Trojan.StartPage.59238

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Desktop\Internet Hao123nknk

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'mlyokxngwpcgsnfiwfjiaineqrvdoocu' WindowName: 'fteijtowhuerdrxmckmmvvbbetzegmvrbtutnkk'
ClassName: 'cvauuzvrbmkmpvymohqvuvkxbwwcerumjmdvx' WindowName: 'kpgapydpcawyqbqtpxyn'
ClassName: 'brgjhwiesesxnyjfpnggetziddyehe' WindowName: 'qdbdfvrzgswraekryhitsjr'
ClassName: 'bparrlwqmtupbjslzail' WindowName: 'dsnrzcmlhiwfwrslwoadcasm'
ClassName: 'lurggjtubwgkoubvknolutmzglkuca' WindowName: 'xmxdvtcfsaswsjmjrgfxpncwsruyybl'
ClassName: 'vdufkrhrrtfxlfsgpbaibkncmaxxjxkmd' WindowName: 'nypsuapiykzevrfp'
ClassName: 'fluejyqkhsfycowzzgswmqysxkcjzbul' WindowName: 'okzkbzzixoqdibuecdtwqvpxek'
ClassName: 'dipbisbbgyqywedcvcugrfgqorflc' WindowName: 'wcabjnkruorumdaoenllbjdacbfhoeougxcqudy'
ClassName: 'bnalwpdxomkzzwfjxyszbqmjywjxifbedrtba' WindowName: 'vagopzvrgjcnudenoawnlohgfenwgrgfuxu'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'qriltgdyqwpiojhdleahwqcli' WindowName: 'eierkvpspzahipdslljnpcdznba'
ClassName: 'vomdodzbcpcfrwnwphgug' WindowName: 'cvezqyceorhuyexhpkqfb'
ClassName: 'jbxckyvqtvbbjyjk' WindowName: 'zbvouionspffnqudaxocmgqlvtee'
ClassName: 'wmonsqvckvgoqhajrxmkv' WindowName: 'xbvenwuabtqoayazmkiudhgouqxm'
ClassName: 'khwbhdhthubjzhgwbiusqjsstitfwdgcq' WindowName: 'gvojnftzwmydlnz'
ClassName: 'ohxkbnpvursesztzzkxcfcvxczujzn' WindowName: 'qcbjujtnltyqcjbzizuqqvfveildq'
ClassName: 'zfvusubqsmkifqgacisarqwejsoxmelpyeudx' WindowName: 'splecgphfdjpdyehmfzeztlbjvfd'
ClassName: 'mxcnhsnfufqtneoeacbhgwctdyvmtfsfvddq' WindowName: 'blvvcycxknssdjfwmdi'
ClassName: 'mtgpanfnqxeahynanfgtjwrkkbr' WindowName: 'hkwyqcryuxnamafiwhbqmpekophchopywhxih'
ClassName: 'wpjutzmlmxcwgpdtnoi' WindowName: 'ncqhfvoxabbaqhuvizzkdak'
ClassName: 'zkxepuieukvyhgvskpdboksctdanp' WindowName: 'udeuhkjnprfcujkyuwbctzgxcpjvoejmxos'
ClassName: 'zrmhgjkwusasoispebqaybo' WindowName: 'usmjrdymlisgxzyirupifpixu'
ClassName: 'dnjmqwvffdzeivnsycnynldkmbaeuktvfcmjo' WindowName: 'hpqsnzczsxalxldzoq'
ClassName: 'xinutfbkwswwkdeywqpiykqsg' WindowName: 'arbddsykzdgbusjkuvkfestyssvmnrqboudm'
ClassName: 'cocnjdlmuzhhzkwljmgtxglmcdnbhijjdmgdx' WindowName: 'pealovgshlsdzdiauhlgzztaedznrdnnlfhrh'
ClassName: 'kvibmnbzyoymlwcgvvao' WindowName: 'wbavgsgsukjgesilsisalgw'
ClassName: 'wdwotutxiphxywnkboqx' WindowName: 'stktdvhbvmiyaztewjjeagejzhngdqyx'
ClassName: 'uzxlhyaluoplfwteqzkjxxvzsx' WindowName: 'gfhliwmkqussupthaqxky'
ClassName: 'qrcrgycpkeofavujyoeripemzt' WindowName: 'lwhslnaqrneutpstcuxkbzazpilqmwyqddkh'
ClassName: 'imydizrdeyrgzcrzvt' WindowName: 'xldusiwhjvyxagkissqcclhoszgkgzrom'
ClassName: 'sgzyzjtnrxjfnxqftrxuppmwafgtrhbayfrria' WindowName: 'khhhzyhorfjuylqcbyueatacbjxdzsuhmldk'
ClassName: 'nmgltrypialuzxangsldxifdufirctbm' WindowName: 'wgmlxgteozvezmbzmkdowfwaowzemgjisat'
ClassName: 'qdesinxpmprpxcxwh' WindowName: 'nsgozqdiqfdtfazbzyfhx'
ClassName: 'awovshhneipqrgpplavqwywduvscrbraz' WindowName: 'epvjmtitegsfopbasyv'
ClassName: 'qizzlyxaotegzojluqptdzrjilndwwhwe' WindowName: 'dzklumwgtghtxit'
ClassName: 'zwapurhhhuvxbtbdx' WindowName: 'ziryhadtbuacnwtjzuichrfjkrruapfmokn'
ClassName: 'woqqhhxfzoqjytnoozalunqi' WindowName: 'myxxdgivhtgriwymwxggjn'
ClassName: 'wsclzfnbcoptzfqvubccmzdgglngpt' WindowName: 'jqsthqrwikpwwwbknzwespchmnte'
ClassName: 'uxbwsdsbfbuvvafzvontjqrhnuzuomyqtlz' WindowName: 'jumwsenzrhyynuhmhqezhkinfmkuihiiyv'
ClassName: 'biutgipferrwoqxrpimkbszupcvysokypygt' WindowName: 'igrhcosyvidattzsmcopkbliwoohqqinyuai'
ClassName: 'otbgqjruyepuptoipu' WindowName: 'dayndnjdrcnfgspjqvjvmdqakcmowbutyjcjef'
ClassName: 'gyvfdfvnuptoynvzr' WindowName: 'whambeangkmeetuafelcblaqqxbgopzpis'
ClassName: 'easzurdqhokahjqzgymopeuv' WindowName: 'ynonuwoilcybaojrdaywwymfgrnscn'
ClassName: 'zopgtxqxjgyqkzcwizthiyzjco' WindowName: 'dkqpkmxkovtpcnzxxwvgfelrdyqgmfr'
ClassName: 'nlhvarzlaqtwxbzfzz' WindowName: 'jbmonttkxguucjakaywjpfddzlhcmdqertqmskn'
ClassName: 'kxklmllxgsvjefmgfykw' WindowName: 'htwgewjczbyjban'
ClassName: 'uveixgelfasiygczghztw' WindowName: 'yithhaclbtzbsxvrbkhnwcnuhfeixgvkkxl'
ClassName: 'vfovnooixkxpdqkgwqlatxpm' WindowName: 'vxwkyhndrebzmlluhqrzwbjaeesxpcsdtwh'
ClassName: 'wlnriwmkllodnsnmstbztdcmybpiauguqi' WindowName: 'yvsmufduexsguqctnlotwjvxwc'
ClassName: 'kpqfzacwinlowud' WindowName: 'esmmhaixpkugnbfhyuwugcrejbis'
ClassName: 'foplnmqsjqpdaiilizdyjzntmjqxygr' WindowName: 'drdfacgnqvolbsscemxbjkogcjvimcpyrr'
ClassName: 'aprpzqyxyishtgv' WindowName: 'imfvacxxwknrqqqyhgkuggrh'
ClassName: 'zdtiduzbigixjbmllwxic' WindowName: 'nwfjkmswlbqmbbwaomopgvbsmxv'
ClassName: 'yxcdksijcugueyjtacrpjwxlaiyf' WindowName: 'qsyzutwbakvbfxhpmfxhfg'
ClassName: 'ansxrdpxlyovdrvurfutzvcnfbybgljdfot' WindowName: 'ryvvudehjdsiuawtbaggunackunsjlokuorryof'
ClassName: 'dpnmwatjdhmfikgbitauk' WindowName: 'kchiucoqztajzlyomdrysxizsjgwijxzstxyozv'
ClassName: 'vidnesgvnjrbumzhytxpqktwscphnnvxs' WindowName: 'itqyyubrurvznsdkqrxwmputpnzlj'
ClassName: 'eidprupvtappsvwflweykufyypprx' WindowName: 'pxapcfpjvgzxcwlxadgcujqzqop'
ClassName: 'lftitmqtaxskegoevllsrq' WindowName: 'ttpknsdcyhzytiiapisqldp'
ClassName: 'jndgqrbumgfyzlmhsfszeajjbaap' WindowName: 'chpmnmfiaxoieapxvdypufttbj'