Technical Information
- [<HKLM>\System\CurrentControlSet\Services\d812a079] 'ImagePath' = '<SYSTEM32>\d812a079.sys'
- <SYSTEM32>\d812a079.drv
- \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009
- %TEMP%\liv1.tmp
- <SYSTEM32>\verclsid.exe
- %TEMP%\liv1.tmp
- from <SYSTEM32>\d812a079.drv to <SYSTEM32>\d812a079.sys
- %TEMP%\liv1.tmp
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> >> NUL' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> >> NUL