Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\r_server] 'Start' = '00000002'
- %WINDIR%\Help\svchost.exe /start
- %WINDIR%\Help\svchost.exe /service
- <SYSTEM32>\system33\111.exe
- %WINDIR%\Help\svchost.exe /install /silence
- <SYSTEM32>\reg.exe delete "HKEY_LOCAL_MACHINE\SYSTEM\RAdmin" /f
- <SYSTEM32>\reg.exe import 111.reg
- %WINDIR%\regedit.exe /s 111.reg
- <SYSTEM32>\cmd.exe /c ""%WINDIR%\Temp\a00687.bat" "<SYSTEM32>\system33\111.exe" "
- <SYSTEM32>\netsh.exe firewall add allowedprogram "%WINDIR%\help\svchost.exe" "Remote %USERNAME% Server" ENABLE
- <SYSTEM32>\reg.exe export "HKEY_LOCAL_MACHINE\SYSTEM\RAdmin" 123.reg
- %WINDIR%\Help\svchost.exe
- %WINDIR%\Temp\a00687.bat
- %WINDIR%\Help\raddrv.dll
- %WINDIR%\Help\admdll.dll
- <SYSTEM32>\system33\111.exe
- <SYSTEM32>\system33\raddrv.dll
- <SYSTEM32>\system33\svchost.exe
- <SYSTEM32>\system33\DEL.bat
- <SYSTEM32>\system33\111.reg
- <SYSTEM32>\system33\admdll.dll
- %WINDIR%\Temp\a00687.bat
- %WINDIR%\Temp\a00687.bat
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''