Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'winsys' = '<SYSTEM32>\winsys.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'winsys' = '<SYSTEM32>\winsys.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\winsys.exe
Сетевая активность:
Подключается к:
- '41.##.49.241':8080
- '61.##0.67.212':80
- '19#.#45.116.22':80
- '20#.#5.143.105':80
- '66.##.122.135':80
- '20#.#2.69.94':8080
- '94.##5.166.95':80
- '19#.#9.134.132':8080
- '21#.#10.201.156':80
- '60.##.209.24':3128
- '18#.#38.112.118':80
- '11#.#5.12.39':80
- '10#.#0.205.107':80
- '18#.#14.111.190':8080
- '69.##3.96.22':8080
- '17#.#37.152.60':8080
- '15#.#26.168.11':80
- '21#.#09.194.139':80
- '21#.#8.177.57':8080
- '41.##.49.225':8080
- '15#.26.53.5':80
- '21#.#8.157.205':80
- '11#.#4.140.111':3128
- '94.##5.166.117':80
- '85.#.79.122':80
- '64.##3.183.147':80
- '20#.#23.164.133':80
- '19#.0.50.38':8080
- '65.##.156.161':80
- '20#.#8.131.209':80
- '20#.#9.209.165':80
- '19#.#13.196.29':80
- '62.##0.110.210':80
- '18#.#2.224.216':80
- '18#.#08.236.3':3128
- '11#.#.188.98':8080
- 'ci##x.ru':80
- '21#.#8.215.175':80
- '12#.#8.250.204':80
- '17#.#39.255.196':80
- '64.##.255.200':8080
- '11#.#12.185.71':8080
- '66.##2.116.165':80
- '21#.#4.144.110':80
- '21#.#9.163.126':8080
- '94.##5.166.94':80
- '18#.#4.227.66':3128
- '22#.60.8.82':8080
- '19#.#96.22.122':3128
- '63.##3.78.202':8080
- '20#.#0.138.83':3128
- '67.##.111.73':80
- '17#.#39.255.194':80
- '15#.#6.53.33':80
TCP:
Запросы HTTP GET:
- 61.##0.67.212http://asian-sexxx.biz:80/
- 19#.#45.116.22http://asiansexporno.net:80/
- 20#.#5.143.105http://asiaticdebauch.com:80/
- 66.##.122.135http://asianwomens.biz:80/
- 11#.#5.12.39http://asianpornoplanet.com:80/
- 10#.#0.205.107http://asianporn4you.com:80/
- 94.##5.166.95http://asian-sex.biz:80/
- 18#.#38.112.118http://asianpussygirl.com:80/
- 15#.26.53.5http://badcallboys.com:80/
- 85.#.79.122http://babu-budu.com:80/
- 21#.#09.194.139http://bbwisbbw.com:80/
- 15#.#26.168.11http://balovnica.com:80/
- 21#.#8.157.205http://assfucker.biz:80/
- 94.##5.166.117http://asiayounggirls.com:80/
- 64.##3.183.147http://babishi.com:80/
- 20#.#23.164.133http://babe45.org:80/
- 21#.#10.201.156http://asianlady.net:80/
- 20#.#8.131.209http://69folla.com:80/
- 18#.#2.224.216http://3dsexy.biz:80/
- 62.##0.110.210http://alexboobs.com:80/
- 65.##.156.161http://ahhairy.com:80/
- 17#.#39.255.196http://3dbiglove.com:80/
- ci##x.ru/
- 21#.#8.215.175http://3dpublicvoyeur.com:80/
- 12#.#8.250.204http://3dgranny.us:80/
- 21#.#4.144.110http://anal-love-sex.com:80/
- 67.##.111.73http://amateurespanol.com:80/
- 94.##5.166.94http://asian-bitchs.com:80/
- 66.##2.116.165http://andbbw.com:80/
- 20#.#9.209.165http://allbestbdsm.com:80/
- 19#.#13.196.29http://alexdrunk.com:80/
- 17#.#39.255.194http://amateurbigsex.com:80/
- 15#.#6.53.33http://amateur4u.biz:80/
UDP:
- DNS ASK ci##x.ru
- '<IP-адрес в локальной сети>':1036
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
