Technical Information
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SystemNetHelper' = '%APPDATA%\Microsoft\Windows\Caches\SysNetHelper.exe'
- %APPDATA%\microsoft\windows\caches\sysnethelper.exe
- %APPDATA%\microsoft\windows\caches\sysnethelper.exe
- 'to######ver.up.railway.app':443
- DNS ASK to######ver.up.railway.app
- '%APPDATA%\microsoft\windows\caches\sysnethelper.exe'
- '%APPDATA%\microsoft\windows\caches\sysnethelper.exe' ' (with hidden window)