Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'debugger' = 'mshta vbscript:msgbox("Çë²»Òª³¢ÊÔÖÕÖ¹P3P¹âËÙÏÂÔØÆ÷£¡·ñÔòÄãµÄµçÄÔ½«»á̱»¾...
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe] 'debugger' = 'mshta vbscript:msgbox("Çë²»Òª³¢ÊÔÖÕÖ¹P3P¹âËÙÏÂÔØÆ÷£¡·ñÔòÄãµÄµçÄÔ½«»á̱»...
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntsd.exe] 'debugger' = 'mshta vbscript:msgbox("Çë²»Òª³¢ÊÔÖÕÖ¹P3P¹âËÙÏÂÔØÆ÷£¡·ñÔòÄãµÄµçÄÔ½«»á̱»¾£¡"...
- %TEMP%\e_n60005\krnln.fnr
- %TEMP%\e_n60005\eapi.fne
- ClassName: '' WindowName: 'taskmgr.exe'