Техническая информация
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LAN Service' = '%ProgramFiles(x86)%\LAN Service\lansvc.exe'
- <SYSTEM32>\tasks\lan service
- <SYSTEM32>\tasks\lan service task
- %APPDATA%\d99ef00b-ccd3-4f1d-9980-90ac453b0b47\run.dat
- %ProgramFiles(x86)%\lan service\lansvc.exe
- %TEMP%\tmp8c.tmp
- %APPDATA%\d99ef00b-ccd3-4f1d-9980-90ac453b0b47\task.dat
- %TEMP%\tmp12d5.tmp
- %TEMP%\tmp8c.tmp
- %TEMP%\tmp12d5.tmp
- '18#.#48.241.40':2965
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "LAN Service" /xml "%TEMP%\tmp8C.tmp"
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "LAN Service Task" /xml "%TEMP%\tmp12D5.tmp"