Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftSDN' = '%WINDIR%.old\Windows\MicrosoftSilverSettings\WindowsExplorer\WindowsSDN.lnk'
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %APPDATA%\hide.bat
- %WINDIR%.old\Windows\MicrosoftSilverSettings\CurrentVersion\CongLang.bat
- %WINDIR%.old\Windows\MicrosoftSilverSettings\MicrosoftAPI\iscsiclix32.exe
- %WINDIR%.old\Windows\MicrosoftSilverSettings\MicrosoftManagerServices\WebDeploymentTracing.exe
- %WINDIR%.old\Windows\MicrosoftSilverSettings\MicrosoftOffice\Office16\vcredMSi.vbs
- %WINDIR%.old\Windows\MicrosoftSilverSettings\WindowsExplorer\WindowsSDN.lnk
- %WINDIR%.old\Windows\MicrosoftSilverSettings\WindowsExplorer\WindowsSDN.vbs
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\hide.bat" "
- '<SYSTEM32>\attrib.exe' +h +s "%WINDIR%.old"