Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'loveyouamaarrarar' = '%HOMEPATH%\loveyouamaarrarar\loveyouamaarrarar.vbs -rb'
- loveyouamaarrarar.exe
- %HOMEPATH%\loveyouamaarrarar\loveyouamaarrarar.exe
- %HOMEPATH%\loveyouamaarrarar\loveyouamaarrarar.vbs
- %HOMEPATH%\loveyouamaarrarar\loveyouamaarrarar.exe
- '<SYSTEM32>\wscript.exe' "%HOMEPATH%\loveyouamaarrarar\loveyouamaarrarar.vbs"
- '%HOMEPATH%\loveyouamaarrarar\loveyouamaarrarar.exe'
- '<SYSTEM32>\wscript.exe' "%HOMEPATH%\loveyouamaarrarar\loveyouamaarrarar.vbs"' (со скрытым окном)
- '%HOMEPATH%\loveyouamaarrarar\loveyouamaarrarar.exe' ' (со скрытым окном)
- '<SYSTEM32>\wscript.exe'
- '<SYSTEM32>\cmd.exe' del "%HOMEPATH%\loveyouamaarrarar\loveyouamaarrarar.exe"