Техническая информация
- %HOMEPATH%\Start Menu\Programs\Startup\photos.exe.lnk
- '<SYSTEM32>\reg.exe' delete "hklm\software\kasperskylab\components\102" /f
- '<SYSTEM32>\reg.exe' delete "hklm\software\microsoft\curentversion\instaler\userdata\s-1-5-18\components\2725a89474cb12c" /f
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\1.bat" "
- %WINDIR%\photos.exe
- %WINDIR%\1.bat
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'