Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\Service1] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Service1] 'ImagePath' = '%WINDIR%\help\svchost.exe'
- %WINDIR%\Help\svchost.exe
- 's5.#77.cn':85
- DNS ASK s5.#77.cn
- '%WINDIR%\Help\svchost.exe' -install
- '%WINDIR%\Help\svchost.exe'