Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sys32' = '%APPDATA%\svchosts.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'sys32' = '%APPDATA%\svchosts.exe'
- %APPDATA%\svchosts.exe
- <SYSTEM32>\cmd.exe /c "%TEMP%\mDM1.tmp_meLt.bat"
- %TEMP%\mDM1.tmp_meLt.bat
- %APPDATA%\svchosts.exe
- 'm3###.no-ip.info':3333
- DNS ASK m3###.no-ip.info
- ClassName: 'Indicator' WindowName: ''