Техническая информация
- %HOMEPATH%\Start Menu\Programs\Startup\RdVcKfeFJScV.lnk
- '<SYSTEM32>\dumprep.exe' 2932 -dm 7 7 %TEMP%\WER6321.dir00\wscript.exe.hdmp 16325836412027144
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\sysdm.cpl,NoExecuteProcessException <SYSTEM32>\wscript.exe
- '<SYSTEM32>\dumprep.exe' 2932 -dm 7 7 %TEMP%\WER6321.dir00\wscript.exe.mdmp 16325836412027124
- '%APPDATA%\KZhG.exe' "%APPDATA%\XPEVS.au3"
- '<SYSTEM32>\wscript.exe'
- <SYSTEM32>\wscript.exe
- %TEMP%\WER6321.dir00\wscript.exe.hdmp
- %TEMP%\WER6321.dir00\wscript.exe.mdmp
- %TEMP%\WER6321.dir00\manifest.txt
- %TEMP%\WER6321.dir00\appcompat.txt
- %TEMP%\kjfyfhl
- %TEMP%\aut1.tmp
- %APPDATA%\XPEVS.au3
- %APPDATA%\KZhG.exe
- %HOMEPATH%\oFlZ8yn4gXn6nBJw\XPEVS.au3
- %HOMEPATH%\oFlZ8yn4gXn6nBJw\KZhG.exe
- %TEMP%\kjfyfhl
- %TEMP%\aut1.tmp
- %APPDATA%\KZhG.exe в %HOMEPATH%\oFlZ8yn4gXn6nBJw\KZhG.exe
- %APPDATA%\XPEVS.au3 в %HOMEPATH%\oFlZ8yn4gXn6nBJw\XPEVS.au3
- ClassName: 'Shell_TrayWnd' WindowName: ''