Техническая информация
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'System Upgrade Assistant' = 'explorer "%HOMEPATH%\Documents\msedge.exe"'
- %WINDIR%\syswow64\msiexec.exe
- %HOMEPATH%\documents\msedge.exe
- %HOMEPATH%\documents\msedge.exe
- 'by##w81.top':17386
- 'wh###.#conline.com.cn':80
- http://wh###.#conline.com.cn/ipJson.jsp
- 'by##w81.top':17386
- DNS ASK by##w81.top
- DNS ASK wh###.#conline.com.cn
- '%WINDIR%\syswow64\msiexec.exe' -Puppet' (со скрытым окном)
- '%WINDIR%\syswow64\msiexec.exe' -Puppet