Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '%WINDIR%\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UserFaultCheck' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '%WINDIR%\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Firewall' = '%PROGRAM_FILES%\winlogon.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Firewall' = '%PROGRAM_FILES%\winlogon.exe'
- %PROGRAM_FILES%\winlogon.exe
- <SYSTEM32>\winlogon.exe
- %APPDATA%\google_r8[H1_6]x6-t.tmp
- %WINDIR%\pchealth\ERRORREP\UserDumps\winlogon.exe.20110929-152904-00.hdmp
- %WINDIR%\ctfmon.exe
- %PROGRAM_FILES%\winlogon.exe
- %WINDIR%\pchealth\ERRORREP\UserDumps\winlogon.exe.20110929-152904-00.mdmp
- %WINDIR%\ctfmon.exe
- %PROGRAM_FILES%\winlogon.exe
- 'ra###bitch.ru':6667
- DNS ASK ra###bitch.ru
- '<Private IP address>':1033
- ClassName: '' WindowName: 'BitDefender Firewall Alert'
- ClassName: '' WindowName: 'Windows Security Alert'
- ClassName: 'Indicator' WindowName: ''