Техническая информация
- '%WINDIR%\syswow64\reg.exe' EXPORT HKCU\Software\Microsoft\Office\16.0\Excel\Security C:\Users\Public\Qba.reg /y
- <SYSTEM32>\csrss.exe
- <SYSTEM32>\fontdrvhost.exe
- C:\users\public\alhlrl.dat
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- '<SYSTEM32>\devicecensus.exe' UserCxt