Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\IpOverUsbSvco idf] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\IpOverUsbSvco idf] 'ImagePath' = '%ProgramFiles%\Windows Media Player\csrss.exe'
- %ProgramFiles%\Windows Media Player\csrss.exe
- from <Full path to file> to <SYSTEM32>\129062.bak
- '44#.mpc.cn':9082
- DNS ASK 44#.mpc.cn
- '%ProgramFiles%\Windows Media Player\csrss.exe'