Technical Information
- [HKLM\SYSTEM\CurrentControlSet\Services\Beijin_clone_01_BF3236C3.sys] 'ImagePath' = '%WINDIR%\Temp\Beijin_clone_01_BF3236C3.sys'
- 'Beijin_clone_01_BF3236C3.sys' %WINDIR%\Temp\Beijin_clone_01_BF3236C3.sys
- Windows Firewall
- Windows Security Center
- Windows Defender
- conout$
- %WINDIR%\temp\beijin_clone_01_bf3236c3.sys
- '<SYSTEM32>\rundll32.exe' <Full path to file>,Initialize