Техническая информация
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'NetworkServiceManager' = '%ALLUSERSPROFILE%\NetworkServices\wlanextsvc.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\NetworkServices'"
- '<SYSTEM32>\schtasks.exe' /create /f /tn "\Microsoft\Windows\Network\NetworkServiceMonitor" /tr "%ALLUSERSPROFILE%\NetworkServices\wlanextsvc.exe" /sc onlogon /rl HIGHEST /ru "%USERNAME%"