Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Host' = '%APPDATA%\app\svhost.exe'
- %APPDATA%\app\Set.bin
- %APPDATA%\app\svhost.exe
- 'az###leo.co.cc':80
- 'wp#d':80
- az###leo.co.cc/wp-a/ip.php
- wp#d/wpad.dat
- az###leo.co.cc/wp-a/connect.php
- DNS ASK az###leo.co.cc
- DNS ASK wp#d