Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] '1999851' = '{4A6D4E96-7240-4D19-8654-E2F73B19F0E9}'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = 'Msenfi430.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{4A6D4E96-7240-4D19-8654-E2F73B19F0E9}' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] '1985103' = '{4A6D4E96-7240-4D19-8654-E2F73B19F0E9}'
- '<SYSTEM32>\ywmc.exe'
- '<SYSTEM32>\main.exe'
- '<SYSTEM32>\SVCHOTS.exe'
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\Deleteme.bat
- Библиотека-обработчик для всех процессов: <SYSTEM32>\Msenfi430.dll
- <SYSTEM32>\Deleteme.bat
- <SYSTEM32>\ywmc.exe
- <SYSTEM32>\Msenfi430.dll
- <SYSTEM32>\SVCHOTS.exe
- <SYSTEM32>\main.exe
- <SYSTEM32>\ywmc.exe
- <SYSTEM32>\Msenfi430.dll
- <SYSTEM32>\main.exe
- ClassName: 'Rejoice_3.2' WindowName: 'Windows IDE'