Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\ЧФ¶ЇК±ЗшёьРВіМРт...] 'ImagePath' = '<SYSTEM32>\srvany.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\ЧФ¶ЇК±ЗшёьРВіМРт...] 'Start' = '00000002'
- '<SYSTEM32>\cmd.exe' /S /D /c" echo # Copyright (c) 1993-1999 Microsoft Corp. "
- '<SYSTEM32>\sc.exe' config UI0Detect start= DISABLED
- '<SYSTEM32>\cmd.exe' /S /D /c" echo # "
- '<SYSTEM32>\findstr.exe' /i "minexmr"
- '<SYSTEM32>\net1.exe' stop UI0Detect
- '<SYSTEM32>\srvany.exe'
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\WindowsUpdate.bat
- '<SYSTEM32>\net.exe' stop UI0Detect
- '<SYSTEM32>\exp1orer.exe'
- %WINDIR%\WindowsUpdate.bat
- <DRIVERS>\etc\$
- <SYSTEM32>\exp1orer.exe
- <SYSTEM32>\srvany.exe
- %WINDIR%\WindowsUpdate.bat
- <SYSTEM32>\exp1orer.exe