Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'shell' = '%WINDIR%\service.exe'
- %WINDIR%\service.exe
- <SYSTEM32>\cmd.exe /c ""%WINDIR%\server.bat" "
- <SYSTEM32>\ftp.exe -s:%WINDIR%\f.txt
- <SYSTEM32>\ntsd.exe -c q -p 336
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V shell /d "%WINDIR%\service.exe" /f
- 360tray.exe
- %WINDIR%\xx.vbs
- %WINDIR%\f.txt
- %WINDIR%\service.exe
- %WINDIR%\server.bat
- '61.##5.207.130':21
- 'localhost':1036
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''