Техническая информация
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%APPDATA%\Microsoft\Windows\Themes\taskhostw.exe"'
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- %APPDATA%\microsoft\windows\themes\taskhostw.exe
- %TEMP%\nebula_telegram_debug.txt
- DNS ASK ap#.#pify.org
- DNS ASK ap#.##legram.org
- '%APPDATA%\microsoft\windows\themes\taskhostw.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe'