Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\services\commwiz.exe] 'Start' = '00000002'
- '<SYSTEM32>\commwiz.exe' /s /p 27016
- '<SYSTEM32>\commwiz.exe' /i
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="commwiz.exe" dir=in action=allow program="<SYSTEM32>\commwiz.exe" enable=yes profile=any
- C:\ProgramData\Microsoft\RAC\Temp\sqlB348.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sqlB318.tmp
- <SYSTEM32>\F097589E243D7ADEDDD774517B680843\conf\.time
- <SYSTEM32>\commwiz.exe
- C:\ProgramData\Microsoft\RAC\Temp\sqlB318.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sqlB348.tmp
- 'gw#####he.bearshare.net':80
- 'gw#.##ufshop.com':80
- 'fr####etworks.com':80
- gw#####he.bearshare.net/?ge############################################
- gw#.##ufshop.com/skulls/skulls.php?ge############################################
- fr####etworks.com/frodo/?a=#######
- DNS ASK gw#.##ufshop.com
- DNS ASK gw#####he.bearshare.net
- DNS ASK fr####etworks.com
- '23#.#55.255.250':1900