Техническая информация
- <SYSTEM32>\tasks\microsoft\windows\devicedirectoryclient\handleaudio
- <SYSTEM32>\tasks\microsoft\windows\devicedirectoryclient\handleaudiocommand
- %TEMP%\rarsfx0\loader.exe
- %TEMP%\rarsfx0\load.vbs
- %ProgramFiles(x86)%\realtek\audio\realtekservice.cat
- %ProgramFiles(x86)%\realtek\audio\realtekservice.inf
- %ProgramFiles(x86)%\realtek\audio\rtcom32.dll
- %ProgramFiles(x86)%\realtek\audio\rtdataproc32.dll
- %ProgramFiles(x86)%\realtek\audio\rtkapi32u.dll
- %ProgramFiles(x86)%\realtek\audio\rtkauduservice32.exe
- %ProgramFiles(x86)%\realtek\audio\rtkauduserviceconf32.dll
- %ProgramFiles(x86)%\realtek\audio\rtkauduserviceres32.dll
- %ProgramFiles(x86)%\realtek\audio\rtkcfg32.dll
- %ProgramFiles(x86)%\realtek\audio\speakerverfdll.dll
- %ProgramFiles(x86)%\realtek\audio\monoseparationenrolldll.dll
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rtkauduservice32.exe.log
- '10#.#7.156.29':5737
- '<DNS_SERVER>':53
- ClassName: 'Edit' WindowName: ''
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\load.vbs"
- '%TEMP%\rarsfx0\loader.exe' -pSAGP9eHKuXnhpfJw0LW2yHeR
- '%ProgramFiles(x86)%\realtek\audio\rtkauduservice32.exe'
- '%TEMP%\rarsfx0\loader.exe' -pSAGP9eHKuXnhpfJw0LW2yHeR (со скрытым окном)