\_mei40762\vcruntime140.dll
- %TEMP%\_mei40762\_bz2.pyd
- %TEMP%\_mei40762\_hashlib.pyd
- %TEMP%\_mei40762\_lzma.pyd
- %TEMP%\_mei40762\_socket.pyd
- %TEMP%\_mei40762\_ssl.pyd
- %TEMP%\_mei40762\libcrypto-1_1.dll
- %TEMP%\_mei40762\libssl-1_1.dll
- %TEMP%\_mei40762\powershell.exe.manifest
- %TEMP%\_mei40762\pyexpat.pyd
- %TEMP%\_mei40762\python37.dll
- %TEMP%\_mei40762\select.pyd
- %TEMP%\_mei40762\unicodedata.pyd
- %TEMP%\_mei40762\base_library.zip
- %ALLUSERSPROFILE%\script.ps1
- %ALLUSERSPROFILE%\script2.ps1
- %TEMP%\_mei40762\base_library.zip
- %TEMP%\_mei40762\libcrypto-1_1.dll
- %TEMP%\_mei40762\libssl-1_1.dll
- %TEMP%\_mei40762\powershell.exe.manifest
- %TEMP%\_mei40762\pyexpat.pyd
- %TEMP%\_mei40762\python37.dll
- %TEMP%\_mei40762\select.pyd
- %TEMP%\_mei40762\unicodedata.pyd
- %TEMP%\_mei40762\vcruntime140.dll
- %TEMP%\_mei40762\_bz2.pyd
- %TEMP%\_mei40762\_hashlib.pyd
- %TEMP%\_mei40762\_lzma.pyd
- %TEMP%\_mei40762\_socket.pyd
- %TEMP%\_mei40762\_ssl.pyd
- '12#.#0.162.164':80
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -ExecutionPolicy Unrestricted -File %ALLUSERSPROFILE%/script2.ps1" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Unrestricted -File %ALLUSERSPROFILE%/script2.ps1