Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\PSEXESVC] 'ImagePath' = '%WINDIR%\PSEXESVC.exe'
- 'PSEXESVC' %WINDIR%\PSEXESVC.exe
- C:\zbxcdc\psexec.exe
- C:\zbxcdc\anti-registration.exe
- C:\zbxcdc\zbxcdc.txt
- %WINDIR%\psexesvc.exe
- <SYSTEM32>\config\systemprofile\appdata\local\gdipfontcachev1.dat
- C:\zbxcdc\zbxcdc.txt
- 'C:\zbxcdc\psexec.exe' -accepteula -i -s "c:\zbxcdc\Anti-Registration.exe"
- '%WINDIR%\psexesvc.exe'
- 'C:\zbxcdc\anti-registration.exe'