Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\core] 'ImagePath' = 'system32\drivers\core.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\core] 'Start' = '00000001'
- NtReplaceKey, handler: core.sys
- NtOpenKey, handler: core.sys
- NtSetValueKey, handler: core.sys
- NtRestoreKey, handler: core.sys
- NtLoadKey, handler: core.sys
- NtCreateKey, handler: core.sys
- NtClose, handler: core.sys
- NtDeleteValueKey, handler: core.sys
- NtDeleteKey, handler: core.sys
- <DRIVERS>\core.cache.dsk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bootup.exe[1].xml
- %TEMP%\tni1.tmp
- <DRIVERS>\core.sys
- %TEMP%\tni1.tmp
- 'www.in####-r-n-e-t.com':80
- www.in####-r-n-e-t.com/bootup.exe.xml
- DNS ASK www.in####-r-n-e-t.com
- ClassName: 'Shell_TrayWnd' WindowName: ''