Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpgradeManager' = '%WINDIR%\winsfc.exe'
- '%TEMP%\RarSFX0\chp.exe' installer.bat
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V WindowsUpgradeManager /T REG_SZ /D "%WINDIR%\winsfc.exe"
- '<SYSTEM32>\cmd.exe' /c installer.bat
- %TEMP%\RarSFX0\winsfc.exe
- %WINDIR%\winsfc.exe
- %TEMP%\RarSFX0\chp.exe
- %TEMP%\RarSFX0\installer.bat
- %TEMP%\RarSFX0\winsfc.exe
- %TEMP%\RarSFX0\installer.bat
- %TEMP%\RarSFX0\chp.exe
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''