Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XXXXXX69B51FF3' = '%WINDIR%\XXXXXX69B51FF3\svchsot.exe'
- 'C:\test.exe'
- 'C:\test.exe' (загружен из сети Интернет)
- %WINDIR%\XXXXXX69B51FF3\svchsot.exe
- C:\test.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\spooIsv[1].exe
- 'th#####h12.no-ip.org':8000
- 'localhost':8000
- 'localhost':1036
- 'ne####.dothome.co.kr':80
- ne####.dothome.co.kr/spooIsv.exe
- DNS ASK th#####h12.no-ip.org
- DNS ASK ne####.dothome.co.kr
- ClassName: '(null)' WindowName: '??????????????'