Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\nwapi] 'Startup' = 'S'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\nwapi] 'DLLName' = 'nwapi.dll'
- '<SYSTEM32>\ntvdm.exe' -f -i1
- %TEMP%\7794ca92.exe
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
- <SYSTEM32>\b064572f.dll
- <SYSTEM32>\3fd26e99.dll
- <SYSTEM32>\nwapi.dll
- <SYSTEM32>\456278c0.dll
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-afc.b00.380001'