Техническая информация
- <SYSTEM32>\tasks\createexplorershellunelevatedtask
- %WINDIR%\explorer.exe
- %TEMP%\d7ae.tmp\d7af.tmp\d7b0.bat
- <SYSTEM32>\tasks\createexplorershellunelevatedtask
- %LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'ApplicationFrameWindow' WindowName: ''
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\D7AE.tmp\D7AF.tmp\D7B0.bat <Полный путь к файлу>" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$p = ConvertTo-SecureString 'poduszka123' -AsPlainText -Force; $c = New-Object System.Management.Automation.PSCredential ('Administrator', $p); Start-Process '%APPDATA%\Sihost\timeout...
- '<SYSTEM32>\sihost.exe'
- '<SYSTEM32>\timeout.exe' 2
- '%WINDIR%\explorer.exe' /LOADSAVEDWINDOWS
- '%WINDIR%\explorer.exe' /NoUACCheck