Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Presentation Foundation Font Cache 3.0.0.0 Patcher' = '<LS_APPDATA>\LWN\spoolsv_upd.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<LS_APPDATA>\LWN\spoolsv_upd.exe' = '<LS_APPDATA>\LWN\spoolsv_upd.exe:*:Enabled:Windows Presentation Foundation Font Cache 3.0.0.0 Patcher'
- '<LS_APPDATA>\LWN\syswinlogon.exe'
- '<LS_APPDATA>\LWN\spoolsv_upd.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "<LS_APPDATA>\LWN\spoolsv_upd.exe" "Windows Presentation Foundation Font Cache 3.0.0.0 Patcher" ENABLE
- <LS_APPDATA>\LWN\syswinlogon.exe
- <LS_APPDATA>\LWN\spoolsv_upd.exe
- 'te####odchang.com':80
- 'qf###mjailm.com':80
- te####odchang.com/teh.php
- qf###mjailm.com/faq.php
- DNS ASK te####odchang.com
- DNS ASK qf###mjailm.com
- ClassName: 'FindWindow' WindowName: 'FindWindow'