Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ffeklgyd] 'Logon' = 'Logon'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ffeklgyd] 'DllName' = 'ffeklgyd32.dll'
- '<SYSTEM32>\cmd.exe' /c %TEMP%\0xfe.bat
- <SYSTEM32>\cmd.exe
- %TEMP%\0xfe.bat
- <SYSTEM32>\ffeklgyd32.dll
- 'sy##agu.biz':80
- sy##agu.biz/images/001.php
- DNS ASK sy##agu.biz