Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{E53D6203-50DC-FDEA-8267-9ECE01930A5E}] 'StubPath' = '<SYSTEM32>\svhost.exe'
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\svhost.exe
- 'www.we###anlu.com':80
- DNS ASK www.we###anlu.com