Техническая информация
- [HKCU\Environment] 'UserInitMprLogonScript' = '"<SYSTEM32>\wscript.exe" "%LOCALAPPDATA%\Microsoft\Windows\TerrierShooter\InclinedStartup.js"'
- %LOCALAPPDATA%\microsoft\windows\terriershooter\inclinedstartup.js
- 'ar##.###iveworkshops.com':31166
- 'ar##.###iveworkshops.com':31166
- DNS ASK ar##.###iveworkshops.com
- '<SYSTEM32>\cscript.exe' //nologo //E:JScript "<PATH_SAMPLE>.js" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command -