Add a missing task scheduler ID, used by gootkit

spender-sandbox · Sep 9, 2016 · a49ca49 · a49ca49
1 parent 5e3e9b2
commit a49ca49
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/hook_special.c b/hook_special.c
@@ -227,7 +227,8 @@ HOOKDEF(HRESULT, WINAPI, CoCreateInstance,
 	}
 	if (!strcmp(idbuf1, "4991D34B-80A1-4291-83B6-3328366B9097") || !strcmp(idbuf1, "5CE34C0D-0DC9-4C1F-897C-100000000003"))
 		pipe("BITS:");
-	if (!strcmp(idbuf1, "0F87369F-A4E5-4CFC-BD3E-73E6154572DD") || !strcmp(idbuf1, "0F87369F-A4E5-4CFC-BD3E-5529CE8784B0"))
+	if (!strcmp(idbuf1, "0F87369F-A4E5-4CFC-BD3E-73E6154572DD") || !strcmp(idbuf1, "0F87369F-A4E5-4CFC-BD3E-5529CE8784B0") ||
+		!strcmp(idbuf1, "148BD52A-A2AB-11CE-B11F-00AA00530503"))
 		pipe("TASKSCHED:");
 	if (!strcmp(idbuf1, "000209FF-0000-0000-C000-000000000046") || !strcmp(idbuf1, "00024500-0000-0000-C000-000000000046") || !strcmp(idbuf1, "91493441-5A91-11CF-8700-00AA0060263B") ||
 		!strcmp(idbuf1, "000246FF-0000-0000-C000-000000000046"))