Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\WcCemsvc_onsConnection_0xE4] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WcCemsvc_onsConnection_0xE4] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs -p'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WcCemsvc_onsConnection_0xE4\Parameters] 'ServiceDll' = '%CommonProgramFiles(x86)%\Connec.dll'
- 'WcCemsvc_onsConnection_0xE4' <SYSTEM32>\svchost.exe -k netsvcs -p
- %CommonProgramFiles(x86)%\connec.dll
- из <Полный путь к файлу> в %WINDIR%\syswow64\1170109.bak
- DNS ASK bj##tj.com
- '%WINDIR%\syswow64\svchost.exe' -k netsvcs -p