Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Corporation' = '%WINDIR%\system\smss.exe'
- '<SYSTEM32>\wscript.exe' "<SYSTEM32>\s4c.vbs"
- <SYSTEM32>\s4c.vbs
- %WINDIR%\system\smss.exe
- <SYSTEM32>\s4c.vbs
- %WINDIR%\system\smss.exe
- <SYSTEM32>\logon.scr
- <SYSTEM32>\s4c.vbs
- <SYSTEM32>\sethc.exe
- <SYSTEM32>\utilman.exe