Техническая информация
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '1' = '%ProgramFiles(x86)%\yiyi-luoÖÆ×÷\ahhhh\1.vbs'
- %APPDATA%\microsoft\windows\start menu\programs\startup\1.vbs
- %APPDATA%\microsoft\windows\start menu\programs\startup\2.vbs
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %APPDATA%\microsoft\windows\start menu\1.vbs
- %APPDATA%\microsoft\windows\start menu\2.vbs
- C:\1\1.vbs
- C:\1\2.vbs
- %ProgramFiles(x86)%\yiyi-luoöæ×÷\ahhhh\1.vbs
- %ProgramFiles(x86)%\yiyi-luoöæ×÷\ahhhh\2.vbs
- %ProgramFiles(x86)%\yiyi-luoöæ×÷\ahhhh\3.vbs
- %TEMP%\$inst\temp_0.tmp
- '%WINDIR%\syswow64\wscript.exe' "C:\1\2.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\1\1.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%ProgramFiles(x86)%\yiyi-luoÖÆ×÷\ahhhh\1.vbs" (со скрытым окном)