Техническая информация
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%TEMP%\{87982~1.EXE'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\wuauclt.exe' = '<SYSTEM32>\wuauclt.exe:*:Enabled:Windows Update'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '<SYSTEM32>\wuauclt.exe' = '<SYSTEM32>\wuauclt.exe:*:Enabled:Windows Update'
- <SYSTEM32>\wuauclt.exe
- <SYSTEM32>\netsh.exe firewall add allowedprogram program = "<SYSTEM32>\WUAUCLT.EXE" name = "Windows Update" mode = ENABLE scope = ALL profile = ALL
- %WINDIR%\explorer.exe
- %TEMP%\{87982593-8269-5826-3592-015936025937}.exe
- %TEMP%\{87982593-8269-5826-3592-015936025937}.tmp
- %TEMP%\{87982593-8269-5826-3592-015936025937}.exe
- %TEMP%\{87982593-8269-5826-3592-015936025937}.tmp