Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\NetServiceDdYuanCheng] 'Start' = '00000002'
- '<SYSTEM32>\svchost.exe' -k NetServiceDdYuanCheng
- <SYSTEM32>\DDYuanCheng.dll
- 'ha##.32881.com':80
- http://ha##.32881.com/ip.txt
- DNS ASK ha##.32881.com