Техническая информация
- [<HKLM>\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Policies' = '%WINDIR%\item\install\cs:go.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Policies' = '%WINDIR%\item\install\cs:go.exe'
- [<HKLM>\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{760JC737-10BB-M532-P50X-N413MWHKM1VE}] 'StubPath' = '%WINDIR%\item\install\cs:go.exe Restart'
- %WINDIR%\syswow64\explorer.exe
- <LS_APPDATA>\microsoft\clr_v4.0_32\usagelogs\<Имя файла>.exe.log
- %WINDIR%\item\install\cs:go.exe
- %TEMP%\user2.txt
- %APPDATA%\user-wchelper.dll
- %TEMP%\user7
- %TEMP%\user8
- %APPDATA%\user-wchelper.dll
- %TEMP%\user2.txt
- %TEMP%\user7
- %TEMP%\user8
- %TEMP%\user7
- %TEMP%\user8
- ClassName: 'shell_traywnd' WindowName: ''
- '%WINDIR%\syswow64\explorer.exe'