Техническая информация
- [<HKLM>\SOFTWARE\Classes\odfile\shell\open\command] '' = 'explorer /n,"%PROGRAM_FILES%\T%H"'
- [<HKLM>\SOFTWARE\Classes\opfile\shell\open\command] '' = 'explorer /n,"%PROGRAM_FILES%\%H"'
- %TEMP%\nsq2.tmp\ns3.tmp c:\3730.bat
- <SYSTEM32>\wbem\wmic.exe userAccount where "Name='%USERNAME%'" get SID /value
- <SYSTEM32>\cmd.exe /c c:\3730.bat
- [<HKCU>\Software\FlashFXP]
- %TEMP%\nsq2.tmp\ns3.tmp
- %TEMP%\tmp4.tmp
- %TEMP%\tmp5.tmp
- %TEMP%\nsq2.tmp\System.dll
- C:\3730.bat
- %TEMP%\nsq2.tmp\nsExec.dll
- %TEMP%\tmp4.tmp