Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\usb8028x] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\usb8028] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\EmonSrv] 'Start' = '00000002'
- '<SYSTEM32>\lfrmewrk.exe'
- '<SYSTEM32>\MSRundll.exe' <SYSTEM32>\bofang.dll,Always
- '<SYSTEM32>\lfrmewrk.exe' -s
- '%WINDIR%\1.tmp' /S
- '<SYSTEM32>\lfrmewrk.exe' -i
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\hbcmd.dll"
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\HelpIE.dll"
- NtSetValueKey, драйвер-обработчик: usb8028x.sys
- NtDeleteValueKey, драйвер-обработчик: usb8028x.sys
- NtDeleteKey, драйвер-обработчик: usb8028x.sys
- <SYSTEM32>\hbcmd.dll
- <SYSTEM32>\tmp335.tmp
- <SYSTEM32>\tmp333.tmp
- <SYSTEM32>\tmp334.tmp
- <SYSTEM32>\bofang.dll
- <SYSTEM32>\MSRundll.exe
- <SYSTEM32>\83-105-7163
- <DRIVERS>\usb8028x.sys
- <SYSTEM32>\lfrmewrk.exe
- <DRIVERS>\usb8028.sys
- %TEMP%\bofang.dll
- %TEMP%\RGInstall.dll
- %TEMP%\nsz3.tmp
- <SYSTEM32>\67-105-7163
- %WINDIR%\1.tmp
- %TEMP%\lfrmewrk.exe
- %TEMP%\nsi4.tmp\System.dll
- %TEMP%\hbcmd.dll
- %TEMP%\usb8028.sys
- %TEMP%\usb8028x.sys
- %TEMP%\RGInstall.dll
- %TEMP%\nsi4.tmp\System.dll
- %WINDIR%\1.tmp
- %TEMP%\bofang.dll
- %TEMP%\hbcmd.dll
- %TEMP%\lfrmewrk.exe
- 'cc#.#oolans.com':80
- DNS ASK cc#.#oolans.com
- DNS ASK ya###.com.cn