Техническая информация
- <SYSTEM32>\tasks\updateservice
- %TEMP%\tmp12354\setup.exe
- %TEMP%\tmp12354\setup.exe.config
- %PROGRAMDATA%\updateservice\updateservice.exe
- %PROGRAMDATA%\updateservice\updateservice.exe.config
- %PROGRAMDATA%\microsoft\crypto\rsa\s-1-5-18\5fb44c323df79ef22010e39f8f35c988_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %PROGRAMDATA%\updateservice\settings.dat
- %TEMP%\tmp12354\setup.exe
- %TEMP%\tmp12354\setup.exe.config
- <SYSTEM32>\tasks\updateservice
- http://www.ge##ook.org/wp-content/plugins/info.php?ur###################
- http://ge##ook.org/wp-content/plugins/info.php?ur###############
- DNS ASK da####abarone.it
- DNS ASK ge##ook.org
- ClassName: '' WindowName: 'Data processing'
- '%TEMP%\tmp12354\setup.exe' -i "<Полный путь к файлу>"
- '%PROGRAMDATA%\updateservice\updateservice.exe' -r "%TEMP%\tmp12354\setup.exe"
- '%PROGRAMDATA%\updateservice\updateservice.exe' -t
- '%PROGRAMDATA%\updateservice\updateservice.exe'
- '%PROGRAMDATA%\updateservice\updateservice.exe' -t' (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /Delete /TN "UpdateService" /F
- '<SYSTEM32>\schtasks.exe' /Create /RU SYSTEM /SC ONSTART /TN "UpdateService" /TR "\"%PROGRAMDATA%\UpdateService\UpdateService.exe\" -t"
- '<SYSTEM32>\schtasks.exe' /Run /TN "UpdateService"