Техническая информация
- <SYSTEM32>\tasks\microsoft\windows\pla\system\phase1
- %APPDATA%\user\cc
- %APPDATA%\user\service.exe
- '<SYSTEM32>\cmd.exe' /c SCHTASKS /Create /sc minute /mo 5 /RL HIGHEST /ST 23:10 /TN "\Microsoft\Windows\PLA\System\Phase1" /TR "%APPDATA%\user\service.exe"' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c SCHTASKS /Create /sc minute /mo 5 /RL HIGHEST /ST 23:10 /TN "\Microsoft\Windows\PLA\System\Phase1" /TR "%APPDATA%\user\service.exe"
- '<SYSTEM32>\schtasks.exe' /Create /sc minute /mo 5 /RL HIGHEST /ST 23:10 /TN "\Microsoft\Windows\PLA\System\Phase1" /TR "%APPDATA%\user\service.exe"