Техническая информация
- <SYSTEM32>\tasks\limerat-admin
- taskwhost.exe
- %APPDATA%\subdir\taskwhost.exe
- '20#.#85.123.144':80
- '20#.#85.123.144':22
- '20#.#85.123.144':22
- '%APPDATA%\subdir\taskwhost.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'%APPDATA%\Subdir\taskwhost.exe'"' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'%APPDATA%\Subdir\taskwhost.exe'"