Техническая информация
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe] 'Debugger' = '<SYSTEM32>\ctfmongem.exe'
- D:\windows\syswow64\ctfmongem.exe
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\windows\system32\config\software.log1
- D:\windows\system32\config\software
- D:\users\user\ntuser.dat.log1
- D:\users\user\ntuser.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\system volume information\syscache.hve.log1
- D:\system volume information\syscache.hve
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\config\system.log1
- D:\windows\system32\config\system
- D:\windows\system32\winevt\logs\application.evtx
- ClassName: 'SystemTray_Main' WindowName: ''