Техническая информация
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Adobe' = 'C:\Drivers\Explorer\adobereader.exe'
- C:\drivers\explorer\adobereader.exe
- C:\drivers\explorer\nt.vbs
- C:\drivers\explorer\win.bat
- ClassName: 'EDIT' WindowName: ''
- '%WINDIR%\syswow64\wscript.exe' "C:\Drivers\Explorer\nt.vbs"
- 'C:\drivers\explorer\adobereader.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Drivers\Explorer\win.bat" " (со скрытым окном)
- '%WINDIR%\syswow64\attrib.exe' +s +h C:\Drivers