Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'SCISound' = '"%WINDIR%\rstray.exe" /lanzateRunOnce'
- '%WINDIR%\rstray.exe' /instalando /melt "%WINDIR%\temp\ok.exe"
- '%WINDIR%\Temp\ok.exe'
- %WINDIR%\rstray.exe
- %WINDIR%\Temp\1.jpg
- %WINDIR%\Temp\ok.exe
- %WINDIR%\Temp\ok.exe
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'