Technical Information
- [<HKLM>\System\CurrentControlSet\Services\defragsrv] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\defragsrv] 'ImagePath' = '<Full path to file>'
- <Current directory>\msvsc.dll
- %PROGRAMDATA%\datakeys\hds
- %WINDIR%\logg.bat
- %PROGRAMDATA%\datakeys\runs.txt
- %PROGRAMDATA%\datakeys\pos.txt
- %PROGRAMDATA%\datakeys\st.xpi
- C:\teslarvng\teslarvng.hta
- '<LOCALNET>.75.211':445
- '<LOCALNET>.75.211':139
- '91.##9.239.123':80
- '<SYSTEM32>\sc.exe' create defragsrv binpath= "<Full path to file>" start= auto' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\logg.bat' (with hidden window)
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet' (with hidden window)
- '<SYSTEM32>\sc.exe' start defragsrv' (with hidden window)
- '<SYSTEM32>\sc.exe' create defragsrv binpath= "<Full path to file>" start= auto
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\logg.bat
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\sc.exe' start defragsrv