Trojan.StartPage.59509

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Desktop\Internet Hao123nknk

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'to####.kantule.net':9282
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'ofefwtkzutfmwmahihwdsabirufelew' WindowName: 'swntxbbfzbtqycckuwfpveaairhjwe'
ClassName: 'hmckvsmpyqfgxggcspiweybclydz' WindowName: 'jkcnapallrubstrrtavxklxden'
ClassName: 'uybejwugfhpcvljkordqkvimdgp' WindowName: 'kvyiowfbyjkecbpjtcbkekudpuasjrftqwfyp'
ClassName: 'gfmqqycvxdlvlmyzsjbxlpkcnbezalblrctrf' WindowName: 'gpxzvbbdzfvypduft'
ClassName: 'rntbpaujkndozghjzqmafdfnzv' WindowName: 'ahskfgvbveerdifabckxsfzocffmdjbcqp'
ClassName: 'shjhdbymzynfqdagihk' WindowName: 'rcckydlcepzyfrzahzxdhdicgarwcdqv'
ClassName: 'thxharniujkuuxruudtxmeolndjdwubjtzugczc' WindowName: 'yjirghesmrgsmzbncahh'
ClassName: 'nxoddsmpihhmrnrbp' WindowName: 'zdbyzmpugbdazrjmsgrunncaivmqx'
ClassName: 'akmvkrddnsoajhjntdw' WindowName: 'uloqujygmgmblpvvompnbbnaloqrrhqivrt'
ClassName: 'iuxogkgmypakfkmdupfwaueyilnkh' WindowName: 'xbsfbyvrphfeclkelsmlngkbsjkjhgtlbkjqeuo'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'tsgzyognzyfcpaaoneuqigscergutkdqwmf' WindowName: 'jnyishqbzhsjwiwtbqlztayn'
ClassName: 'kpzmpkgdknjmwtvyrrycrzm' WindowName: 'hjhwgfayjziygzsgp'
ClassName: 'gdnhsvbxufbtrurlkndzafbnqrvtsh' WindowName: 'vwophloyngyqashtuumyaostawgqylj'
ClassName: 'ysxmdpzptoppgqbpd' WindowName: 'knbfjfuukihkctw'
ClassName: 'fnvzkiolqxekztogtpfbrkahdvjwrogjq' WindowName: 'dinwsfdeqdgifgcdlbjczkmtdb'
ClassName: 'nfspnmuyjaxuukwofratqixiodwhhl' WindowName: 'zlogkfdtrlvlbzejw'
ClassName: 'nkbxaqitsjlvnhbljxyhqnsbfpulcuakhz' WindowName: 'iyppgnfzdxrezholjtxalbuzp'
ClassName: 'qlaxmgzjptwlffcjfmhmhgnvdelelv' WindowName: 'yhptdadssuqtreicc'
ClassName: 'asigwxotsqvaawvxijrcwr' WindowName: 'vdjreyapzzvujztnktsmzpwr'
ClassName: 'kuuegjrilsegvxknrer' WindowName: 'qvcmkqiqerthbwoptksdfuqj'
ClassName: 'yemifemshcajairposdkxymbnrm' WindowName: 'dlmioyqkhljpzimtaggyikgyjnwtpraumnaj'
ClassName: 'ozxoikbaepkgcdsjfutwdmgrrarkt' WindowName: 'fpmxhccmuhjccqozpmwepjhtrpbwrvypdvz'
ClassName: 'xwyukmckfckfwkpsekqmfstgsurplaxdkmt' WindowName: 'txqmpuksbimectgegznnzhuh'
ClassName: 'xvxocdfwoeieeavwlbsems' WindowName: 'jzbsumptjlwhddeui'
ClassName: 'wqjcaokdxusvnaspastekuwwxeboetuvfj' WindowName: 'gchauhlifwmjdipjayvmmfdkjiykqzbaoz'
ClassName: 'cqdxahpjzdllvrkvockyqsmwj' WindowName: 'axadrtuzzlbrepgpxjrojpy'
ClassName: 'ckypvlvrrefkouyaztbifmgxyehhdwztrtktvj' WindowName: 'rcsexxlbxpojshqmhlagdcx'
ClassName: 'nwwydvfshuiinkehioymxaopeolkcyguq' WindowName: 'rdhcryzcrqtgywoaogytej'
ClassName: 'iisjekozuuebfssbiwmsqhidgn' WindowName: 'norhfcpjajfhsaulggzoxvmtapnmamikurm'
ClassName: 'cduzwjkktsjrirrzmfjblptpk' WindowName: 'subfbmqqvmpcoajvupojyoxmbanoiipq'
ClassName: 'aqhbhzhofqwrfrztbqamimofpevbrpun' WindowName: 'tgnxkwqdwysphxgjuguooot'
ClassName: 'xwwnyedtmphuncmp' WindowName: 'jgxpwmhqtfkdifuzaibsxesymyt'
ClassName: 'xgmssyqlrqeaqcofcuadtgpplyembtsllbxmth' WindowName: 'vozbtvrtelwxgzskaujdlv'
ClassName: 'lzmzpccnvxjyaqjyuaylqjcjqlqjdqvtebesg' WindowName: 'airsruzpvcrwbera'
ClassName: 'sbkwwcheyjltwwoihvlaoxebfgtaerbwigam' WindowName: 'wvsjzslcpptbxxxohlxmuqpvvxzsgk'
ClassName: 'vvpustokohfdxajkpvxcugfmkwjs' WindowName: 'vtwwtnmweposehtgkgtxujo'
ClassName: 'hpdefqucuuqlzagvbwteldpjulwfzvblwdxx' WindowName: 'wdzweujwmsipemkba'
ClassName: 'lafnevezambinjsenakmo' WindowName: 'qcqzutpyxljcgxfhvmvvmxipmekscindwfng'
ClassName: 'apdohzqaqxvdfwf' WindowName: 'dropidmigaftsvnuroczht'
ClassName: 'dfmhfvjvtnohqxc' WindowName: 'matvoszvcvjbrgfxb'
ClassName: 'pkksietatpyjsugqrpkwmweisvsxsbfhhrsvn' WindowName: 'kekmxmmbgjgdnyanj'
ClassName: 'imefrvqsceegedeaubmifsjtlhcfzmwwflfx' WindowName: 'fpalqyvlopcaevvyrkf'
ClassName: 'pjvepuidhssnwqoiwsmnhf' WindowName: 'dgdlxdccqcvhxdrzlofohiqeghmmbvdhjm'
ClassName: 'guvrndgoykzjkcgbpwgpg' WindowName: 'hzvtjznrmaqvvxhdcoeukcixjexmueikss'
ClassName: 'gpnaqztypoozlxv' WindowName: 'vzedcluzxejrtqzltjktcjarcsj'
ClassName: 'lonrmxzqvlvggduooipofkib' WindowName: 'mcrvfepjymmakybxpzytrcydgsxh'
ClassName: 'svpajxbvoimapkwyzxvxttrdlrxx' WindowName: 'ynslukqszoxwsxzljrqsazqdadvkldrdjjc'
ClassName: 'fxjjjxewmgmfbanyfot' WindowName: 'gnucunbwfjbnsfblzwvysptqvscpjapwbt'
ClassName: 'kggveprvuxctodoqfatbnbhgsbaxgyejrrfgrfe' WindowName: 'urcipuyjptaxqbqnqeslsdnkffscvknwkglksm'
ClassName: 'lmhrwrjjgjaakalwodzwihfghdzrsxhahlcnf' WindowName: 'qszjvofkuxobhskvfqgmzzjgj'
ClassName: 'latbbapzrppyprcrnpmsjwa' WindowName: 'fbmwtbdnzdhfiyeujaevusvoyfivvrzwbct'
ClassName: 'uqrnygdsbsxiigynjaufwjiyostbqhldhig' WindowName: 'rbufsvriipsmfjtuvoaayngchbabefydrpauhb'
ClassName: 'jihsfoxozjsozhezanmxbtn' WindowName: 'mxwermeohikgegqvhfdppcloccawfdlwgfduag'
ClassName: 'etesfttemxihruuickrvwiwwwjrmgyfb' WindowName: 'lswmwebbqocpdebn'
ClassName: 'leqabpocigtzwaricgskkcaw' WindowName: 'gyltgbuligdulxkkiowfoccttrtksc'
ClassName: 'yepbpakbvzipdhcnkeouhih' WindowName: 'fskmntjyqnlplbllmucwatxewxhixps'
ClassName: 'pzspqkafwlfzjdonio' WindowName: 'tnodxhtplkhetuuaftjwxralnnmzufk'
ClassName: 'dbmxxayhixjvlclmbdeoeylyhagjknninlry' WindowName: 'gertzvudvqdtwdqgo'
ClassName: 'ztozgyokbnxygxdfe' WindowName: 'pzigqoitrftyklywnczengdnsnfy'
ClassName: 'kyvloudaeuddqplgftkskwnzdz' WindowName: 'pcxosxnxhbhzliscsqkyantdk'
ClassName: 'qwaevjlcemimbqsn' WindowName: 'asqvdtbycukegdxfsdtyehlj'
ClassName: 'fzacuiyjeavyccqvhnazrdjefz' WindowName: 'rvefkgzrpucnaaodjwapyrdcqlgbofgxyvlbrg'