Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\bitmgr.exe] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\bitmgr.exe' = '<SYSTEM32>\bitmgr.exe:*:Enabled:bitmgr.exe'
- '<SYSTEM32>\bitmgr.exe' /s /p 27016
- '<SYSTEM32>\bitmgr.exe' /i
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "<SYSTEM32>\bitmgr.exe" "bitmgr.exe" ENABLE
- <SYSTEM32>\700FF4FCDFC2270F691DF06FE786BFFE\conf\.time
- <SYSTEM32>\bitmgr.exe
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- 'gw#.##ufshop.com':80
- 'gw#####he.bearshare.net':80
- 'qu####eeder.info':80
- http://gw#.##ufshop.com/skulls/skulls.php?ge############################################
- http://gw#####he.bearshare.net/?ge############################################
- http://qu####eeder.info/biter/?a=#######
- DNS ASK gw#####he.bearshare.net
- DNS ASK gw#.##ufshop.com
- DNS ASK qu####eeder.info
- '23#.#55.255.250':1900