webshell

Ghost Exploiter Team Official

C:/Windows/System32/DriverStore/FileRepository/memory.inf_amd64_38464a9328c12df1/

File / Folder	Size	Action
.	-
memory.inf	3.125KB	edt ren
pnpmem.sys	48KB	edt ren

��
�
�[�V�e�r�s�i�o�n�]�
�
�S�i�g�n�a�t�u�r�e�=�"�$�W�I�N�D�O�W�S� �N�T�$�"�
�
�C�l�a�s�s�=�M�e�m�o�r�y�
�
�C�l�a�s�s�G�u�i�d�=�{�5�0�9�9�9�4�4�A�-�F�6�B�9�-�4�0�5�7�-�A�0�5�6�-�8�C�5�5�0�2�2�8�5�4�4�C�}�
�
�P�r�o�v�i�d�e�r�=�%�M�S�F�T�%�
�
�P�n�p�L�o�c�k�d�o�w�n�=�1�
�
�D�r�i�v�e�r�V�e�r� �=� �0�6�/�2�1�/�2�0�0�6�,�1�0�.�0�.�2�0�3�4�8�.�1�
�
�
�
�[�S�o�u�r�c�e�D�i�s�k�s�N�a�m�e�s�]�
�
�3�4�2�6�=�w�i�n�d�o�w�s� �c�d�
�
�
�
�[�S�o�u�r�c�e�D�i�s�k�s�F�i�l�e�s�]�
�
�p�n�p�m�e�m�.�s�y�s� �	�	�=� �3�4�2�6�
�
�
�
�[�D�e�s�t�i�n�a�t�i�o�n�D�i�r�s�]�
�
�D�e�f�a�u�l�t�D�e�s�t�D�i�r� �=� �1�2�
�
�
�
�[�M�a�n�u�f�a�c�t�u�r�e�r�]�
�
�%�M�S�F�T�%�=�M�i�c�r�o�s�o�f�t�,�N�T�a�m�d�6�4�
�
�
�
�[�M�i�c�r�o�s�o�f�t�.�N�T�a�m�d�6�4�]�
�
�%�*�p�n�p�0�c�8�0�.�D�e�v�i�c�e�D�e�s�c�%� �=� �P�N�P�M�E�M�_�I�n�s�t�,�A�C�P�I�\�P�N�P�0�C�8�0�
�
�
�
�[�P�N�P�M�E�M�_�I�n�s�t�.�N�T�]�
�
�C�o�p�y�f�i�l�e�s� �=� �P�N�P�M�E�M�_�C�o�p�y�f�i�l�e�s�
�
�
�
�[�P�N�P�M�E�M�_�C�o�p�y�f�i�l�e�s�]�
�
�p�n�p�m�e�m�.�s�y�s�,�,�,�0�x�1�0�0�
�
�
�
�[�P�N�P�M�E�M�_�I�n�s�t�.�N�T�.�S�e�r�v�i�c�e�s�]�
�
�A�d�d�S�e�r�v�i�c�e� �=� �P�N�P�M�E�M�,�%�S�P�S�V�C�I�N�S�T�_�A�S�S�O�C�S�E�R�V�I�C�E�%�,�P�N�P�M�E�M�_�S�e�r�v�i�c�e�_�I�n�s�t�,�P�N�P�M�E�M�_�E�v�e�n�t�L�o�g�_�I�n�s�t�
�
�
�
�[�P�N�P�M�E�M�_�S�e�r�v�i�c�e�_�I�n�s�t�]�
�
�D�i�s�p�l�a�y�N�a�m�e� � � � �=� �%�P�N�P�M�E�M�.�S�v�c�D�e�s�c�%�
�
�S�e�r�v�i�c�e�T�y�p�e� � � � �=� �%�S�E�R�V�I�C�E�_�K�E�R�N�E�L�_�D�R�I�V�E�R�%�
�
�S�t�a�r�t�T�y�p�e� � � � � � �=� �%�S�E�R�V�I�C�E�_�D�E�M�A�N�D�_�S�T�A�R�T�%�
�
�E�r�r�o�r�C�o�n�t�r�o�l� � � �=� �%�S�E�R�V�I�C�E�_�E�R�R�O�R�_�N�O�R�M�A�L�%�
�
�S�e�r�v�i�c�e�B�i�n�a�r�y� � �=� �%�1�2�%�\�p�n�p�m�e�m�.�s�y�s�
�
�
�
�[�P�N�P�M�E�M�_�E�v�e�n�t�L�o�g�_�I�n�s�t�]�
�
�A�d�d�R�e�g�=�P�N�P�M�E�M�_�E�v�e�n�t�L�o�g�_�A�d�d�R�e�g�
�
�
�
�[�P�N�P�M�E�M�_�E�v�e�n�t�L�o�g�_�A�d�d�R�e�g�]�
�
�H�K�R�,�,�E�v�e�n�t�M�e�s�s�a�g�e�F�i�l�e�,�0�x�0�0�0�2�0�0�0�0�,�"�%�%�S�y�s�t�e�m�R�o�o�t�%�%�\�S�y�s�t�e�m�3�2�\�I�o�L�o�g�M�s�g�.�d�l�l�;�%�%�S�y�s�t�e�m�R�o�o�t�%�%�\�S�y�s�t�e�m�3�2�\�d�r�i�v�e�r�s�\�p�n�p�m�e�m�.�s�y�s�"�
�
�H�K�R�,�,�T�y�p�e�s�S�u�p�p�o�r�t�e�d�,�0�x�0�0�0�1�0�0�0�1�,�7�
�
�
�
�[�s�t�r�i�n�g�s�]�
�
�;�L�o�c�a�l�i�z�a�b�l�e�
�
�M�S�F�T� � � � � � � � � � � � � � � � � � �=� �"�M�i�c�r�o�s�o�f�t�"�
�
�*�p�n�p�0�c�8�0�.�D�e�v�i�c�e�D�e�s�c� � � �=� �"�M�e�m�o�r�y� �M�o�d�u�l�e�"�
�
�P�N�P�M�E�M�.�S�v�c�D�e�s�c� � � � � � � � �=� �"�M�i�c�r�o�s�o�f�t� �M�e�m�o�r�y� �M�o�d�u�l�e� �D�r�i�v�e�r�"�
�
�
�
�;�N�o�n�-�l�o�c�a�l�i�z�a�b�l�e�
�
�S�P�S�V�C�I�N�S�T�_�T�A�G�T�O�F�R�O�N�T� � �=� �0�x�0�0�0�0�0�0�0�3�
�
�S�P�S�V�C�I�N�S�T�_�A�S�S�O�C�S�E�R�V�I�C�E�=� �0�x�0�0�0�0�0�0�0�2�
�
�S�E�R�V�I�C�E�_�K�E�R�N�E�L�_�D�R�I�V�E�R� �=� �1�
�
�S�E�R�V�I�C�E�_�B�O�O�T�_�S�T�A�R�T� � � � �=� �0�
�
�S�E�R�V�I�C�E�_�S�Y�S�T�E�M�_�S�T�A�R�T� � �=� �1�
�
�S�E�R�V�I�C�E�_�D�E�M�A�N�D�_�S�T�A�R�T� � �=� �3�
�
�S�E�R�V�I�C�E�_�E�R�R�O�R�_�N�O�R�M�A�L� � �=� �1�
�
�S�E�R�V�I�C�E�_�E�R�R�O�R�_�I�G�N�O�R�E� � �=� �0�
�
�R�E�G�_�E�X�P�A�N�D�_�S�Z� � � � � � � � � �=� �0�x�0�0�0�2�0�0�0�0�
�
�R�E�G�_�D�W�O�R�D� � � � � � � � � � � � � �=� �0�x�0�0�0�1�0�0�0�1�
�
�R�E�G�_�S�Z� � � � � � � � � � � � � � � � �=� �0�x�0�0�0�0�0�0�0�0�
�
�

<=Back