Техническая информация
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'svchostInstall' = 'C:\Users\Leo\AppData\Local\Temp\Host Service Install\svchost.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchostInstall' = 'C:\Users\Leo\AppData\Local\Temp\Host Service Install\svchost.exe'
- C:\users\leo\appdata\local\temp\host service install\svchost.exe
- C:\users\leo\appdata\local\temp\host service install\svchost.exe
- http://ep##emic.cc/httpbot/bot/startup.php
- http://www.fi####p-address.org/
- http://ep##emic.cc/httpbot/bot/getError.php?co###################################################################################################################################################...
- DNS ASK ep##emic.cc
- DNS ASK fi####p-address.org