Техническая информация
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XClient' = '%TEMP%\XClient.exe'
- '%TEMP%\tmp_cde8558a69c14bddbe23731235e0d609.exe'
- %TEMP%\tmp_cde8558a69c14bddbe23731235e0d609.exe
- %TEMP%\xclient.exe
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- 'ip##pi.com':80
- http://ip##pi.com/line/?fi############
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK ip##pi.com