Техническая информация
- <SYSTEM32>\tasks\mГ®crosoft
- %TEMP%\mГ®crosoft.exe
- %APPDATA%\logs\10-13-2024
- 'ip##pi.com':80
- '84.##.231.214':9548
- http://ip##pi.com/json/
- DNS ASK ip##pi.com
- '%TEMP%\mГ®crosoft.exe'
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn "MГ®crosoft" /tr "%TEMP%\MГ®crosoft.exe" /sc onlogon /rl highest /f
- '<SYSTEM32>\schtasks.exe' /create /tn "MГ®crosoft" /tr "%TEMP%\MГ®crosoft.exe" /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /c cls
- '<SYSTEM32>\cmd.exe' /c schtasks /run /tn "MГ®crosoft"
- '<SYSTEM32>\schtasks.exe' /run /tn "MГ®crosoft"
- '<SYSTEM32>\taskeng.exe' {AEA93AD1-B422-4BAB-967E-F6F2E0BB3E39} S-1-5-21-3691498038-2086406363-2140527554-1000:cjohod\user:Interactive:[1]
- '%TEMP%\mГ®crosoft.exe' (со скрытым окном)