Техническая информация
- <SYSTEM32>\tasks\myapp startup
- C:\systemhelpers\payload.bat
- %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1920_1080_pos2.jpg
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_idx.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_16.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_32.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_48.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_96.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_256.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_768.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_1280.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_1920.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_2560.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_sr.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_wide.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_exif.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_custom_stream.db
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "MyApp Startup" /TR "\"C:\SYSTEMHELPERS\payload.bat\"" /SC ONLOGON /RL HIGHEST /F