Техническая информация
- <SYSTEM32>\tasks\windows\systemcare\microsoft
- %WINDIR%\syswow64\tasklist.exe
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- из <Полный путь к файлу> в %PROGRAMDATA%\microsoftcare.exe
- ClassName: '18467-41' WindowName: ''
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windows\SystemCare\Microsoft /tr "%PROGRAMDATA%\MicrosoftCare.exe" /st 00:00 /sc daily /du 9999:59 /ri 1 /f' (со скрытым окном)
- '%PROGRAMDATA%\microsoftcare.exe' ' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windows\SystemCare\Microsoft /tr "%PROGRAMDATA%\MicrosoftCare.exe" /st 00:00 /sc daily /du 9999:59 /ri 1 /f
- '%WINDIR%\syswow64\tasklist.exe'
- '<SYSTEM32>\taskeng.exe' {99F2F6AF-DFCD-41A5-9B3B-DE0BADEB80F7} S-1-5-21-1960123792-2022915161-3775307078-1001:msowhnqa\user:Interactive:[1]