Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Wired Bluetooth Connections Logs AuthIP] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Wired Bluetooth Connections Logs AuthIP] 'ImagePath' = 'C:\erploxdjhenj\xbzdzpf.exe'
Создает следующие сервисы
- 'Wired Bluetooth Connections Logs AuthIP' C:\erploxdjhenj\xbzdzpf.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\erploxdjhenj\qnmayrr6s
- C:\erploxdjhenj\qnmayrr6s
- C:\erploxdjhenj\jnoegfdmqfeo1pl4e.exe
- C:\erploxdjhenj\xbzdzpf.exe
- C:\erploxdjhenj\hpdedqxh.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\erploxdjhenj\xbzdzpf.exe
- C:\erploxdjhenj\hpdedqxh.exe
Удаляет следующие файлы
- %WINDIR%\erploxdjhenj\qnmayrr6s
- C:\erploxdjhenj\jnoegfdmqfeo1pl4e.exe
Подменяет следующие файлы
- %WINDIR%\erploxdjhenj\qnmayrr6s
Сетевая активность
Подключается к
- 'su###rthird.net':80
- 'wo###object.net':80
- 'jo####yspace.net':80
- 'li###espace.net':80
- 'be####travel.net':80
- 'in####setravel.net':80
UDP
- DNS ASK li####object.net
- DNS ASK wi####travel.net
- DNS ASK su###rspace.net
- DNS ASK wi###nspace.net
- DNS ASK th###close.net
- DNS ASK ch###close.net
- DNS ASK th###yellow.net
- DNS ASK ch###yellow.net
- DNS ASK th###travel.net
- DNS ASK ch###travel.net
- DNS ASK th###space.net
- DNS ASK ch###space.net
- DNS ASK be###gclose.net
- DNS ASK be####yellow.net
- DNS ASK wi####yellow.net
- DNS ASK ri####yellow.net
- DNS ASK be####travel.net
- DNS ASK ri####travel.net
- DNS ASK be###gspace.net
- DNS ASK ri###nspace.net
- DNS ASK li###eclose.net
- DNS ASK de####yclose.net
- DNS ASK li####yellow.net
- DNS ASK de####yyellow.net
- DNS ASK li####travel.net
- DNS ASK de####ytravel.net
- DNS ASK ri###nclose.net
- DNS ASK wo####tation.net
- DNS ASK su####yellow.net
- DNS ASK de####beyond.net
- DNS ASK re####erclose.net
- DNS ASK wo###close.net
- DNS ASK re####eryellow.net
- DNS ASK wo###yellow.net
- DNS ASK re####ertravel.net
- DNS ASK wo###travel.net
- DNS ASK re####erspace.net
- DNS ASK wo###space.net
- DNS ASK in####seclose.net
- DNS ASK fo###tclose.net
- DNS ASK in####seyellow.net
- DNS ASK li###espace.net
- DNS ASK su####travel.net
- DNS ASK fo####travel.net
- DNS ASK in####sespace.net
- DNS ASK fo###tspace.net
- DNS ASK th####hclose.net
- DNS ASK ef###tclose.net
- DNS ASK th####hyellow.net
- DNS ASK ef####yellow.net
- DNS ASK th####htravel.net
- DNS ASK ef####travel.net
- DNS ASK th####hspace.net
- DNS ASK ef###tspace.net
- DNS ASK su###rclose.net
- DNS ASK in####setravel.net
- DNS ASK wi###nclose.net
- DNS ASK de####yspace.net
- DNS ASK hu####dclose.net
- DNS ASK jo####yclose.net
- DNS ASK ch###third.net
- DNS ASK wi####childhood.net
- DNS ASK su####object.net
- DNS ASK wi####object.net
- DNS ASK su###rthird.net
- DNS ASK wi###nthird.net
- DNS ASK su####station.net
- DNS ASK wi####station.net
- DNS ASK th####hildhood.net
- DNS ASK ch####hildhood.net
- DNS ASK th###object.net
- DNS ASK ch###object.net
- DNS ASK fo####dbeyond.net
- DNS ASK ef####station.net
- DNS ASK th####tation.net
- DNS ASK ch####tation.net
- DNS ASK be####childhood.net
- DNS ASK ri####childhood.net
- DNS ASK be####object.net
- DNS ASK ri####object.net
- DNS ASK be###gthird.net
- DNS ASK ri###nthird.net
- DNS ASK be####station.net
- DNS ASK ri####station.net
- DNS ASK li####childhood.net
- DNS ASK de#####childhood.net
- DNS ASK th###third.net
- DNS ASK fo####yellow.net
- DNS ASK th####hstation.net
- DNS ASK ef####object.net
- DNS ASK ef###tthird.net
- DNS ASK hu####dyellow.net
- DNS ASK jo####yyellow.net
- DNS ASK hu####dtravel.net
- DNS ASK jo####ytravel.net
- DNS ASK hu####dspace.net
- DNS ASK jo####yspace.net
- DNS ASK re#####rchildhood.net
- DNS ASK wo####hildhood.net
- DNS ASK re####erobject.net
- DNS ASK wo###object.net
- DNS ASK re####erthird.net
- DNS ASK th####hthird.net
- DNS ASK wo###third.net
- DNS ASK su####childhood.net
- DNS ASK in#####echildhood.net
- DNS ASK fo####childhood.net
- DNS ASK in####seobject.net
- DNS ASK fo####object.net
- DNS ASK in####sethird.net
- DNS ASK fo###tthird.net
- DNS ASK in####sestation.net
- DNS ASK fo####station.net
- DNS ASK th#####childhood.net
- DNS ASK ef####childhood.net
- DNS ASK th####hobject.net
- DNS ASK re####erstation.net
- DNS ASK de###ebeing.net
Другое
Создает и запускает на исполнение
- 'C:\erploxdjhenj\jnoegfdmqfeo1pl4e.exe'
- 'C:\erploxdjhenj\xbzdzpf.exe'
- 'C:\erploxdjhenj\hpdedqxh.exe' "c:\erploxdjhenj\xbzdzpf.exe"
