Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'OpenCloud Security' = '%APPDATA%\OpenCloud Security\OpenCloud Security.exe'
- %APPDATA%\OpenCloud Security\OpenCloud Security.exe
- <SYSTEM32>\msiexec.exe /V
- %TEMP%\1.tmp
- %APPDATA%\OpenCloud Security\OpenCloud Security.exe
- 'any':80
- '20#.#6.232.182':80
- any/r.php?ve###############################################################
- 20#.#6.232.182/pki/crl/products/CSPCA.crl
- DNS ASK google.com
- DNS ASK crl.microsoft.com