Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Error Transfer Secondary File] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Error Transfer Secondary File] 'ImagePath' = 'C:\wwfxvnzhktoepyh\iyzdtzsdqoi.exe'
Создает следующие сервисы
- 'Error Transfer Secondary File' C:\wwfxvnzhktoepyh\iyzdtzsdqoi.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\wwfxvnzhktoepyh\rlaymz7bdsex
- C:\wwfxvnzhktoepyh\rlaymz7bdsex
- C:\wwfxvnzhktoepyh\ihshow4kpiocavkdvjo.exe
- C:\wwfxvnzhktoepyh\iyzdtzsdqoi.exe
- C:\wwfxvnzhktoepyh\gowkxziett.exe
- C:\wwfxvnzhktoepyh\xs7bghum
Присваивает атрибут 'скрытый' для следующих файлов
- C:\wwfxvnzhktoepyh\iyzdtzsdqoi.exe
- C:\wwfxvnzhktoepyh\gowkxziett.exe
Удаляет следующие файлы
- %WINDIR%\wwfxvnzhktoepyh\rlaymz7bdsex
- C:\wwfxvnzhktoepyh\ihshow4kpiocavkdvjo.exe
Подменяет следующие файлы
- %WINDIR%\wwfxvnzhktoepyh\rlaymz7bdsex
Сетевая активность
Подключается к
- 'jo####ywomen.net':80
- 'li###ewomen.net':80
- 'th###women.net':80
- 'th####hpaint.net':80
- 'th####hcourse.net':80
- 'li####nothing.net':80
- 'ef####nothing.net':80
TCP
Запросы HTTP GET
- http://jo####ywomen.net/index.php
- http://li###ewomen.net/index.php
- http://th###women.net/index.php
- http://th####hpaint.net/index.php
- http://th####hcourse.net/index.php
- http://li####nothing.net/index.php
- http://ef####nothing.net/index.php
UDP
- DNS ASK va####seearly.net
- DNS ASK th###stream.net
- DNS ASK ch###stream.net
- DNS ASK be####divide.net
- DNS ASK ri####divide.net
- DNS ASK be####bottle.net
- DNS ASK ri####bottle.net
- DNS ASK be####nothing.net
- DNS ASK ri####nothing.net
- DNS ASK be####stream.net
- DNS ASK ri####stream.net
- DNS ASK li####divide.net
- DNS ASK de####ydivide.net
- DNS ASK li####bottle.net
- DNS ASK de####ybottle.net
- DNS ASK li####nothing.net
- DNS ASK de####ynothing.net
- DNS ASK li####stream.net
- DNS ASK de####ystream.net
- DNS ASK hu####ddivide.net
- DNS ASK jo####ydivide.net
- DNS ASK hu####dbottle.net
- DNS ASK jo####ybottle.net
- DNS ASK hu####dnothing.net
- DNS ASK jo####ynothing.net
- DNS ASK hu####dstream.net
- DNS ASK jo####ystream.net
- DNS ASK re####erwomen.net
- DNS ASK wo###women.net
- DNS ASK re####ercourse.net
- DNS ASK ch####othing.net
- DNS ASK ch###bottle.net
- DNS ASK re####ernothing.net
- DNS ASK th###bottle.net
- DNS ASK wo####othing.net
- DNS ASK re####erstream.net
- DNS ASK wo###stream.net
- DNS ASK in####sedivide.net
- DNS ASK fo####divide.net
- DNS ASK in####sebottle.net
- DNS ASK fo####bottle.net
- DNS ASK in####senothing.net
- DNS ASK fo####nothing.net
- DNS ASK in####sestream.net
- DNS ASK fo####stream.net
- DNS ASK th####hdivide.net
- DNS ASK ef####divide.net
- DNS ASK th####hbottle.net
- DNS ASK ef####bottle.net
- DNS ASK th####hnothing.net
- DNS ASK ef####nothing.net
- DNS ASK th####hstream.net
- DNS ASK ef####stream.net
- DNS ASK su####divide.net
- DNS ASK wi####divide.net
- DNS ASK su####bottle.net
- DNS ASK wi####bottle.net
- DNS ASK su####nothing.net
- DNS ASK wi####nothing.net
- DNS ASK su####stream.net
- DNS ASK wi####stream.net
- DNS ASK th###divide.net
- DNS ASK ch###divide.net
- DNS ASK wo###course.net
- DNS ASK th####othing.net
- DNS ASK re####erpaint.net
- DNS ASK th###clean.net
- DNS ASK be###gwomen.net
- DNS ASK ri###nwomen.net
- DNS ASK be####course.net
- DNS ASK ri####course.net
- DNS ASK be###gpaint.net
- DNS ASK ri###npaint.net
- DNS ASK be###gclean.net
- DNS ASK ri###nclean.net
- DNS ASK li###ewomen.net
- DNS ASK de####ywomen.net
- DNS ASK li####course.net
- DNS ASK de####ycourse.net
- DNS ASK li###epaint.net
- DNS ASK de####ypaint.net
- DNS ASK li###eclean.net
- DNS ASK de####yclean.net
- DNS ASK hu####dwomen.net
- DNS ASK jo####ywomen.net
- DNS ASK hu####dcourse.net
- DNS ASK jo####ycourse.net
- DNS ASK hu####dpaint.net
- DNS ASK jo####ypaint.net
- DNS ASK hu####dclean.net
- DNS ASK jo####yclean.net
- DNS ASK re###ndress.net
- DNS ASK va####sdress.net
- DNS ASK re####public.net
- DNS ASK va####spublic.net
- DNS ASK re####eearly.net
- DNS ASK ch###clean.net
- DNS ASK ch###paint.net
- DNS ASK re####erclean.net
- DNS ASK th###paint.net
- DNS ASK wo###clean.net
- DNS ASK in####sewomen.net
- DNS ASK fo###twomen.net
- DNS ASK in####secourse.net
- DNS ASK fo####course.net
- DNS ASK in####sepaint.net
- DNS ASK fo###tpaint.net
- DNS ASK in####seclean.net
- DNS ASK fo###tclean.net
- DNS ASK th####hwomen.net
- DNS ASK ef###twomen.net
- DNS ASK th####hcourse.net
- DNS ASK ef####course.net
- DNS ASK th####hpaint.net
- DNS ASK ef###tpaint.net
- DNS ASK th####hclean.net
- DNS ASK ef###tclean.net
- DNS ASK su###rwomen.net
- DNS ASK wi###nwomen.net
- DNS ASK su####course.net
- DNS ASK wi####course.net
- DNS ASK su###rpaint.net
- DNS ASK wi###npaint.net
- DNS ASK su###rclean.net
- DNS ASK wi###nclean.net
- DNS ASK th###women.net
- DNS ASK ch###women.net
- DNS ASK th###course.net
- DNS ASK ch###course.net
- DNS ASK wo###paint.net
- DNS ASK wo###bottle.net
Другое
Создает и запускает на исполнение
- 'C:\wwfxvnzhktoepyh\ihshow4kpiocavkdvjo.exe'
- 'C:\wwfxvnzhktoepyh\iyzdtzsdqoi.exe'
- 'C:\wwfxvnzhktoepyh\gowkxziett.exe' "c:\wwfxvnzhktoepyh\iyzdtzsdqoi.exe"
