Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=6052
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=6044
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=6028
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=6100
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=6084
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=6068
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=6012
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5956
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5940
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=5932
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5996
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=5980
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=5972
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=4040
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=3000
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=2884
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=1716
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=4208
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=3604
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=4140
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=2724
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=2544
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=2484
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=884
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=2660
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=1136
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=1824
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5700
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=5684
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=5716
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5744
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=5732
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5668
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe'
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe'
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe'
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5660
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe'
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5756
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5916
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5860
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5872
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5900
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5884
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5844
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5788
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=5772
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5804
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5828
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5812
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' (загружен из сети Интернет)
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' (загружен из сети Интернет)
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' (загружен из сети Интернет)
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' (загружен из сети Интернет)
Изменения в файловой системе:
Создает следующие файлы:
- C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe
- C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe
- C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe
- C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe
Сетевая активность:
Подключается к:
- 'ki#####303.bplaced.net':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- ki#####303.bplaced.net/Servi/kazy.exe
- ki#####303.bplaced.net/Servi/razorcrypter1.1.3.exe
- ki#####303.bplaced.net/Servi/grievecrypter.exe
- wp#d/wpad.dat
- ki#####303.bplaced.net/Servi/Razorcrypter1.6.1.exe
UDP:
- DNS ASK ki#####303.bplaced.net
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
