Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Con_service' = 'c:\RECYCLED\all1\CON.exe'
- C:\RECYCLED\all1\PRN.exe
- C:\RECYCLED\all1\CON.exe
- <SYSTEM32>\cmd.exe /c \\.\c:\RECYCLED\all1\cp.bat
- <SYSTEM32>\net1.exe share ALL-You-Need=c:\RECYCLED\All
- <SYSTEM32>\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /v sysUpload /t REG_SZ /d <SYSTEM32>\sysUpload.exe
- <SYSTEM32>\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /v Con_service /t REG_SZ /d c:\RECYCLED\all1\CON.exe
- <SYSTEM32>\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState /f /v FullPath /t REG_DWORD /d 1
- <SYSTEM32>\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState /f /v FullPath /t REG_DWORD /d 1
- <SYSTEM32>\sysUpload.exe
- C:\RECYCLED\all1\cp.bat
- C:\RECYCLED\all\Have_Fun_Stuff.exe
- %HOMEPATH%\My Documents\Heat_You_Traitor.exe
- C:\RECYCLED\all1\PRN.exe
- C:\RECYCLED\all1\auto.txt
- C:\RECYCLED\desktop.ini
- C:\RECYCLED\all1\c.exe
- C:\RECYCLED\all1\CON.exe
- C:\RECYCLED\desktop.ini