Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\absbgfkq] 'Startup' = 'WLStartupEvent'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\absbgfkq] 'DllName' = 'absbgfkq.dll'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%TEMP%\{52680~1.EXE'
- <SYSTEM32>\wuauclt.exe
- <SYSTEM32>\netsh.exe firewall add allowedprogram program = "<SYSTEM32>\WUAUCLT.EXE" name = "Windows Update" mode = ENABLE scope = ALL profile = ALL
- %WINDIR%\explorer.exe
- %TEMP%\{52680224-6880-4468-0224-241131035799}.exe
- %TEMP%\{52680224-6880-4468-0224-241131035799}.tmp
- %TEMP%\{52680224-6880-4468-0224-241131035799}.exe
- %TEMP%\{52680224-6880-4468-0224-241131035799}.tmp
- DNS ASK google.com
- '<IP-адрес в локальной сети>':1037