Техническая информация
- <SYSTEM32>\tasks\ll
- 'pa###bin.com':443
- DNS ASK pa###bin.com
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn LL /tr "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Ge...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Sorry\).Payload))....' (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn LL /tr "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Ge...
- '<SYSTEM32>\taskeng.exe' {8CC216AA-7B47-4C71-A692-8ABA155E8EA1} S-1-5-21-1960123792-2022915161-3775307078-1001:hdvbzwgbpkh\user:Interactive:[1]
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Sorry\).Payload))....