Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\Magnification] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Magnification] 'ImagePath' = '"%WINDIR%\SysWOW64\XAudio2_4\Magnification.exe"'
- 'Magnification' "%WINDIR%\SysWOW64\XAudio2_4\Magnification.exe"
- 'Magnification' %WINDIR%\SysWOW64\XAudio2_4\Magnification.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABGAHMAZwA2AGgANwA3AD0AWwBjAGgAYQByAF0ANAAyADsAJABKAGcAMwB2AG8ANQA3AD0AKAAoACcAUQBtACcAKwAnAGMAJwApACsAJwBwAGkAJwArACcANQB5ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQ...
- %HOMEPATH%\tceqbwm\dcxwgck\u9pruuf.exe
- %WINDIR%\syswow64\xaudio2_4\magnification.exe
- %HOMEPATH%\tceqbwm\dcxwgck\u9pruuf.exe в %WINDIR%\syswow64\xaudio2_4\magnification.exe
- '42.##0.96.63':80
- http://co###rse.com.ar/colfar/A/
- http://42.##0.96.63/nOB49pb/aY00Yzv2yP/0pfyEgp4eEnGBIz/9Towk1063e5/
- DNS ASK tr####ersuvan.com
- DNS ASK co###rse.com.ar
- '%HOMEPATH%\tceqbwm\dcxwgck\u9pruuf.exe'
- '%WINDIR%\syswow64\xaudio2_4\magnification.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABGAHMAZwA2AGgANwA3AD0AWwBjAGgAYQByAF0ANAAyADsAJABKAGcAMwB2AG8ANQA3AD0AKAAoACcAUQBtACcAKwAnAGMAJwApACsAJwBwAGkAJwArACcANQB5ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQ...' (со скрытым окном)