Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\fc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\fc] 'ImagePath' = '"%WINDIR%\SysWOW64\netsh\fc.exe"'
- 'fc' "%WINDIR%\SysWOW64\netsh\fc.exe"
- 'fc' %WINDIR%\SysWOW64\netsh\fc.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABQAHEAbwA4AGsANQA1AD0AKAAnAFkAMwAnACsAKAAnADUAMQAnACsAJwBsADgAJwApACsAJwBsACcAKQA7ACQAWQA5AHgANgBnAGMAdAA9ACQAQQBsADkAOAAyAGMAYQAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...
- %HOMEPATH%\p0ge3qt\an7ltj5\hyu7s9nf.exe
- %HOMEPATH%\p0ge3qt\an7ltj5\hyu7s9nf.exe
- %HOMEPATH%\p0ge3qt\an7ltj5\hyu7s9nf.exe в %WINDIR%\syswow64\netsh\fc.exe
- %HOMEPATH%\p0ge3qt\an7ltj5\hyu7s9nf.exe
- '20#.#80.207.205':80
- http://ho#####tor.wasseela.com/x2ekf/tMR/
- http://20#.#80.207.205/lJHktfOjNDI0/ZIPNWBdICL0j/YhkjHLh/m0sD7LZv35xlX2e7b/8CnocLHfcBhLF/
- DNS ASK po###lon.com
- DNS ASK pe######trainersindia.com
- DNS ASK el##hwa.com
- DNS ASK me##k.com
- DNS ASK pr####tcycles.com
- DNS ASK ho#####tor.wasseela.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABQAHEAbwA4AGsANQA1AD0AKAAnAFkAMwAnACsAKAAnADUAMQAnACsAJwBsADgAJwApACsAJwBsACcAKQA7ACQAWQA5AHgANgBnAGMAdAA9ACQAQQBsADkAOAAyAGMAYQAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...' (со скрытым окном)