16·
2 months agoThe embedded PowerShell code creates a hidden folder at C:\Systems and downloads a trojanized ScreenConnect package from legitserver.theworkpc[.]com over TCP port 5443.
Nothing to see here, just a legit server doing work with the systems.
I’ve never before appreciated enough that the shitty bluetooth emitter of my system has such short range that I have to lay my phone on top of it in order to work