Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\Vwxyab Defghijk Mno] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Vwxyab Defghijk Mno] 'ImagePath' = '%ProgramFiles%\Arrange\Null.jpg'
- C:\1.txt
- C:\2.exe
- C:\64.cat
- C:\obsglad.pdb
- C:\obs-scripting.pdb
- C:\qmusbguard.tpc
- C:\qqpcclinic.rdb
- C:\qqpcsoftmgr.rdb
- C:\w32-pthreads.pdb
- C:\x64.inf
- %ProgramFiles%\arrange\null.jpg
- %ProgramFiles%\arrange\null.jpg
- C:\2.exe в <SYSTEM32>\1341719.bak
- '21#.#3.59.38':8090
- ClassName: 'EDIT' WindowName: ''
- 'C:\2.exe'
- '%ProgramFiles%\arrange\null.jpg'
- '<SYSTEM32>\notepad.exe' C:\1.txt