Техническая информация
- <SYSTEM32>\tasks\nightfallservice
- %APPDATA%\nightfallservice.exe
- %TEMP%\tmp3b89.tmp.bat
- nul
- 'localhost':7707
- '45.#3.2.61':8808
- 'localhost':6606
- '45.#3.2.61':1604
- '%APPDATA%\nightfallservice.exe'
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "NightFallService" /tr '"%APPDATA%\NightFallService.exe"' & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "NightFallService" /tr '"%APPDATA%\NightFallService.exe"' & exit
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc onlogon /rl highest /tn "NightFallService" /tr '"%APPDATA%\NightFallService.exe"'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tmp3B89.tmp.bat""
- '%WINDIR%\syswow64\timeout.exe' 3