Техническая информация
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'GN' = '"%TEMP%\<Имя файла>.exe"'
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %TEMP%\<Имя файла>.exe
- %HOMEPATH%\documents\desktop.ini.gone
- %HOMEPATH%\pictures\desktop.ini.gone
- %HOMEPATH%\desktop\adhd_and_obesity.docx.gone
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.gone
- %HOMEPATH%\desktop\coffee.bmp.gone
- %HOMEPATH%\desktop\contosoroot.cer.gone
- %HOMEPATH%\desktop\cveuropeo.doc.gone
- %HOMEPATH%\desktop\dashborder_120.bmp.gone
- %HOMEPATH%\desktop\dashborder_192.bmp.gone
- %HOMEPATH%\desktop\desktop.ini.gone
- %HOMEPATH%\desktop\icq.lnk.gone
- %HOMEPATH%\desktop\mail.ru agent.lnk.gone
- %HOMEPATH%\desktop\qip 2012.lnk.gone
- %HOMEPATH%\desktop\telegram.lnk.gone
- %HOMEPATH%\desktop\total commander 64 bit.lnk.gone