Техническая информация
- <SYSTEM32>\tasks\googleupdatetaskmachineqc
- %APPDATA%\google\libs\g.log
- %APPDATA%\google\chrome\updater.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#cukrcyib#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#llygob#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System...
- '<SYSTEM32>\cmd.exe' /c mkdir "%APPDATA%\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "%APPDATA%\Google\Libs\g.log"
- '<SYSTEM32>\wbem\wmic.exe' PATH Win32_VideoController GET Name, VideoProcessor
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#llygob#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System...
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn GoogleUpdateTaskMachineQC /tr '%APPDATA%\Google\Chrome\updater.exe'
- '<SYSTEM32>\schtasks.exe' /run /tn GoogleUpdateTaskMachineQC
- '<SYSTEM32>\taskeng.exe' {3E97CCE3-9CE0-404E-8516-E66B67C841C4} S-1-5-21-1960123792-2022915161-3775307078-1001:vafjmiwbnvc\user:Interactive:[1]