Техническая информация
- <SYSTEM32>\tasks\nafifas
- %WINDIR%\syswow64\cmd.exe
- %TEMP%\images__1__nox_icon.ico
- %APPDATA%\windows defender\windows defender.exe
- '79.##4.225.69':3431
- '%APPDATA%\windows defender\windows defender.exe'
- '%APPDATA%\windows defender\windows defender.exe' ' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\windows defender\windows defender.exe'" /f
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\windows defender\windows defender.exe'" /f
- '%WINDIR%\syswow64\cmd.exe' /C copy "<Полный путь к файлу>" "%APPDATA%\windows defender\windows defender.exe"
- '<SYSTEM32>\taskeng.exe' {4344D2C4-3522-484A-9DB2-3B7BDEFDAC0E} S-1-5-21-1960123792-2022915161-3775307078-1001:tsafpe\user:Interactive:[1]
- '%WINDIR%\syswow64\cmd.exe' /C copy "%APPDATA%\windows defender\windows defender.exe" "%APPDATA%\windows defender\windows defender.exe"