Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Subvision Desktop' = '%APPDATA%\Microsoft\Windows\svchost.exe'
- %APPDATA%\Microsoft\Windows\svchost.exe
- 'ha###ncle.ws':80
- '20#.#6.232.182':80
- 20#.#6.232.182/windowsupdate/v6/thanks.aspx?ln#################
- ha###ncle.ws/adminks2/cmd.php
- DNS ASK ha###ncle.ws
- DNS ASK www.up####.microsoft.com
- ClassName: 'Indicator' WindowName: '(null)'