Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\xtmtONKw] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\adsdsedt] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\XRCTYDFK] 'ImagePath' = '<DRIVERS>\XRCTYDFK.sys'
- '<SYSTEM32>\Setup\servero.exe'
- '%CommonProgramFiles%\Microsoft Shared\MSInfo\iLaeaU4j.exe'
- '<SYSTEM32>\svchdsort.exe'
- '<SYSTEM32>\svchdsortpp.exe'
- '<SYSTEM32>\sc.exe' Create adsdsedt binPath= "cmd /c start <SYSTEM32>\shoserstyr.exe" type= own type= interact start= auto
- NtWriteVirtualMemory, драйвер-обработчик: XRCTYDFK.sys
- NtReadVirtualMemory, драйвер-обработчик: XRCTYDFK.sys
- NtOpenProcess, драйвер-обработчик: XRCTYDFK.sys
- <SYSTEM32>\svchdsortpp.exe
- <SYSTEM32>\Setup\servero.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\iLaeaU4j.exe
- <DRIVERS>\XRCTYDFK.sys
- <SYSTEM32>\svchdsort.exe
- <SYSTEM32>\shoserstyr.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\iLaeaU4j.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\iLaeaU4j.exe
- <DRIVERS>\XRCTYDFK.sys
- 'qw####800.gicp.net':8010
- 'do##.u.gsie.cn':8089
- DNS ASK qw####800.gicp.net
- DNS ASK .#.
- DNS ASK do##.u.gsie.cn
- ClassName: 'MS_WINHELP' WindowName: '(null)'
- ClassName: 'TAppBuilder' WindowName: '(null)'