Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\ofsecu] 'Start' = '00000002'
- <SYSTEM32>\cmd.exe /c ""%TEMP%\httpsys.bat" "
- <SYSTEM32>\svchost.exe -k "ofsecu"
- %TEMP%\httpsys.bat
- <SYSTEM32>\offwrk.tsp
- <SYSTEM32>\ofsecu.dll
- '18#.#24.100.165':3128