Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'egkepxcackaofrwsjvh' = '%APPDATA%\egkepxcackaofrwsjvh.exe'
- %TEMP%\xubkwafyw.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\svchost.exe
- %TEMP%\xubkwafyw.exe
- %APPDATA%\egkepxcackaofrwsjvh.exe
- 'us#.##lipsemc.com':8337
- 'il##oip.it':80
- il##oip.it/
- DNS ASK us#.##lipsemc.com
- DNS ASK www.il##oip.it
- DNS ASK il##oip.it
- ClassName: 'Indicator' WindowName: ''