Техническая информация
- <SYSTEM32>\tasks\runtimebroker maintenance
- %LOCALAPPDATA%\microsoft\windows\runtimebroker\runtimebroker.exe
- 'ex###sion.shop':5000
- 'ex###sion.cc':5000
- DNS ASK ex###sion.shop
- DNS ASK ex###sion.cc
- '%LOCALAPPDATA%\microsoft\windows\runtimebroker\runtimebroker.exe' -s
- '<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBroker Maintenance" /tr ""%LOCALAPPDATA%\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe" -s" /sc onlogon /f /rl highest