Техническая информация
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WMI Update Service' = '%PROGRAMDATA%\WMI Provider Host\Wmi64Update.exe'
- <SYSTEM32>\tasks\wmi host updater
- %PROGRAMDATA%\wmi provider host\taskshell.exe
- %PROGRAMDATA%\wmi provider host\wmi64update.exe
- %PROGRAMDATA%\wmi provider host\config.json
- %PROGRAMDATA%\wmi provider host\taskshell.exe
- %PROGRAMDATA%\wmi provider host\config.json
- %PROGRAMDATA%\wmi provider host\wmi64update.exe
- http://we####3.zzz.com.ua/server1
- http://we####3.zzz.com.ua/server2
- http://we####3.zzz.com.ua/server3
- DNS ASK we####3.zzz.com.ua
- DNS ASK ia#######qni.000webhostapp.com
- DNS ASK xm#.###l.minergate.com
- DNS ASK ip###ger.org
- ClassName: '' WindowName: 'Task Manager'
- ClassName: '' WindowName: 'Диспетчер задач'
- '%PROGRAMDATA%\wmi provider host\wmi64update.exe'
- '%PROGRAMDATA%\wmi provider host\taskshell.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /sc MINUTE /mo 1 /tn "WMI Host Updater" /tr "%PROGRAMDATA%\WMI Provider Host\\Wmi64Update.exe" /f' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /create /sc MINUTE /mo 1 /tn "WMI Host Updater" /tr "%PROGRAMDATA%\WMI Provider Host\\Wmi64Update.exe" /f
- '<SYSTEM32>\taskeng.exe' {BE8CBB18-4583-413B-BBF2-F549A20B127E} S-1-5-21-1960123792-2022915161-3775307078-1001:tjudcdslziw\user:Interactive:[1]