Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Kfrhiy iabtka] 'Start' = '00000002'
- '%WINDIR%\Kingsoft.com'
- '<SYSTEM32>\wscript.exe' "C:\5768.vbs"
- C:\5768.vbs
- %WINDIR%\Kingsoft.com
- C:\5768.vbs
- 'q4####2519.3322.org':2012
- DNS ASK q4####2519.3322.org