Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\mtxlegih] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mtxlegih] 'ImagePath' = '"%WINDIR%\SysWOW64\NlsLexicons0047\mtxlegih.exe"'
- 'mtxlegih' "%WINDIR%\SysWOW64\NlsLexicons0047\mtxlegih.exe"
- 'mtxlegih' %WINDIR%\SysWOW64\NlsLexicons0047\mtxlegih.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGgAYgBqAGwAagB3AD0AKAAoACcATgBfACcAKwAnAGYAJwApACsAKAAnAHQANQAnACsAJwBmADcAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABFAE4AVgA6AFUAcwBFAFIAcA...
- %HOMEPATH%\olgtqfs\wda5pgn\pt8izs8v5.exe
- %WINDIR%\syswow64\nlslexicons0047\mtxlegih.exe
- %HOMEPATH%\olgtqfs\wda5pgn\pt8izs8v5.exe в %WINDIR%\syswow64\nlslexicons0047\mtxlegih.exe
- '12#.#2.203.42':80
- http://vo###fitz.com/wp-content/se/
- http://12#.#2.203.42/gdFot0pjEo2hvu2LAY/AStXzSvYb2ZPSB/1aKJ9v9o9569xFn/
- DNS ASK vo###fitz.com
- '%HOMEPATH%\olgtqfs\wda5pgn\pt8izs8v5.exe'
- '%WINDIR%\syswow64\nlslexicons0047\mtxlegih.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGgAYgBqAGwAagB3AD0AKAAoACcATgBfACcAKwAnAGYAJwApACsAKAAnAHQANQAnACsAJwBmADcAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABFAE4AVgA6AFUAcwBFAFIAcA...' (со скрытым окном)