Техническая информация
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'RuntimesHost' = '"%ProgramFiles(x86)%\RuntimesHost\RuntimesHost.exe"'
- <SYSTEM32>\tasks\runtimeshost_user
- %ProgramFiles(x86)%\runtimeshost\.write-90b4e0f6ef0541888fb770c38d873ac8
- %ProgramFiles(x86)%\runtimeshost\worker.log
- %ProgramFiles(x86)%\runtimeshost\node.exe
- %ProgramFiles(x86)%\runtimeshost\script.js
- %ProgramFiles(x86)%\runtimeshost\device.txt
- %ProgramFiles(x86)%\runtimeshost\runtimeshost.exe
- %ProgramFiles(x86)%\runtimeshost\install.log
- %ProgramFiles(x86)%\runtimeshost\args.txt
- %ProgramFiles(x86)%\runtimeshost\client_args.txt
- %ProgramFiles(x86)%\runtimeshost\go_version.txt
- %ProgramFiles(x86)%\runtimeshost\.write-90b4e0f6ef0541888fb770c38d873ac8
- DNS ASK pe##.#roxyrack.com
- DNS ASK go#.###etizemyapp.net
- DNS ASK ap####dates.sock.sh
- '%ProgramFiles(x86)%\runtimeshost\node.exe' script.js --homeIp point-of-presence.sock.sh --homePort 443 --id 67991E8BF8E55AD26479A16A5D443AA6A9E164654FC250E91E9CEDE638091610 --version 1.0.16 --clientKey proxyrack-pop-client --clientType ...
- '<SYSTEM32>\schtasks.exe' /Query /TN "RuntimesHost_user" /FO LIST /V
- '<SYSTEM32>\schtasks.exe' /Create /TN "RuntimesHost_user" /TR "%ProgramFiles(x86)%\RuntimesHost\RuntimesHost.exe" /SC ONLOGON /RL LIMITED /F