Техническая информация
- '%WINDIR%\run.exe'
- '<SYSTEM32>\regsvr32.exe' /S <SYSTEM32>\Quartz.dll
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{22475450-5E7A-4A9A-8E13-23DC57A7A7A5}\Connection /v IpCheckingEnabled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\regsvr32.exe' /S <SYSTEM32>\directSpy.dll
- '<SYSTEM32>\regsvr32.exe' /S <SYSTEM32>\Proppage.dll
- '<SYSTEM32>\findstr.exe' "}\\{"
- '<SYSTEM32>\sc.exe' config srservice start= DISABLED
- '%WINDIR%\regedit.exe' /s "<SYSTEM32>\????.reg"
- '<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}
- '<SYSTEM32>\sc.exe' config wuauserv start= DEMAND
- %WINDIR%\run.exe
- %TEMP%\aut3.tmp
- %TEMP%\bt2742.bat
- %TEMP%\aut1.tmp
- %WINDIR%\system\830.exe
- %TEMP%\aut2.tmp
- %TEMP%\bt2742.bat
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'