Техническая информация
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'WinSCP' = 'wscript.exe "%WINDIR%\winscp.vbs"'
- %WINDIR%\winscp.vbs
- %TEMP%\ftp_script.txt
- %WINDIR%\winscp.vbs
- '3.##.52.71':80
- http://3.##.52.71/download/tmp.vbs
- '<SYSTEM32>\wscript.exe' "%WINDIR%\winscp.vbs"
- '<SYSTEM32>\wscript.exe' "%WINDIR%\winscp.vbs" (со скрытым окном)