Техническая информация
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'HKLM' = '%WINDIR%\InstallDir\Server.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'HKCU' = '%WINDIR%\InstallDir\Server.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A27K711P-13T3-AHA2-58TF-7N17II87I2TG}] 'StubPath' = '%WINDIR%\InstallDir\Server.exe restart'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A27K711P-13T3-AHA2-58TF-7N17II87I2TG}] 'StubPath' = '%WINDIR%\InstallDir\Server.exe'
- %WINDIR%\syswow64\svchost.exe
- %TEMP%\fed-684143
- %WINDIR%\installdir\server.exe
- 'localhost':81
- '%TEMP%\fed-684143'
- '%TEMP%\fed-684143' ' (со скрытым окном)
- '%WINDIR%\syswow64\svchost.exe'