Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Desktop\Internet Hao123nknk
Сетевая активность:
Подключается к:
- '17#.#95.249.133':8511
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
- 'to####.kantule.net':9282
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'ozjmxjbcabnmhjhw' WindowName: 'hojpljfisgkdtczxoe'
- ClassName: 'vskvzgvlfrlifwkoqopm' WindowName: 'emjaoltqcwtecxleypdelgqn'
- ClassName: 'mdrosesnqchkvkkrrqqkbkkhiepczeccp' WindowName: 'bjeolzpkvvaroslyrhucinywudwnrxe'
- ClassName: 'cgxorbnxxzttadgdsjbxgsrezlka' WindowName: 'nldbjtvxdjlnhuyxmjmmxkclw'
- ClassName: 'mjneedwzjurdldh' WindowName: 'rgwfmjfyogtondeuxpxdxqxodbbw'
- ClassName: 'cyulswvamazzhhduci' WindowName: 'gjhvdxvdahguklxtjgbsghlnk'
- ClassName: 'wtxcwuqncvqbatusvhdnabv' WindowName: 'lmakjrwjonufpyhr'
- ClassName: 'vreiwstinnveprdsoodujni' WindowName: 'dduznintjpofzxjlmjxuvsacmnveuxjxsqfchn'
- ClassName: 'aiimvnwfwwwpizpqdmomhwvzxpfra' WindowName: 'zshhfevachssqoyqjeowtiquuaukhommygrjezg'
- ClassName: 'hiqglulmdqagshlvecrkofaztsbdzwsxhaxh' WindowName: 'fpdnxwckxwasmvuu'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'yxboczqqnleqyxieigymvdlzpusp' WindowName: 'iayivrotfyjuesledbrqzhfzukamxirfemyfek'
- ClassName: 'qmkyltbyffcfqrfr' WindowName: 'rzztsqaqlmovfmrqojbwhsv'
- ClassName: 'gvdiqdouodnrrwxcilvsatxduodazrcviciig' WindowName: 'fscaztxcolefxlbym'
- ClassName: 'sojjqiilfrvwkjwvcvuzhaoxqnsfhk' WindowName: 'untcdkcdtfuulyxddpfn'
- ClassName: 'pllhbnusmbjliunwgfcnjqufhnmbnugiwvmnw' WindowName: 'nraewsbxrvyqeyeagqnpdiedjmpsdxkpkwyggjr'
- ClassName: 'mpdtmxaftodqobcihhljngtksiko' WindowName: 'rcgoeaaiokeqwuiclz'
- ClassName: 'apizweozrvgxpiogepykhr' WindowName: 'pyzydbsnrijtejydbrgiqradnkv'
- ClassName: 'zqeadxfvpylebwpzjplhwnkllkrhddktnvhxusj' WindowName: 'wtviqsjbbnkmyxqitiqdbqvut'
- ClassName: 'jacaadpgnfltnogfiqiboevtjiyebmyddq' WindowName: 'rojbogbtsxhkkkjwuyoyvdohwzuufn'
- ClassName: 'rfmaetxpfzcnymahupdkvvinlzlladwhqtud' WindowName: 'vzfbbnvdsftqigfauvmwbhdwofjhtz'
- ClassName: 'xcmdheybzpbupmfvxxmobrcwwmnz' WindowName: 'knirphsigdoronodvrq'
- ClassName: 'cufmwwxxzqijevqittptxoxfvmqonecklrq' WindowName: 'vnqkezfijwlmgtoavuzljxjd'
- ClassName: 'waforsbeebaopjyxri' WindowName: 'fxyjcrssopwnpxjyiduacavqxv'
- ClassName: 'hgckhlyadwdwtbotdwqnbxieeamsv' WindowName: 'zyagictwvnecexjbyjknsirlmhreekz'
- ClassName: 'euogmmyvavydbmnjisjcgttveurvafiydobz' WindowName: 'jtppuamqqxsknztcosnh'
- ClassName: 'fzznyvbsvzcgisvajizzrtyrid' WindowName: 'yrderqlmbpazgnzcbpljslxaviiealowjcu'
- ClassName: 'ijwowvsowsbhswwvoilrbkeasyjyjxdxenvli' WindowName: 'quceipotglhsgqyiohwsmmzvdnde'
- ClassName: 'gmtkwjgnguirhpgsakyaxlada' WindowName: 'hpvxvjauvhgucgdvklzpeuepoxnvwvam'
- ClassName: 'nhuwbjkigexspuzkzapjpgyidodxoboanvs' WindowName: 'sghokjkidrikdibifzudonhbrjlqwxndg'
- ClassName: 'bokvakrrpnykmkawitqwbfkuiggmpbxn' WindowName: 'qjyfrlkgcgxdzscidmxgokqhcunzveks'
- ClassName: 'hdgaytukppjepyoqewvsmanxrhce' WindowName: 'lmrsnkjchgrkdyqyjspgo'
- ClassName: 'goopjsjhmczfwhh' WindowName: 'ienbqbymwpcrxrxlocxatyhhjer'
- ClassName: 'ystzmiehwspefwjlikqwmkrepbis' WindowName: 'zmxzqpmxqvspwryxbzsquibykxanitnwmdabry'
- ClassName: 'izxsmxmhhydieltuzthvdswfmtshzqrqlkjc' WindowName: 'rgjqeimmwvualqvaaygvtkjqh'
- ClassName: 'jueronadbgahuckhlodmaizly' WindowName: 'tscwgofqwcpdrppwfzaxgsdoakitofqgrscwar'
- ClassName: 'rptkylcptmqktrcyqh' WindowName: 'velkkeocuvocevqpbzur'
- ClassName: 'duzwsldmidrsfhgcyircpqquttdtg' WindowName: 'ouahexbcnvgylihugfwp'
- ClassName: 'aoyabfymwgbazjtmnxtycrlanw' WindowName: 'eljrultolhialevfddnqyfdwlqm'
- ClassName: 'wbmsfliszggnwylkpcowuqwrsrjcvezyulco' WindowName: 'qtxyxijgxzisjklnqrv'
- ClassName: 'rmjuxvqushpedsgjaeztawqwuy' WindowName: 'vnrkyeiqyatrqsxfjmgfppftieakpqozvoyz'
- ClassName: 'slxhhgvzlfmyhhwvcn' WindowName: 'rwnmpjoimaowyjijsbzyjxeirtztptwmekejxlw'
- ClassName: 'nqweuarafpxdivrkvtufbum' WindowName: 'augrxraczciusiwimh'
- ClassName: 'gahypbrbevvdbrkzotcgxkgtepexcbwosm' WindowName: 'azllazyqfrsisunxneesswawwfavokdj'
