Technical Information
- '<SYSTEM32>\sc.exe' delete RsRavMon
- '<SYSTEM32>\sc.exe' stop ekrn
- '<SYSTEM32>\sc.exe' delete ekrn
- '<SYSTEM32>\sc.exe' stop RsRavMon
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\epn.dll Execute
- '<SYSTEM32>\sc.exe' stop 360rp
- '<SYSTEM32>\sc.exe' delete 360rp
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\sc.exe
- <SYSTEM32>\cmd.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\ctfmon.exe
- ekrn.exe
- 360tray.exe
- <SYSTEM32>\epn.dll
- C:\pci.sys
- C:\Driver.sys
- <SYSTEM32>\epn.dll
- C:\Driver.sys
- C:\pci.sys