Technical Information
- [HKLM\System\CurrentControlSet\Services\kservice] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\kservice] 'ImagePath' = '<SYSTEM32>\svchost -k kservice'
- [HKLM\SYSTEM\CurrentControlSet\Services\kservice\Parameters] 'ServiceDll' = '<SYSTEM32>\hangro.dl_'
- 'kservice' <SYSTEM32>\svchost -k kservice
- %WINDIR%\syswow64\hangro.dl_
- %WINDIR%\help\ajtcjgnqtqj.rux
- DNS ASK fh##.info
- '%WINDIR%\syswow64\svchost.exe' -k kservice