Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\adedcabdefdfb] 'Startup' = 'Startup'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\adedcabdefdfb] 'Logon' = 'Logon'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\adedcabdefdfb] 'DllName' = '<SYSTEM32>\adedcabdefdfb.dll'
Modifies file system :
Creates the following files:
- <SYSTEM32>\.event.log
- <SYSTEM32>\adedcabdefdfb.dll