Technical Information
- [<HKLM>\System\CurrentControlSet\Services\DevicePickerUserS_0xDevicePickerA] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\DevicePickerUserS_0xDevicePickerA] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs -p'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\DevicePickerUserS_0xDevicePickerA\Parameters] 'ServiceDll' = '%ProgramFiles(x86)%\AppToAvi.dll'
- %ProgramFiles(x86)%\apptoavi.dll
- from <Full path to file> to %WINDIR%\syswow64\1074531.bak
- 'bj##tj.com':19950
- DNS ASK bj##tj.com
- '%WINDIR%\syswow64\svchost.exe' -k netsvcs -p