Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'System' = '%WINDIR%\win32.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\win32.exe' = '%WINDIR%\win32.exe:*:Enabled:ipsec'
- %WINDIR%\win32.exe
- %WINDIR%\win32.exe