Техническая информация
- '%WINDIR%\syswow64\rundll32.exe' C:\Users\Public\Documents\Yhqe12g.txt,DllRegisterServer
- %WINDIR%\explorer.exe
- C:\users\public\documents\yhqe12g.txt
- %ProgramFiles%\unp\logs\updatenotificationpipeline.001.etl в %ProgramFiles%\unp\logs\updatenotificationpipeline.002.etl
- %ProgramFiles%\UNP\Logs\UpdateNotificationPipeline.001.etl
- 'ri###iral.com':443
- DNS ASK ri###iral.com
- DNS ASK ar#.msn.com
- DNS ASK im##########-rt-microsoft-com.akamaized.net
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- '<SYSTEM32>\usoclient.exe' StartScan
- '<SYSTEM32>\sc.exe' start wuauserv
- '<SYSTEM32>\apphostregistrationverifier.exe'
- '%ProgramFiles(x86)%\microsoft office\office16\excel.exe' /dde
- '<SYSTEM32>\devicecensus.exe' UserCxt
- '<SYSTEM32>\svchost.exe' -k netsvcs -p