Техническая информация
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'System Upgrade Assistant' = 'explorer "%HOMEPATH%\Documents\msedge.exe"'
- %WINDIR%\syswow64\msiexec.exe
- %HOMEPATH%\documents\msedge.exe
- %HOMEPATH%\documents\msedge.exe
- '20#.#38.221.17':12237
- 'wh###.#conline.com.cn':80
- http://wh###.#conline.com.cn/ipJson.jsp
- '20#.#38.221.17':12237
- DNS ASK wh###.#conline.com.cn
- '%WINDIR%\syswow64\msiexec.exe' -Puppet' (со скрытым окном)
- '%WINDIR%\syswow64\msiexec.exe' -Puppet