Technical Information
- [\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'kukuqi' = 'C:\rail.exe'
- [<HKLM>\System\CurrentControlSet\Services\PDFConvert] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\PDFConvert] 'ImagePath' = 'C:\rail.exe'
- C:\rail.exe
- C:\searchengine.dll
- C:\sqlite3.dll
- C:\1.exe
- C:\libeay32.dll
- C:\rail.exe
- C:\searchengine.dll
- C:\sqlite3.dll
- C:\1.exe
- C:\libeay32.dll
- 'localhost':8000
- ClassName: 'EDIT' WindowName: ''
- 'C:\1.exe'
- 'C:\rail.exe'
- 'C:\rail.exe' ' (with hidden window)