Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ygh' = 'regsvr32 /s "%APPDATA%\CRNJEUFU.jpg"'
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v ygh /d "regsvr32 /s """%APPDATA%\CRNJEUFU.jpg"""" /f
- ClassName: '(null)' WindowName: 'rydll'
- ClassName: 'Indicator' WindowName: '(null)'