Техническая информация
- <SYSTEM32>\tasks\startclickbyenouac
- %TEMP%\rarsfx0\click_bye.zip
- %TEMP%\rarsfx0\install_clickbye.ps1
- %TEMP%\rarsfx0\setup.bat
- nul
- %ProgramFiles%\clickbye\iconv.dll
- %ProgramFiles%\clickbye\intl.dll
- %ProgramFiles%\clickbye\libssl-3-x64.dll
- %ProgramFiles%\clickbye\libxmlsec.dll
- %ProgramFiles%\clickbye\libxmlsec-openssl.dll
- %ProgramFiles%\clickbye\pcre.dll
- %ProgramFiles%\clickbye\app.ico
- %ProgramFiles%\clickbye\clickbye.exe
- %ProgramFiles%\clickbye\glibmm-2.4.dll
- %ProgramFiles%\clickbye\gmodule-2.0-0.dll
- %ProgramFiles%\clickbye\gobject-2.0-0.dll
- %ProgramFiles%\clickbye\gthread-2.0-0.dll
- %ProgramFiles%\clickbye\gueststoreclient.dll
- %ProgramFiles%\clickbye\hgfs.dll
- %HOMEPATH%\desktop\click bye.lnk
- '<DNS_SERVER>':53
- ClassName: 'Edit' WindowName: ''
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\setup.bat" "
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\config\system"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-ExecutionPolicy RemoteSigned -Scope LocalMachine -Force"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -File "install_clickbye.ps1"