Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Performance Block TCP/IP WMI Experience' = '%APPDATA%\juvutzp\cznloaziezeh.exe'
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\juvutzp\cznloaziezeh.exe
- %APPDATA%\juvutzp\wrgkwnyut.exe
- %APPDATA%\juvutzp\cznloaziezeh.dlgg
Присваивает атрибут 'скрытый' для следующих файлов
- %APPDATA%\juvutzp\cznloaziezeh.exe
- %APPDATA%\juvutzp\wrgkwnyut.exe
Сетевая активность
Подключается к
- 'br###nheart.net':80
- 'de###eheart.net':80
- 'st###heart.net':80
- 'st####thbattle.net':80
- 'ex###tvalue.net':80
- 'ri###reason.net':80
- 'wh####rorderly.net':80
- 'ci####ttereason.net':80
TCP
Запросы HTTP GET
- http://br###nheart.net/forum/search.php?em#################################################
- http://de###eheart.net/forum/search.php?em#################################################
- http://st###heart.net/forum/search.php?em#################################################
- http://st####thbattle.net/forum/search.php?em#################################################
- http://ex###tvalue.net/forum/search.php?em#################################################
- http://ri###reason.net/forum/search.php?em#################################################
- http://wh####rorderly.net/forum/search.php?em#################################################
- http://ci####ttereason.net/forum/search.php?em#################################################
UDP
- DNS ASK pr####perfect.net
- DNS ASK ri###almost.net
- DNS ASK wh####ralmost.net
- DNS ASK fo####nvalue.net
- DNS ASK su###nvalue.net
- DNS ASK fo####norderly.net
- DNS ASK su####orderly.net
- DNS ASK fo####nreason.net
- DNS ASK su####reason.net
- DNS ASK fo####nalmost.net
- DNS ASK su####almost.net
- DNS ASK ma####evalue.net
- DNS ASK pe###nvalue.net
- DNS ASK ma####eorderly.net
- DNS ASK pe####orderly.net
- DNS ASK ma####ereason.net
- DNS ASK pe####reason.net
- DNS ASK ma####ealmost.net
- DNS ASK be####evalue.net
- DNS ASK pe####almost.net
- DNS ASK wh####rreason.net
- DNS ASK ri###reason.net
- DNS ASK ci#####teorderly.net
- DNS ASK pi####eorderly.net
- DNS ASK ci####ttereason.net
- DNS ASK pi####ereason.net
- DNS ASK ci####ttealmost.net
- DNS ASK pi####ealmost.net
- DNS ASK th###hvalue.net
- DNS ASK fi###evalue.net
- DNS ASK fi####orderly.net
- DNS ASK st####thperfect.net
- DNS ASK th####reason.net
- DNS ASK fi####reason.net
- DNS ASK th####almost.net
- DNS ASK fi####almost.net
- DNS ASK ri###value.net
- DNS ASK wh####rvalue.net
- DNS ASK ri####rderly.net
- DNS ASK wh####rorderly.net
- DNS ASK ex###tvalue.net
- DNS ASK be####eorderly.net
- DNS ASK ex####orderly.net
- DNS ASK br###nmayor.net
- DNS ASK re####perfect.net
- DNS ASK br####perfect.net
- DNS ASK re###theart.net
- DNS ASK br###nheart.net
- DNS ASK fe####battle.net
- DNS ASK do###emayor.net
- DNS ASK fe###wmayor.net
- DNS ASK do####perfect.net
- DNS ASK fe####perfect.net
- DNS ASK do###eheart.net
- DNS ASK fe###wheart.net
- DNS ASK pr####battle.net
- DNS ASK do####battle.net
- DNS ASK pr###ymayor.net
- DNS ASK do###rmayor.net
- DNS ASK br####battle.net
- DNS ASK re####battle.net
- DNS ASK re###tmayor.net
- DNS ASK pr####eheart.net
- DNS ASK be####ereason.net
- DNS ASK de###eheart.net
- DNS ASK ex####reason.net
- DNS ASK be####ealmost.net
- DNS ASK ex####almost.net
- DNS ASK st###battle.net
- DNS ASK st####thbattle.net
- DNS ASK st###mayor.net
- DNS ASK st####thmayor.net
- DNS ASK th####orderly.net
- DNS ASK pi####evalue.net
- DNS ASK st###heart.net
- DNS ASK st####thheart.net
- DNS ASK de####battle.net
- DNS ASK pr####ebattle.net
- DNS ASK de###emayor.net
- DNS ASK pr####emayor.net
- DNS ASK de####perfect.net
- DNS ASK pr####eperfect.net
- DNS ASK st####erfect.net
- DNS ASK ci####ttevalue.net
Другое
Создает и запускает на исполнение
- '%APPDATA%\juvutzp\cznloaziezeh.exe'
- '%APPDATA%\juvutzp\wrgkwnyut.exe' "%APPDATA%\juvutzp\cznloaziezeh.exe"
