Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\HjobProServer] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\HjobProServer] 'ImagePath' = '%ProgramFiles%\Windows NT\HjobPro.EXE'
- %ProgramFiles%\Windows NT\HjobPro.EXE
- C:\3610.vbs
- <Полный путь к файлу>
- C:\3610.vbs
- 'te####b.165668.com':2017
- DNS ASK te####b.165668.com
- '%ProgramFiles%\Windows NT\HjobPro.EXE'
- '<SYSTEM32>\wscript.exe' "C:\3610.vbs"