Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '351d15918b770df7ec69b980cb921237' = '"%TEMP%\Updater.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '351d15918b770df7ec69b980cb921237' = '"%TEMP%\Updater.exe" ..'
- %HOMEPATH%\Start Menu\Programs\Startup\351d15918b770df7ec69b980cb921237.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\Updater.exe' = '%TEMP%\Updater.exe:*:Enabled:Updater.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\Updater.exe" "Updater.exe" ENABLE
- '%TEMP%\Updater.exe'
- '%TEMP%\WindowsUpdater.exe'
- %TEMP%\Updater.exe
- %TEMP%\xXWndg
- %TEMP%\WindowsUpdater.exe
- 'xd####aru.ddns.net':1604
- DNS ASK xd####aru.ddns.net