Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\userinit.exe] 'Debugger' = 'knylb.exe'
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\csrss.exe
- iexplore.exe
- firefox.exe
- <SYSTEM32>\knylb.exe
- 'bu##zami.cn':80
- bu##zami.cn/bdsm/1.8?rn############
- DNS ASK wpad.localdomain
- DNS ASK bu##zami.cn