Техническая информация
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'nvwrmsxmlClient' = 'rundll32.exe "%LOCALAPPDATA%\nvwrmsxmlClient\nvwrmsxmlClient.dll", DllInit'
- Библиотека-обработчик для всех процессов: %LOCALAPPDATA%\nvwrmsxmlClient\nvwrmsxmlClient.dll
- %TEMP%\sckbdtools.dll
- %LOCALAPPDATA%\nvwrmsxmlclient\nvwrmsxmlclient.dll
- %TEMP%\sckbdtools.dll
- '%WINDIR%\syswow64\regsvr32.exe' /i /n /s "%TEMP%\sckbdtools.dll"
- '%WINDIR%\syswow64\rundll32.exe' "%LOCALAPPDATA%\nvwrmsxmlClient\nvwrmsxmlClient.dll", DllInit