Technical Information
- [HKLM\System\CurrentControlSet\Services\TaskKill] 'Start' = '00000000'
- [HKLM\System\CurrentControlSet\Services\TaskKill] 'ImagePath' = '%TEMP%\Иисус.sys'
- 'TaskKill' %TEMP%\Иисус.sys
- %WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.02558\setuputility.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\mscorsvw.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\ilasm.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\caspol.exe
- %TEMP%\иисус.sys
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.02558\setuputility.exe'