Техническая информация
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'KVP' = '<DRIVERS>\svchost.exe'
- %WINDIR%\syswow64\packet.dll
- %WINDIR%\syswow64\wanpacket.dll
- %WINDIR%\syswow64\wpcap.dll
- %WINDIR%\syswow64\drivers\npf.sys
- %WINDIR%\syswow64\drivers\svchost.exe
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- '%WINDIR%\syswow64\drivers\svchost.exe'