Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\r_server] 'Start' = '00000002'
- %WINDIR%\system\svchost.exe /start
- %WINDIR%\system\svchost.exe /service
- %PROGRAM_FILES%\kernel\111.exe
- %WINDIR%\system\svchost.exe /install /silence
- <SYSTEM32>\reg.exe import 111.reg
- %WINDIR%\regedit.exe /s 111.reg
- <SYSTEM32>\reg.exe delete "HKEY_LOCAL_MACHINE\SYSTEM\RAdmin" /f
- <SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\111.bat" "
- <SYSTEM32>\reg.exe export "HKEY_LOCAL_MACHINE\SYSTEM\RAdmin" 123.reg
- %PROGRAM_FILES%\kernel\111.exe
- %TEMP%\1.tmp\111.bat
- %PROGRAM_FILES%\kernel\123.reg
- %PROGRAM_FILES%\kernel\svchost.exe
- %WINDIR%\system\admdll.dll
- %WINDIR%\system\svchost.exe
- %WINDIR%\system\raddrv.dll
- %TEMP%\$inst\5.tmp
- %TEMP%\$inst\7.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\4.tmp
- %PROGRAM_FILES%\kernel\AdmDll.dll
- %PROGRAM_FILES%\kernel\raddrv.dll
- %TEMP%\$inst\temp_0.tmp
- %PROGRAM_FILES%\kernel\111.reg
- %TEMP%\$inst\5.tmp
- %TEMP%\$inst\7.tmp
- %TEMP%\1.tmp\111.bat
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\4.tmp
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''