Техническая информация
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\findstr.exe' /i "ravmond.exe 360tray.exe kxetray.exe "
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" /v "PendingFileRenameOperations2" /t "REG_MULTI_SZ" /d "\??\%WINDIR%\ime0\0\??%WINDIR%\mui\0\??\%WINDIR%\mui\scripts.ini\0\??\<SYSTEM32>\GroupPolicy\user\Scripts\scripts.ini" /f
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\s1.bat" "
- '<SYSTEM32>\attrib.exe' <SYSTEM32>\GroupPolicy\*.* -r -s -h /s /d
- <SYSTEM32>\GroupPolicy\gpt.ini
- %WINDIR%\Media\error.s1
- %WINDIR%\mui\scripts.ini
- %TEMP%\1.tmp\scripts.ini
- %TEMP%\1.tmp\woti.wav
- %TEMP%\1.tmp\s1.bat
- %TEMP%\1.tmp\we.wav
- %TEMP%\1.tmp\tb.wav
- %TEMP%\1.tmp\we.wav в %WINDIR%\Media\we.bat
- %TEMP%\1.tmp\scripts.ini в %WINDIR%\Media\scripts.ini
- %TEMP%\1.tmp\tb.wav в %WINDIR%\Media\tb.wav
- %TEMP%\1.tmp\woti.wav в %WINDIR%\Media\woti.wav