Техническая информация
- [<HKCU>\Software\Classes\zje2opu3ihq\shell\open\command] '' = 'powershell -command "$A=New-Object System.Security.Cryptography.AesCryptoServiceProvider;$A.Key=@([byte]99,238,117,87,26,203,18,19...
- %APPDATA%\microsoft\windows\start menu\programs\startup\nw5obqxtmux.lnk
- %TEMP%\435f1iqpcewi332qjvb32qga3idbw0mk.ps1
- %HOMEPATH%\omyfitqgwjh.3u0xybewmu5
- ClassName: 'MS_WINHELP' WindowName: ''
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ep bypass -windowstyle hidden -file "%TEMP%\435f1iqpcewi332qjvb32qga3idbw0mk.ps1"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ep bypass -windowstyle hidden -file "%TEMP%\435f1iqpcewi332qjvb32qga3idbw0mk.ps1"' (со скрытым окном)