Техническая информация
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\Sub\Client.exe'
- <SYSTEM32>\tasks\sasahi
- %WINDIR%\sub\client.exe
- %LOCALAPPDATA%\sub\watchdog.exe
- %WINDIR%\sub\client.exe
- %LOCALAPPDATA%\sub\watchdog.exe
- 'ad######ings.gl.at.ply.gg':29864
- DNS ASK ad######ings.gl.at.ply.gg
- '<SYSTEM32>\cmd.exe' /c SchTaSKs /create /f /sc minute /mo -1 /tn "sashi" /tr "%WINDIR%\Sub\Client.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo -1 /tn "sashi" /tr "%WINDIR%\Sub\Client.exe" /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /c SchTaSKs /create /f /sc minute /mo 5 /tn "sasahi" /tr "%LOCALAPPDATA%\Sub\WatchDog.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 5 /tn "sasahi" /tr "%LOCALAPPDATA%\Sub\WatchDog.exe" /RL HIGHEST