Техническая информация
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSecurityHealth' = '"%APPDATA%\Microsoft\Crypto\WindowsSecurityHealth.exe"'
- <SYSTEM32>\tasks\microsoft\windows\windowssecurityhealth
- %APPDATA%\microsoft\crypto\windowssecurityhealth.exe
- nul
- %APPDATA%\microsoft\crypto\state.dat
- %APPDATA%\microsoft\crypto\windowssecurityhealth.exe
- %APPDATA%\microsoft\crypto\state.dat
- 'localhost':8443
- '<SYSTEM32>\cmd.exe' /c schtasks /Delete /TN "Microsoft\Windows\WindowsSecurityHealth" /F >nul 2>&1 (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /Delete /TN "Microsoft\Windows\WindowsSecurityHealth" /F
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /TN "Microsoft\Windows\WindowsSecurityHealth" /TR "\"%APPDATA%\Microsoft\Crypto\WindowsSecurityHealth.exe\"" /SC ONLOGON /RL LIMITED /F (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /Create /TN "Microsoft\Windows\WindowsSecurityHealth" /TR "\"%APPDATA%\Microsoft\Crypto\WindowsSecurityHealth.exe\"" /SC ONLOGON /RL LIMITED /F
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\WindowsSecurityHealth" /ENABLE >nul 2>&1 (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\WindowsSecurityHealth" /ENABLE