Техническая информация
- <SYSTEM32>\tasks\nremoteutils
- '13#.#44.100.54':8899
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; ((Get-ScheduledTask -TaskPath '\' -TaskName 'NRemoteUtils').Actions | Select-Object -First 1).Execute...
- '<SYSTEM32>\schtasks.exe' /Delete /TN \MicrosoftEdgeUpdate\MicrosoftEdgeUpdateTaskUserCore /F
- '<SYSTEM32>\schtasks.exe' /Delete /TN MicrosoftEdgeUpdateTaskUserCore /F
- '<SYSTEM32>\schtasks.exe' /Delete /TN NeedleRemoteAgent /F
- '<SYSTEM32>\whoami.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $action = New-ScheduledTaskAction -Execute '<Полный путь к файлу>'; $trigger = New-ScheduledTaskTrigg...