Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Internt' = '<SYSTEM32>\internt.exe'
- <SYSTEM32>\internt.exe
- 'sm##.163.com':25
- '12#.#25.114.144':80
- http://www.ba##u.com/ via 12#.#25.114.144
- DNS ASK sm##.163.com
- DNS ASK www.ba##u.com