Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\vistawith] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\vistawith] 'ImagePath' = '"%WINDIR%\SysWOW64\vistawith.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAQQB5AHoAZgBrAGkAeQBrAGsAbQB0ACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAFgAZwBnAGYAbwBjAG4AYQBiAGEAIAAjAD4AIAAkAEQAeQBtAG8AegBiAHAAegBlAGQAbwB1AHIAPQ...
- %HOMEPATH%\407.exe
- %HOMEPATH%\407.exe в %WINDIR%\syswow64\vistawith.exe
- http://ko###ireddy.net/wp-content/frn377/
- http://19#.#17.1.149/taskbar/mult/ringin/merge/
- http://45.##.79.249:443/window/tpt/ringin/merge/ via 45.##.79.249
- DNS ASK th###teryee.com
- DNS ASK ko###ireddy.net
- '%HOMEPATH%\407.exe'
- '%WINDIR%\syswow64\vistawith.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAQQB5AHoAZgBrAGkAeQBrAGsAbQB0ACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAFgAZwBnAGYAbwBjAG4AYQBiAGEAIAAjAD4AIAAkAEQAeQBtAG8AegBiAHAAegBlAGQAbwB1AHIAPQ...' (со скрытым окном)