Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Rsrqvd zddguqme] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Rsrqvd zddguqme] 'ImagePath' = '%WINDIR%\svchost1.exe'
- <Полный путь к файлу> в %WINDIR%\svchost1.exe
- '19#.#12.104.76':8000
- 'mm#.#caxy.com':8888
- DNS ASK mm#.#caxy.com
- '%WINDIR%\svchost1.exe'