Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\WAN64SVC] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\WAN64SVC] 'ImagePath' = '%TEMP%\temp03x.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\WAN32SVC] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\WAN32SVC] 'ImagePath' = '%TEMP%\temp02x.sys'
- %TEMP%\temp0x3.exe
- NtQueryDirectoryFile, драйвер-обработчик: temp02x.sys
- %TEMP%\temp02x.sys
- %TEMP%\temp03x.sys
- %TEMP%\temp0x2.exe
- %TEMP%\temp0x3.exe
- %TEMP%\temp0x2.exe
- %TEMP%\temp0x3.exe
- %TEMP%\temp02x.sys
- %TEMP%\temp03x.sys