Техническая информация
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WMI Update Service' = '%PROGRAMDATA%\WMI Services\WmiPrvSvc.exe'
- <SYSTEM32>\tasks\wmi services
- %PROGRAMDATA%\wmi services\wmiprvsvc.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %PROGRAMDATA%\wmi services\wmiprvsvc.exe
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- DNS ASK ip###ger.org
- '%PROGRAMDATA%\wmi services\wmiprvsvc.exe'
- '<SYSTEM32>\schtasks.exe' /create /sc MINUTE /mo 1 /tn "WMI Services" /tr "%PROGRAMDATA%\WMI Services\\WmiPrvSvc.exe" /f' (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /create /sc MINUTE /mo 1 /tn "WMI Services" /tr "%PROGRAMDATA%\WMI Services\\WmiPrvSvc.exe" /f
- '<SYSTEM32>\taskeng.exe' {FE37E7E4-2A49-4CAD-8973-88FFEF54D797} S-1-5-21-1960123792-2022915161-3775307078-1001:mddiercfzq\user:Interactive:[1]