Техническая информация
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] '4l8gpzzqxp' = '%ALLUSERSPROFILE%\fezh5t1vqn\DingtalkCleaner.exe'
- <SYSTEM32>\tasks\lw7rhpcs7ygu
- Процесс dingtalkcleaner.exe, модуль ntdll.dll
- %ALLUSERSPROFILE%\fezh5t1vqn\dtfbase.dll
- %ALLUSERSPROFILE%\fezh5t1vqn\dingtalkcleaner.exe
- '47.##.100.245':8443
- '47.##.100.245':8443
- DNS ASK mo#####.map.fastly.net
- '%ALLUSERSPROFILE%\fezh5t1vqn\dingtalkcleaner.exe'