Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'KHSafeClient Launcher' = '"%TEMP%\SafeLuncher.exe"'
- [<HKLM>\SYSTEM\ControlSet003\Services\COMSysApp] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet002\Services\COMSysApp] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\COMSysApp] 'Start' = '00000002'
- '%TEMP%\11111.exe'
- '%TEMP%\SafeLuncher.exe'
- 'C:\kungho\SafeLuncher.exe'
- '<SYSTEM32>\rundll32.exe' "%CommonProgramFiles%\Microsoft Shared\qrwsih.dll",polmxhat
- '%WINDIR%\regedit.exe' -s "%TEMP%\qrwsihreg.reg"
- '<SYSTEM32>\rundll32.exe' "%TEMP%\qrwsihreg.dll",polmxhat
- %TEMP%\qrwsihreg.dll
- %TEMP%\qrwsihreg.reg
- %CommonProgramFiles%\Microsoft Shared\qrwsih.dll
- %CommonProgramFiles%\Microsoft Shared\qrwsih.exe
- %TEMP%\qrwsih.dll
- %TEMP%\SafeLuncher.exe
- C:\kungho\SafeLuncher.exe
- %TEMP%\VFS.DLL
- %TEMP%\11111.exe
- %TEMP%\qrwsih.dll
- %TEMP%\11111.exe
- %TEMP%\qrwsihreg.dll
- %TEMP%\qrwsihreg.reg
- 'wi####s98.f3322.org':8000
- '<IP-адрес в локальной сети>':15168
- DNS ASK wi####s98.f3322.org
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'MS_WINHELP' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'