Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinShell' = 'C:\WinShell\WinSeven.exe'
- '<SYSTEM32>\REG.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinShell /t REG_SZ /d C:\WinShell\WinSeven.exe /f
- C:\WinShell\WinSeven.exe
- ClassName: 'Indicator' WindowName: '(null)'