Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%HOMEPATH%\Start Menu\Programs\9GpswpaNVV1qoJJSls032S2td.exe'
- '%PROGRAM_FILES%\FXvgGf6FHBMeP9Ukeoy2s3N9m.exe'
- '%HOMEPATH%\My Documents\tSBEAEg7PzXh6MoPzXSD6iC0B.exe'
- '%HOMEPATH%\Favorites\4xgMwhawOCmxX3lOHDfIhgeZW.exe'
- '%HOMEPATH%\Start Menu\Programs\NvCcapuDXODwl4Uc9YYRN6Lr9.exe'
- '%WINDIR%\sphWk1yiS6Of6EO5RzkI0BD5w.exe'
- '%HOMEPATH%\Start Menu\Programs\lDogwwknd2rES3180tKDX8gXT.exe'
- '<SYSTEM32>\izPPcCIU7szjBno6satqtQlMP.exe'
- '%PROGRAM_FILES%\zkXRKHV1SjJNhS7YaYsxZEYrS.exe'
- '%PROGRAM_FILES%\M38spfDqbn3jcCsLGzFYGiA8Z.exe'
- '%HOMEPATH%\Favorites\f6cosfZfNAmRdDk7Roq9VkMKH.exe'
- '%HOMEPATH%\My Documents\HyLqs291CW2M2X6PwiumwNNPF.exe'
- '%HOMEPATH%\2QnFQKZwghQYoI5ilQb0S06lw.exe'
- '%APPDATA%\W1e18hx2xqZJXbYDeiLscQ1GT.exe'
- '%HOMEPATH%\Start Menu\Programs\SztdpgYGGy6xrcoKFSWrPtqfN.exe'
- '%PROGRAM_FILES%\Gzu2qP0GcKzi15IuyMcsmc59y.exe'
- '%HOMEPATH%\Start Menu\Programs\CKkoHgZubYlimUuv7YCbpd2Nc.exe'
- '<Текущая директория>\752zPgBShYuPFNvz188r9fTsN.exe'
- '%WINDIR%\55QQTLezL6Cvyt1enqWHstEAp.exe'
- '%WINDIR%\JBIjnDvjhcdPgFmiipKhxwGgV.exe'
- '<Текущая директория>\hP8g9PeVsUaWF0ypXmsFFdsF3.exe'
- '%HOMEPATH%\Start Menu\ttCyG5FZOKLM59w4rNAcvnEQn.exe'
- '%HOMEPATH%\Start Menu\816jTz22vQUUsi3qRIFES5NuB.exe'
- '%HOMEPATH%\Favorites\jY8qHdb6E3NEjKqUZtdopOn1D.exe'
- '%HOMEPATH%\Favorites\hP8g9PeVsUaWF0ypXmsFFdsF3.exe'
- '<SYSTEM32>\TBDCL3GmvmISOk8PVnl4e5QKM.exe'
- '%HOMEPATH%\Start Menu\Programs\WxE1DEnwZL6Wfmi19Zl2vdODT.exe'
- '%HOMEPATH%\Desktop\G9AkG0b84iy5LWFCybX1OIMlU.exe'
- '%HOMEPATH%\Favorites\niRibftBopvR4ZYA3Pk148NrC.exe'
- '%HOMEPATH%\Desktop\GlE0z0wYwyYNKulIo3J1eAngh.exe'
- '%HOMEPATH%\Start Menu\Programs\UYSEP2LFtPVqGkVNDvR7zrNWg.exe'
- '%HOMEPATH%\Desktop\qL8WIB2eX0gv69AewrV4PQLmV.exe'
- '%HOMEPATH%\SimlHhog3P6uOXXK4Jtednlnf.exe'
- '%PROGRAM_FILES%\qkpJJPuqNw7ktejYPYC8SiwsJ.exe'
- '%WINDIR%\lmUCbq6G7DCDzH2CIiQPmOvKF.exe'
- '%PROGRAM_FILES%\9gsXPgMQyjnxRyJZnKeShg2lK.exe'
- '%HOMEPATH%\Start Menu\Programs\KlkDNfCbIfEmxrMLKQ5z2qZsx.exe'
- '%APPDATA%\8KlQVUroSgdUw9PFFqiVCH9C3.exe'
- '%HOMEPATH%\6Z1hxNIbYteRp0HuftMz7OzWv.exe'
- '%APPDATA%\KWUVcV1OSwWuXZ0QOwKPYMOC3.exe'
- '%APPDATA%\o1Z1BOHYt6osQigM9KzDLfIQ2.exe'
- '%HOMEPATH%\Start Menu\mxMjtmnheYtIEGLLBnaEeh5Hu.exe'
- '%PROGRAM_FILES%\L9jiImRqEQkw8tKWl6UjhBxFj.exe'
- '%PROGRAM_FILES%\gzwB79Bq35ZZdzo2kqqMSyL9s.exe'
- '%HOMEPATH%\Start Menu\7Kbm4Ml8w5IIs92rEJPEAadxh.exe'
- '%HOMEPATH%\Start Menu\Programs\l1nvX2j5bRkl0w96WFs4Dbgv1.exe'
- '%PROGRAM_FILES%\9LTDXAtqmKvPjIklOHMXrwwit.exe'
- '%HOMEPATH%\Favorites\gBg8jGNJyx93SQ7hZM07JuT8U.exe'
- '%HOMEPATH%\My Documents\SOwakMacLBOOCk4AhnH6x8j2e.exe'
- '%PROGRAM_FILES%\2jLiPD9yfQLd6nBc9hXDLIQYd.exe'
- '%HOMEPATH%\Start Menu\ehKuW4sJOaLRdFih9I2prJ0vg.exe'
- '%WINDIR%\k7V73yUR1elrDMfaNoi8KFT9e.exe'
- '%HOMEPATH%\Favorites\sMr54eftxjoqQWeVWn150bvR3.exe'
- '%HOMEPATH%\Start Menu\o3lNurVaQ1n3S486sdf86RL89.exe'
- '%HOMEPATH%\Desktop\CQQfV9GyPFXrjC5urByN8zxX2.exe'
- '%HOMEPATH%\HGppYf2tXJP9PVIvaQmilUNFS.exe'
- '%HOMEPATH%\Favorites\MD3IYLtiuaBY6DUwFbJjC57AP.exe'
- '%HOMEPATH%\QTwLGMNqlQRQXi9nwwQV2LUoq.exe'
- '%APPDATA%\m3ezhDFHsZtUPAp4VGrTOfCSN.exe'
- '<SYSTEM32>\J7erpXrFA8HEiSOgt4FA2u948.exe'
- '%HOMEPATH%\Desktop\bbD6ACNFTRYQlPnJItuTT7iiM.exe'
- '%HOMEPATH%\Start Menu\UBEAudb4GspVIDf8RSd4xBSNv.exe'
- '<SYSTEM32>\CpK8L1IRBpPC63oILJ8FT6BhF.exe'
- '%HOMEPATH%\Favorites\T47zlvwo7gffMRLgbEyUDKaEt.exe'
- '%HOMEPATH%\Start Menu\KNceOPq9OZWHQlqYhLI3aeaSD.exe'
- '%HOMEPATH%\poZ2jIWBAKhcPRqX5quSN7ANC.exe'
- '%APPDATA%\poZ2jIWBAKhcPRqX5quSN7ANC.exe'
- '%HOMEPATH%\AISLBpQ4oQYt4XVF6vbSGOt2r.exe'
- '%PROGRAM_FILES%\fBVsCkNnzCtWSo1KZ1LYhHccj.exe'
- '<SYSTEM32>\5EJ8p9w0UhMM9WPd7wc19SEW4.exe'
- '<SYSTEM32>\nnb3r1lgR70TLMxTA6205a7hn.exe'
- '%HOMEPATH%\Start Menu\tpw5Epax3fkRjPeO8AxLdTArl.exe'
- '<Текущая директория>\fyG92bva89exlvCllcXjCLwz9.exe'
- '%HOMEPATH%\My Documents\VMXgUqj1i8AOgew5futtChbRN.exe'
- '%HOMEPATH%\Start Menu\Programs\mqmrzIjSYosAcU7ByrUjvxsFI.exe'
- '%HOMEPATH%\Start Menu\G4KUHrCSizmwvxSNjbNbUnpcq.exe'
- '<SYSTEM32>\WLoMUvB5F7H1Fm9unbeN7Gjc0.exe'
- '%HOMEPATH%\Desktop\qNlTS58Fxr85SQAfYYcuBl9tK.exe'
- '%HOMEPATH%\Start Menu\Programs\6Y3dx3YnFWIzjDYgqkSbZzQzz.exe'
- '<SYSTEM32>\vmomb0BFjZ5oBCfBtE5deApY0.exe'
- '%HOMEPATH%\Desktop\jkzPqN3TZwf3KJlotheuZYHhv.exe'
- '%APPDATA%\bWeNjDYlICMUX6e6DVxBZfYiO.exe'
- '%HOMEPATH%\Z0oqQt4ZTdUbDXrpMY5CS0Emp.exe'
- '%APPDATA%\CTOmlw3jb5Fjpl1FKbSmElPSA.exe'
- '%HOMEPATH%\Favorites\csp5272JyFlgSb3LFUVL1sINn.exe'
- '%HOMEPATH%\My Documents\9XAwWnD5icb7EyBymz4mmV0YO.exe'
- '%HOMEPATH%\Start Menu\Programs\u5k7UT9whybQXb2otqsFxDigk.exe'
- '%HOMEPATH%\Desktop\pyrU7fVqgVqfBHq48GcQYj8bE.exe'
- '%HOMEPATH%\Start Menu\Kpv3hPK2TIhlK2p6FesxPhr2F.exe'
- '%HOMEPATH%\Start Menu\Programs\9JBNiD1ZNG72SLl4MSGIdpD4v.exe'
- '%HOMEPATH%\Favorites\rjduAHyJtA1aCQTUFrSsLFlfw.exe'
- '%PROGRAM_FILES%\aUhAtWXirC1oRkqV2hf8p5iKv.exe'
- '<SYSTEM32>\KF1bJh5z4y5K7yGRTiEkUlbzD.exe'
- '%HOMEPATH%\Start Menu\K589O2qMwTpBl1cPNC5yBrqfz.exe'
- '%HOMEPATH%\AnTB4xMSdd0TMYUumW9Gfl2Na.exe'
- '%HOMEPATH%\F0UBtwkyPbyrl6I5w3Gx0GdD2.exe'
- '%HOMEPATH%\Desktop\Z6nuumdF9bVBB2zdCGlGQ1Wid.exe'
- '%HOMEPATH%\Start Menu\Programs\s8ORq737PZSMRZ24pTRhjTDZa.exe'
- '%HOMEPATH%\Desktop\dsLLuLmSuHpuX3c2mj7p6Nstd.exe'
- '%HOMEPATH%\Favorites\5OageyNYRarBnGfld6ujDjtYv.exe'
- '%HOMEPATH%\Start Menu\Programs\d0MBFQ7wxuDsLk1FWvji2D3AG.exe'
- '%WINDIR%\OJAuPM6Zr857o99myat9tC3uh.exe'
- '%HOMEPATH%\Desktop\pa2DCVbKuKi4qYq7rbEUBXhfj.exe'
- '%HOMEPATH%\Start Menu\Programs\pZO4CgaacocSe3kpWWoWIc3Di.exe'
- '%HOMEPATH%\Start Menu\Programs\Ok4HCaIOke7k4uT5Br2Q1cyGe.exe'
- '%PROGRAM_FILES%\RIbAarRzfa5BDCK7BXuvpZgis.exe'
- '%HOMEPATH%\My Documents\VrN3mZ5uWDIdTEv645UN01U7B.exe'
- '<SYSTEM32>\MbauGclS0pTyaZ1teeP3Pgdm8.exe'
Запускает на исполнение:
- '%WINDIR%\explorer.exe'
Завершает или пытается завершить
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\sphWk1yiS6Of6EO5RzkI0BD5w.exe
- %HOMEPATH%\Start Menu\Programs\9GpswpaNVV1qoJJSls032S2td.exe
- %PROGRAM_FILES%\FXvgGf6FHBMeP9Ukeoy2s3N9m.exe
- %HOMEPATH%\Start Menu\Programs\NvCcapuDXODwl4Uc9YYRN6Lr9.exe
- %HOMEPATH%\Favorites\jY8qHdb6E3NEjKqUZtdopOn1D.exe
- %APPDATA%\W1e18hx2xqZJXbYDeiLscQ1GT.exe
- %HOMEPATH%\Favorites\4xgMwhawOCmxX3lOHDfIhgeZW.exe
- %HOMEPATH%\2QnFQKZwghQYoI5ilQb0S06lw.exe
- <SYSTEM32>\izPPcCIU7szjBno6satqtQlMP.exe
- %PROGRAM_FILES%\zkXRKHV1SjJNhS7YaYsxZEYrS.exe
- %HOMEPATH%\My Documents\HyLqs291CW2M2X6PwiumwNNPF.exe
- %HOMEPATH%\My Documents\tSBEAEg7PzXh6MoPzXSD6iC0B.exe
- %HOMEPATH%\Start Menu\Programs\lDogwwknd2rES3180tKDX8gXT.exe
- %HOMEPATH%\Favorites\f6cosfZfNAmRdDk7Roq9VkMKH.exe
- %WINDIR%\JBIjnDvjhcdPgFmiipKhxwGgV.exe
- %PROGRAM_FILES%\Gzu2qP0GcKzi15IuyMcsmc59y.exe
- %HOMEPATH%\Start Menu\Programs\SztdpgYGGy6xrcoKFSWrPtqfN.exe
- %WINDIR%\55QQTLezL6Cvyt1enqWHstEAp.exe
- %HOMEPATH%\Start Menu\Programs\9JBNiD1ZNG72SLl4MSGIdpD4v.exe
- %HOMEPATH%\Favorites\rjduAHyJtA1aCQTUFrSsLFlfw.exe
- <Текущая директория>\752zPgBShYuPFNvz188r9fTsN.exe
- %HOMEPATH%\Start Menu\Programs\WxE1DEnwZL6Wfmi19Zl2vdODT.exe
- %HOMEPATH%\Start Menu\ttCyG5FZOKLM59w4rNAcvnEQn.exe
- %HOMEPATH%\Start Menu\816jTz22vQUUsi3qRIFES5NuB.exe
- <SYSTEM32>\TBDCL3GmvmISOk8PVnl4e5QKM.exe
- %HOMEPATH%\Start Menu\Programs\CKkoHgZubYlimUuv7YCbpd2Nc.exe
- <Текущая директория>\hP8g9PeVsUaWF0ypXmsFFdsF3.exe
- %HOMEPATH%\Favorites\hP8g9PeVsUaWF0ypXmsFFdsF3.exe
- %HOMEPATH%\SimlHhog3P6uOXXK4Jtednlnf.exe
- %HOMEPATH%\Favorites\niRibftBopvR4ZYA3Pk148NrC.exe
- %HOMEPATH%\Desktop\GlE0z0wYwyYNKulIo3J1eAngh.exe
- %HOMEPATH%\Desktop\G9AkG0b84iy5LWFCybX1OIMlU.exe
- %HOMEPATH%\Start Menu\Programs\UYSEP2LFtPVqGkVNDvR7zrNWg.exe
- %APPDATA%\o1Z1BOHYt6osQigM9KzDLfIQ2.exe
- %HOMEPATH%\Desktop\qL8WIB2eX0gv69AewrV4PQLmV.exe
- %WINDIR%\lmUCbq6G7DCDzH2CIiQPmOvKF.exe
- %PROGRAM_FILES%\9gsXPgMQyjnxRyJZnKeShg2lK.exe
- %HOMEPATH%\Start Menu\Programs\KlkDNfCbIfEmxrMLKQ5z2qZsx.exe
- %APPDATA%\KWUVcV1OSwWuXZ0QOwKPYMOC3.exe
- %PROGRAM_FILES%\qkpJJPuqNw7ktejYPYC8SiwsJ.exe
- %APPDATA%\8KlQVUroSgdUw9PFFqiVCH9C3.exe
- %HOMEPATH%\6Z1hxNIbYteRp0HuftMz7OzWv.exe
- %PROGRAM_FILES%\9LTDXAtqmKvPjIklOHMXrwwit.exe
- %PROGRAM_FILES%\L9jiImRqEQkw8tKWl6UjhBxFj.exe
- %PROGRAM_FILES%\gzwB79Bq35ZZdzo2kqqMSyL9s.exe
- %HOMEPATH%\Start Menu\mxMjtmnheYtIEGLLBnaEeh5Hu.exe
- %PROGRAM_FILES%\M38spfDqbn3jcCsLGzFYGiA8Z.exe
- %HOMEPATH%\Start Menu\7Kbm4Ml8w5IIs92rEJPEAadxh.exe
- %HOMEPATH%\Start Menu\Programs\l1nvX2j5bRkl0w96WFs4Dbgv1.exe
- %HOMEPATH%\My Documents\SOwakMacLBOOCk4AhnH6x8j2e.exe
- %PROGRAM_FILES%\2jLiPD9yfQLd6nBc9hXDLIQYd.exe
- %HOMEPATH%\Start Menu\ehKuW4sJOaLRdFih9I2prJ0vg.exe
- %HOMEPATH%\Start Menu\o3lNurVaQ1n3S486sdf86RL89.exe
- %HOMEPATH%\Favorites\gBg8jGNJyx93SQ7hZM07JuT8U.exe
- %WINDIR%\k7V73yUR1elrDMfaNoi8KFT9e.exe
- %HOMEPATH%\Favorites\sMr54eftxjoqQWeVWn150bvR3.exe
- %HOMEPATH%\QTwLGMNqlQRQXi9nwwQV2LUoq.exe
- %APPDATA%\m3ezhDFHsZtUPAp4VGrTOfCSN.exe
- <SYSTEM32>\J7erpXrFA8HEiSOgt4FA2u948.exe
- %HOMEPATH%\AISLBpQ4oQYt4XVF6vbSGOt2r.exe
- %HOMEPATH%\Start Menu\G4KUHrCSizmwvxSNjbNbUnpcq.exe
- <SYSTEM32>\WLoMUvB5F7H1Fm9unbeN7Gjc0.exe
- %HOMEPATH%\Desktop\qNlTS58Fxr85SQAfYYcuBl9tK.exe
- %HOMEPATH%\Start Menu\KNceOPq9OZWHQlqYhLI3aeaSD.exe
- %HOMEPATH%\poZ2jIWBAKhcPRqX5quSN7ANC.exe
- %APPDATA%\poZ2jIWBAKhcPRqX5quSN7ANC.exe
- %HOMEPATH%\Desktop\bbD6ACNFTRYQlPnJItuTT7iiM.exe
- %HOMEPATH%\Desktop\CQQfV9GyPFXrjC5urByN8zxX2.exe
- %HOMEPATH%\HGppYf2tXJP9PVIvaQmilUNFS.exe
- %HOMEPATH%\Favorites\MD3IYLtiuaBY6DUwFbJjC57AP.exe
- %HOMEPATH%\Start Menu\tpw5Epax3fkRjPeO8AxLdTArl.exe
- <Текущая директория>\fyG92bva89exlvCllcXjCLwz9.exe
- %HOMEPATH%\My Documents\VMXgUqj1i8AOgew5futtChbRN.exe
- <Текущая директория>\993b9dnNDSbd9qud.exe
- %TEMP%\aut1.tmp
- <Текущая директория>\NUu993ND9dhd9paxz.exe
- %TEMP%\aut2.tmp
- %HOMEPATH%\Start Menu\Programs\6Y3dx3YnFWIzjDYgqkSbZzQzz.exe
- <SYSTEM32>\vmomb0BFjZ5oBCfBtE5deApY0.exe
- %HOMEPATH%\Desktop\jkzPqN3TZwf3KJlotheuZYHhv.exe
- %HOMEPATH%\Start Menu\Programs\mqmrzIjSYosAcU7ByrUjvxsFI.exe
- %PROGRAM_FILES%\fBVsCkNnzCtWSo1KZ1LYhHccj.exe
- <SYSTEM32>\5EJ8p9w0UhMM9WPd7wc19SEW4.exe
- <SYSTEM32>\nnb3r1lgR70TLMxTA6205a7hn.exe
- %HOMEPATH%\My Documents\9XAwWnD5icb7EyBymz4mmV0YO.exe
- %APPDATA%\bWeNjDYlICMUX6e6DVxBZfYiO.exe
- %HOMEPATH%\Start Menu\Programs\u5k7UT9whybQXb2otqsFxDigk.exe
- %HOMEPATH%\AnTB4xMSdd0TMYUumW9Gfl2Na.exe
- %HOMEPATH%\Start Menu\Programs\pZO4CgaacocSe3kpWWoWIc3Di.exe
- %HOMEPATH%\Start Menu\Programs\Ok4HCaIOke7k4uT5Br2Q1cyGe.exe
- %HOMEPATH%\Favorites\csp5272JyFlgSb3LFUVL1sINn.exe
- <SYSTEM32>\KF1bJh5z4y5K7yGRTiEkUlbzD.exe
- %HOMEPATH%\Start Menu\Kpv3hPK2TIhlK2p6FesxPhr2F.exe
- %HOMEPATH%\Start Menu\K589O2qMwTpBl1cPNC5yBrqfz.exe
- %PROGRAM_FILES%\aUhAtWXirC1oRkqV2hf8p5iKv.exe
- %HOMEPATH%\Z0oqQt4ZTdUbDXrpMY5CS0Emp.exe
- %APPDATA%\CTOmlw3jb5Fjpl1FKbSmElPSA.exe
- %HOMEPATH%\Desktop\pyrU7fVqgVqfBHq48GcQYj8bE.exe
- %HOMEPATH%\Desktop\dsLLuLmSuHpuX3c2mj7p6Nstd.exe
- %HOMEPATH%\Start Menu\Programs\d0MBFQ7wxuDsLk1FWvji2D3AG.exe
- %HOMEPATH%\F0UBtwkyPbyrl6I5w3Gx0GdD2.exe
- %HOMEPATH%\Favorites\5OageyNYRarBnGfld6ujDjtYv.exe
- %HOMEPATH%\Start Menu\UBEAudb4GspVIDf8RSd4xBSNv.exe
- <SYSTEM32>\CpK8L1IRBpPC63oILJ8FT6BhF.exe
- %HOMEPATH%\Favorites\T47zlvwo7gffMRLgbEyUDKaEt.exe
- %HOMEPATH%\My Documents\VrN3mZ5uWDIdTEv645UN01U7B.exe
- <SYSTEM32>\MbauGclS0pTyaZ1teeP3Pgdm8.exe
- %HOMEPATH%\Desktop\pa2DCVbKuKi4qYq7rbEUBXhfj.exe
- %PROGRAM_FILES%\RIbAarRzfa5BDCK7BXuvpZgis.exe
- %HOMEPATH%\Desktop\Z6nuumdF9bVBB2zdCGlGQ1Wid.exe
- %HOMEPATH%\Start Menu\Programs\s8ORq737PZSMRZ24pTRhjTDZa.exe
- %WINDIR%\OJAuPM6Zr857o99myat9tC3uh.exe
Удаляет следующие файлы:
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
