Technical Information
- [<HKLM>\System\CurrentControlSet\Services\SRDSL] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SRDSL] 'ImagePath' = '<SYSTEM32>\svchost.exe -k "SRDSL"'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SRDSL\Parameters] 'ServiceDll' = '%ProgramFiles(x86)%\Google\1197182.dll'
- 'SRDSL' <SYSTEM32>\svchost.exe -k "SRDSL"
- %ProgramFiles(x86)%\google\1197182.dll
- 'ip.cn':80
- DNS ASK ip.cn
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 1 && del /f/q "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\svchost.exe' -k "SRDSL"
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\google\1197182.dll",MainThread
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 1 && del /f/q "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 1