Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Store Backup Information Defragmenter] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Store Backup Information Defragmenter] 'ImagePath' = 'C:\wnjyoqf\dupcrse.exe'
Создает следующие сервисы
- 'Store Backup Information Defragmenter' C:\wnjyoqf\dupcrse.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\wnjyoqf\n7mjehiewph
- C:\wnjyoqf\n7mjehiewph
- C:\wnjyoqf\zubtia9flxukfamsnk.exe
- C:\wnjyoqf\dupcrse.exe
- C:\wnjyoqf\oyuwypvnjlp.exe
- C:\wnjyoqf\fwpwnn
Присваивает атрибут 'скрытый' для следующих файлов
- C:\wnjyoqf\dupcrse.exe
- C:\wnjyoqf\oyuwypvnjlp.exe
Удаляет следующие файлы
- %WINDIR%\wnjyoqf\n7mjehiewph
- C:\wnjyoqf\zubtia9flxukfamsnk.exe
Подменяет следующие файлы
- %WINDIR%\wnjyoqf\n7mjehiewph
Сетевая активность
Подключается к
- 'pr####efancy.net':80
- 'do####future.net':80
- 'st####thsmell.net':80
- 'st###early.net':80
- 'ou####ehealth.net':80
- 'mo####ntclothes.net':80
- 'ev####gclothes.net':80
- 'do####health.net':80
- 'fe####health.net':80
- 'st####thhealth.net':80
- 'mi###eearly.net':80
TCP
Запросы HTTP GET
- http://pr####efancy.net/index.php
- http://do####future.net/index.php
- http://st####thsmell.net/index.php
- http://st###early.net/index.php
- http://ou####ehealth.net/index.php
- http://mo####ntclothes.net/index.php
- http://ev####gclothes.net/index.php
- http://do####health.net/index.php
- http://fe####health.net/index.php
- http://st####thhealth.net/index.php
- http://mi###eearly.net/index.php
UDP
- DNS ASK de####laughter.net
- DNS ASK pr####clothes.net
- DNS ASK do####distant.net
- DNS ASK pr####distant.net
- DNS ASK fe####separate.net
- DNS ASK fe####health.net
- DNS ASK ev####gdistant.net
- DNS ASK fe####clothes.net
- DNS ASK br####separate.net
- DNS ASK re####separate.net
- DNS ASK br####health.net
- DNS ASK re####health.net
- DNS ASK br####clothes.net
- DNS ASK re####clothes.net
- DNS ASK do####health.net
- DNS ASK fe####distant.net
- DNS ASK do####clothes.net
- DNS ASK pr####health.net
- DNS ASK pr####separate.net
- DNS ASK do####separate.net
- DNS ASK ev####gseparate.net
- DNS ASK bu####nghealth.net
- DNS ASK ev####ghealth.net
- DNS ASK bu####ngclothes.net
- DNS ASK ev####gclothes.net
- DNS ASK br####distant.net
- DNS ASK bu####ngdistant.net
- DNS ASK mo####ntdistant.net
- DNS ASK st####eparate.net
- DNS ASK st###health.net
- DNS ASK mi###health.net
- DNS ASK st####lothes.net
- DNS ASK mi####lothes.net
- DNS ASK st####istant.net
- DNS ASK ou####edistant.net
- DNS ASK mi####istant.net
- DNS ASK mi####eparate.net
- DNS ASK bu#####gseparate.net
- DNS ASK re####distant.net
- DNS ASK de####health.net
- DNS ASK ev####geearly.net
- DNS ASK bu####ngpublic.net
- DNS ASK ev####gpublic.net
- DNS ASK bu####ngdress.net
- DNS ASK ev####gdress.net
- DNS ASK st###catch.net
- DNS ASK ou####edress.net
- DNS ASK mi###catch.net
- DNS ASK mi###eearly.net
- DNS ASK st###public.net
- DNS ASK mi###public.net
- DNS ASK st###dress.net
- DNS ASK mi###dress.net
- DNS ASK do###rcatch.net
- DNS ASK ev####gcatch.net
- DNS ASK bu####ngeearly.net
- DNS ASK bu####ngcatch.net
- DNS ASK mo####ntdress.net
- DNS ASK do###esmell.net
- DNS ASK pr####eclothes.net
- DNS ASK de####clothes.net
- DNS ASK pr####edistant.net
- DNS ASK de####distant.net
- DNS ASK st#####hseparate.net
- DNS ASK pr####eseparate.net
- DNS ASK pr####ehealth.net
- DNS ASK de####separate.net
- DNS ASK st####thhealth.net
- DNS ASK ou####ecatch.net
- DNS ASK mo####nteearly.net
- DNS ASK ou####eeearly.net
- DNS ASK mo####ntpublic.net
- DNS ASK ou####epublic.net
- DNS ASK st####thclothes.net
- DNS ASK st####thdistant.net
- DNS ASK mo####ntcatch.net
- DNS ASK ou####eclothes.net
- DNS ASK mo####ntclothes.net
- DNS ASK ou####ehealth.net
- DNS ASK bu####ngsmell.net
- DNS ASK ev####gsmell.net
- DNS ASK bu####ngearly.net
- DNS ASK ev####gearly.net
- DNS ASK bu####ngsafety.net
- DNS ASK ev####gsafety.net
- DNS ASK st###future.net
- DNS ASK bu####ngfuture.net
- DNS ASK st###smell.net
- DNS ASK mi###smell.net
- DNS ASK st###early.net
- DNS ASK mi###early.net
- DNS ASK st###safety.net
- DNS ASK ou####esafety.net
- DNS ASK mo####ntsafety.net
- DNS ASK ou####efuture.net
- DNS ASK ou####eearly.net
- DNS ASK mo####ntearly.net
- DNS ASK pr####efancy.net
- DNS ASK pr####econsider.net
- DNS ASK de####consider.net
- DNS ASK pr####efriend.net
- DNS ASK de####friend.net
- DNS ASK st#####hlaughter.net
- DNS ASK mi###safety.net
- DNS ASK st####aughter.net
- DNS ASK ev####gfuture.net
- DNS ASK st###fancy.net
- DNS ASK st####onsider.net
- DNS ASK st####thfriend.net
- DNS ASK st###friend.net
- DNS ASK mo####ntsmell.net
- DNS ASK ou####esmell.net
- DNS ASK st####thfancy.net
- DNS ASK de###efancy.net
- DNS ASK st#####hconsider.net
- DNS ASK mo####ntfuture.net
- DNS ASK mi###future.net
- DNS ASK re####future.net
- DNS ASK de###esmell.net
- DNS ASK pr####eearly.net
- DNS ASK de###eearly.net
- DNS ASK pr####esafety.net
- DNS ASK de####safety.net
- DNS ASK br####future.net
- DNS ASK do###rsmell.net
- DNS ASK pr####esmell.net
- DNS ASK pr####efuture.net
- DNS ASK st####thsafety.net
- DNS ASK st####thfuture.net
- DNS ASK mo#####tseparate.net
- DNS ASK ou####eseparate.net
- DNS ASK mo####nthealth.net
- DNS ASK de####future.net
- DNS ASK st####thsmell.net
- DNS ASK st####thearly.net
- DNS ASK st###eearly.net
- DNS ASK pr###ycatch.net
- DNS ASK re###tearly.net
- DNS ASK do###rearly.net
- DNS ASK pr###yearly.net
- DNS ASK do####safety.net
- DNS ASK pr####safety.net
- DNS ASK do####future.net
- DNS ASK pr####future.net
- DNS ASK br####safety.net
- DNS ASK re####safety.net
- DNS ASK fe###wsmell.net
- DNS ASK do###eearly.net
- DNS ASK fe####safety.net
- DNS ASK fe####future.net
- DNS ASK br###nsmell.net
- DNS ASK re###tsmell.net
- DNS ASK br###nearly.net
- DNS ASK pr###ysmell.net
- DNS ASK fe###wearly.net
- DNS ASK do####eearly.net
Другое
Создает и запускает на исполнение
- 'C:\wnjyoqf\zubtia9flxukfamsnk.exe'
- 'C:\wnjyoqf\dupcrse.exe'
- 'C:\wnjyoqf\oyuwypvnjlp.exe' "c:\wnjyoqf\dupcrse.exe"
