Техническая информация
- [<HKLM>\SYSTEM\CurrentControlSet\Services\David] 'ImagePath' = '%WINDIR%\David.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\1] 'ImagePath' = '%WINDIR%\1.sys'
- 'David' %WINDIR%\David.sys
- '1' %WINDIR%\1.sys
- <Текущая директория>\ø³ëåøèèГìµõú\î¾ã³ïñ¼·ôè.ink
- %WINDIR%\david.sys
- %WINDIR%\1.sys
- %WINDIR%\temp\udde6bd.tmp
- %WINDIR%\temp\udde6ce.tmp
- %WINDIR%\temp\uddeebe.tmp
- %WINDIR%\temp\uddfe01.tmp
- %WINDIR%\temp\udd5e2.tmp
- %WINDIR%\temp\udddb3.tmp
- %WINDIR%\temp\udd1584.tmp
- <Текущая директория>\ø³ëåøèèГìµõú\î¾ã³ïñ¼·ôè.lnk
- %WINDIR%\temp\udde6ce.tmp
- %WINDIR%\temp\udde6bd.tmp
- %WINDIR%\temp\uddeebe.tmp
- %WINDIR%\temp\uddfe01.tmp
- %WINDIR%\temp\udd5e2.tmp
- %WINDIR%\temp\udddb3.tmp
- %WINDIR%\temp\udd1584.tmp
- <Текущая директория>\ø³ëåøèèГìµõú\î¾ã³ïñ¼·ôè.ink в <Текущая директория>\ø³ëåøèèГìµõú\î¾ã³ïñ¼·ôè.lnk
- из <Полный путь к файлу> в %TEMP%\1041078\....\temporaryfile