Техническая информация
- %HOMEPATH%\start menu\programs\startup\setup.js
- %TEMP%\dllm.js
- %TEMP%\setup.exe
- %TEMP%\setup.js
- DNS ASK m9#.net
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- '<SYSTEM32>\wscript.exe' "%TEMP%\setup.js"
- '<SYSTEM32>\wscript.exe' "%TEMP%\dllm.js"
- '%TEMP%\setup.exe'
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn anydesk /tr "%TEMP%\setup.js' (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn anydesk /tr "%TEMP%\setup.js