Техническая информация
- [<HKLM>\SYSTEM\cONTROLsET003\sERVICES\ERSvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\yczinayc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ERSvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet002\Services\ERSvc] 'Start' = '00000002'
- <SYSTEM32>\svchost.exe -k ERSvc
- NtDeviceIoControlFile, драйвер-обработчик: ekhcym.sys
- <DRIVERS>\ekhcym.sys
- <SYSTEM32>\ekhcym.dll
- <SYSTEM32>\00059188.001
- 'ps.###topsite.info':88
- DNS ASK ps.###topsite.info