Техническая информация
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WMI Update Service' = '%PROGRAMDATA%\WMI Services\WmiPrvSvc.exe'
- <SYSTEM32>\tasks\wmi services
- %TEMP%\file123.exe
- %PROGRAMDATA%\wmi services\wmiprvsvc.exe
- %TEMP%\123file.exe
- %TEMP%\file123.exe
- %PROGRAMDATA%\wmi services\wmiprvsvc.exe
- %TEMP%\123file.exe
- 'ra#.####ubusercontent.com':443
- DNS ASK ra#.####ubusercontent.com
- '%TEMP%\file123.exe'
- '%TEMP%\123file.exe'
- '%PROGRAMDATA%\wmi services\wmiprvsvc.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /sc MINUTE /mo 1 /tn "WMI Services" /tr "%PROGRAMDATA%\WMI Services\\WmiPrvSvc.exe" /f' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /create /sc MINUTE /mo 1 /tn "WMI Services" /tr "%PROGRAMDATA%\WMI Services\\WmiPrvSvc.exe" /f