Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4ab4f6ccd42d2399c5890ae14addcdd1' = '"%TEMP%\Windows Host Process Microsoft.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '4ab4f6ccd42d2399c5890ae14addcdd1' = '"%TEMP%\Windows Host Process Microsoft.exe" ..'
- '%TEMP%\Windows Host Process Microsoft.exe'
- '<SYSTEM32>\rundll32.exe' dfdts.dll,DfdGetDefaultPolicyAndSMART
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\Windows Host Process Microsoft.exe" "Windows Host Process Microsoft.exe" ENABLE
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4ab4f6ccd42d2399c5890ae14addcdd1.exe
- %TEMP%\Windows Host Process Microsoft.exe
- 're####1.no-ip.biz':1177
- DNS ASK dn#.##ftncsi.com
- DNS ASK re####1.no-ip.biz
- ClassName: 'Indicator' WindowName: '(null)'