Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt] 'DLLName' = 'crypts.dll'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\FAFB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[62].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[62].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[62].php
- %TEMP%\FCB0.tmp
- %TEMP%\F936.tmp
- %TEMP%\F5CB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[61].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[61].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[61].php
- %TEMP%\F780.tmp
- %TEMP%\FE56.tmp
- %TEMP%\55B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[63].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[63].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[64].php
- %TEMP%\720.tmp
- %TEMP%\396.tmp
- %TEMP%\1B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[62].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[63].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[63].php
- %TEMP%\1D1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[59].php
- %TEMP%\E669.tmp
- %TEMP%\E81F.tmp
- %TEMP%\E9C5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[59].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[59].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[58].php
- %TEMP%\E129.tmp
- %TEMP%\E2EF.tmp
- %TEMP%\E4A4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[58].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[59].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[60].php
- %TEMP%\F09B.tmp
- %TEMP%\F250.tmp
- %TEMP%\F406.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[61].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[60].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[60].php
- %TEMP%\EB7A.tmp
- %TEMP%\ED20.tmp
- %TEMP%\EEE5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[60].php
- %TEMP%\2547.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[67].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[68].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[68].php
- %TEMP%\270C.tmp
- %TEMP%\2372.tmp
- %TEMP%\1FF8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[67].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[67].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[67].php
- %TEMP%\21AD.tmp
- %TEMP%\28D1.tmp
- %TEMP%\2FB7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[69].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[69].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[69].php
- %TEMP%\317C.tmp
- %TEMP%\2DF2.tmp
- %TEMP%\2A87.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[68].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[68].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[69].php
- %TEMP%\2C3C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[65].php
- %TEMP%\E25.tmp
- %TEMP%\FEA.tmp
- %TEMP%\13B3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[65].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[64].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[64].php
- %TEMP%\8D6.tmp
- %TEMP%\A8B.tmp
- %TEMP%\C50.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[64].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[65].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[66].php
- %TEMP%\1A99.tmp
- %TEMP%\1C6D.tmp
- %TEMP%\1E23.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[66].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[66].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[65].php
- %TEMP%\1568.tmp
- %TEMP%\171E.tmp
- %TEMP%\18E3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[66].php
- %TEMP%\AC5E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[50].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[50].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[51].php
- %TEMP%\AE04.tmp
- %TEMP%\AAB8.tmp
- %TEMP%\A76C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[49].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[50].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[50].php
- %TEMP%\A912.tmp
- %TEMP%\AFAA.tmp
- %TEMP%\B670.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[52].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[52].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[52].php
- %TEMP%\B816.tmp
- %TEMP%\B4BA.tmp
- %TEMP%\B16F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[51].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[51].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[51].php
- %TEMP%\B315.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[47].php
- %TEMP%\9868.tmp
- %TEMP%\9A1E.tmp
- %TEMP%\9BB4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[48].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[47].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[47].php
- %TEMP%\9377.tmp
- %TEMP%\951D.tmp
- %TEMP%\96C3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[47].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[48].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[49].php
- %TEMP%\A26B.tmp
- %TEMP%\A411.tmp
- %TEMP%\A5C6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[49].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[49].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[48].php
- %TEMP%\9D89.tmp
- %TEMP%\9F1F.tmp
- %TEMP%\A0C5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[48].php
- %TEMP%\D37D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[56].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[56].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[56].php
- %TEMP%\D533.tmp
- %TEMP%\D1D8.tmp
- %TEMP%\CE1E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[55].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[55].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[56].php
- %TEMP%\CFC4.tmp
- %TEMP%\D6E8.tmp
- %TEMP%\DDCE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[57].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[58].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[58].php
- %TEMP%\DF74.tmp
- %TEMP%\DC09.tmp
- %TEMP%\D89E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[57].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[57].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[57].php
- %TEMP%\DA63.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[53].php
- %TEMP%\BEBD.tmp
- %TEMP%\C063.tmp
- %TEMP%\C228.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[53].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[53].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[52].php
- %TEMP%\B9BC.tmp
- %TEMP%\BB71.tmp
- %TEMP%\BD17.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[53].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[54].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[55].php
- %TEMP%\C8FE.tmp
- %TEMP%\CAA4.tmp
- %TEMP%\CC59.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[55].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[54].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[54].php
- %TEMP%\C3CE.tmp
- %TEMP%\C593.tmp
- %TEMP%\C739.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[54].php
- %TEMP%\AAC3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[85].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[85].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[85].php
- %TEMP%\ACC6.tmp
- %TEMP%\A8B0.tmp
- %TEMP%\A4B8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[84].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[84].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[84].php
- %TEMP%\A69C.tmp
- %TEMP%\AEDA.tmp
- %TEMP%\B717.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[86].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[86].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[87].php
- %TEMP%\B92A.tmp
- %TEMP%\B504.tmp
- %TEMP%\B0ED.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[85].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[86].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[86].php
- %TEMP%\B2F1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[82].php
- %TEMP%\923A.tmp
- %TEMP%\944D.tmp
- %TEMP%\9650.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[82].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[82].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[81].php
- %TEMP%\8C0F.tmp
- %TEMP%\8E23.tmp
- %TEMP%\9026.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[81].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[82].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[83].php
- %TEMP%\9E8E.tmp
- %TEMP%\A0B1.tmp
- %TEMP%\A2B4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[84].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[83].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[83].php
- %TEMP%\9864.tmp
- %TEMP%\9A67.tmp
- %TEMP%\9C8A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[83].php
- %TEMP%\DBD5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[90].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[91].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[91].php
- %TEMP%\DDE9.tmp
- %TEMP%\D9A3.tmp
- %TEMP%\D58C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[90].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[90].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[90].php
- %TEMP%\D79F.tmp
- %TEMP%\E22E.tmp
- %TEMP%\ECAE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[92].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[92].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[92].php
- %TEMP%\EED1.tmp
- %TEMP%\EA3D.tmp
- %TEMP%\E451.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[91].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[91].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[92].php
- %TEMP%\E664.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[88].php
- %TEMP%\C168.tmp
- %TEMP%\C37B.tmp
- %TEMP%\C58E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[88].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[87].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[87].php
- %TEMP%\BB3E.tmp
- %TEMP%\BD51.tmp
- %TEMP%\BF54.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[87].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[88].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[89].php
- %TEMP%\CE39.tmp
- %TEMP%\D146.tmp
- %TEMP%\D379.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[89].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[89].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[88].php
- %TEMP%\C7A1.tmp
- %TEMP%\C9C4.tmp
- %TEMP%\CBC8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[89].php
- %TEMP%\4DCE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[73].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[73].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[74].php
- %TEMP%\4FC2.tmp
- %TEMP%\4BCA.tmp
- %TEMP%\4850.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[72].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[73].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[73].php
- %TEMP%\4A15.tmp
- %TEMP%\51C6.tmp
- %TEMP%\59D4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[75].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[75].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[75].php
- %TEMP%\5BD8.tmp
- %TEMP%\57D0.tmp
- %TEMP%\53BA.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[74].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[74].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[74].php
- %TEMP%\55BD.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[70].php
- %TEMP%\3881.tmp
- %TEMP%\3A46.tmp
- %TEMP%\3C0B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[71].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[70].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[70].php
- %TEMP%\3331.tmp
- %TEMP%\34F7.tmp
- %TEMP%\36BC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[70].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[71].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[72].php
- %TEMP%\4310.tmp
- %TEMP%\44D5.tmp
- %TEMP%\468B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[72].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[72].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[71].php
- %TEMP%\3DE0.tmp
- %TEMP%\3FA5.tmp
- %TEMP%\415A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[71].php
- %TEMP%\7BF2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[79].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[79].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[79].php
- %TEMP%\7DF6.tmp
- %TEMP%\79EF.tmp
- %TEMP%\75D8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[78].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[78].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[79].php
- %TEMP%\77EB.tmp
- %TEMP%\8009.tmp
- %TEMP%\8818.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[80].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[81].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[81].php
- %TEMP%\89FC.tmp
- %TEMP%\8614.tmp
- %TEMP%\81FD.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[80].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[80].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[80].php
- %TEMP%\8411.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[76].php
- %TEMP%\63C7.tmp
- %TEMP%\65CB.tmp
- %TEMP%\67CE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[76].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[76].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[75].php
- %TEMP%\5DDB.tmp
- %TEMP%\5FCF.tmp
- %TEMP%\61D3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[76].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[77].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[78].php
- %TEMP%\6FCD.tmp
- %TEMP%\71C1.tmp
- %TEMP%\73E4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[78].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[77].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[77].php
- %TEMP%\69D2.tmp
- %TEMP%\6BD5.tmp
- %TEMP%\6DC9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[77].php
- %TEMP%\CF9A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[16].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[16].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[16].php
- %TEMP%\D121.tmp
- %TEMP%\CE14.tmp
- %TEMP%\CB06.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[15].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[15].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[15].php
- %TEMP%\CC7D.tmp
- %TEMP%\D2A7.tmp
- %TEMP%\D8D2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[17].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[17].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[18].php
- %TEMP%\DA58.tmp
- %TEMP%\D74B.tmp
- %TEMP%\D42E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[16].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[17].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[17].php
- %TEMP%\D5B5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[13].php
- %TEMP%\A435.tmp
- %TEMP%\A8F8.tmp
- %TEMP%\ADAB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[13].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[13].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[12].php
- %TEMP%\961B.tmp
- %TEMP%\9ADE.tmp
- %TEMP%\9F91.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[12].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[13].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[14].php
- %TEMP%\C0A6.tmp
- %TEMP%\C559.tmp
- %TEMP%\C980.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[15].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[14].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[14].php
- %TEMP%\B28D.tmp
- %TEMP%\B740.tmp
- %TEMP%\BBF3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[14].php
- %TEMP%\F301.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[21].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[22].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[22].php
- %TEMP%\F497.tmp
- %TEMP%\F17A.tmp
- %TEMP%\EE5D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[21].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[21].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[21].php
- %TEMP%\EFE4.tmp
- %TEMP%\F61E.tmp
- %TEMP%\FC57.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[23].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[23].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[23].php
- %TEMP%\FDDE.tmp
- %TEMP%\FAD1.tmp
- %TEMP%\F7A4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[22].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[22].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[23].php
- %TEMP%\F93A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[19].php
- %TEMP%\E073.tmp
- %TEMP%\E1F9.tmp
- %TEMP%\E390.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[19].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[18].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[18].php
- %TEMP%\DBDF.tmp
- %TEMP%\DD65.tmp
- %TEMP%\DEEC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[18].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[19].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[20].php
- %TEMP%\E9BA.tmp
- %TEMP%\EB40.tmp
- %TEMP%\ECC7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[20].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[20].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[19].php
- %TEMP%\E516.tmp
- %TEMP%\E69D.tmp
- %TEMP%\E823.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[20].php
- %TEMP%\44B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[5].php
- %TEMP%\8EF.tmp
- %TEMP%\FFB7.tmp
- %TEMP%\F651.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[4].php
- %TEMP%\FAF5.tmp
- %TEMP%\DA2.tmp
- %TEMP%\204F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[6].php
- %TEMP%\2502.tmp
- %TEMP%\1BAC.tmp
- %TEMP%\1255.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[5].php
- %TEMP%\16F9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[1].php
- %TEMP%\C5CB.tmp
- %TEMP%\CACD.tmp
- %TEMP%\D193.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[1].php
- <SYSTEM32>\crypts.dll
- %TEMP%\A562.tmp
- %TEMP%\BE49.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[3].php
- %TEMP%\E828.tmp
- %TEMP%\ECEB.tmp
- %TEMP%\F18E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[2].php
- %TEMP%\D740.tmp
- %TEMP%\DD6A.tmp
- %TEMP%\E2F8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[2].php
- %TEMP%\6FF6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[10].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[10].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[10].php
- %TEMP%\74A9.tmp
- %TEMP%\6B52.tmp
- %TEMP%\61EC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[9].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[9].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[10].php
- %TEMP%\669F.tmp
- %TEMP%\795C.tmp
- %TEMP%\8CB5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[11].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[12].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[12].php
- %TEMP%\9178.tmp
- %TEMP%\8766.tmp
- %TEMP%\7E0F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[11].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[11].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[11].php
- %TEMP%\82C2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[7].php
- %TEMP%\37CF.tmp
- %TEMP%\3C92.tmp
- %TEMP%\4145.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[6].php
- %TEMP%\29C5.tmp
- %TEMP%\2E69.tmp
- %TEMP%\331C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[8].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[9].php
- %TEMP%\53F2.tmp
- %TEMP%\58A5.tmp
- %TEMP%\5D49.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[9].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[8].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[8].php
- %TEMP%\45F8.tmp
- %TEMP%\4A9B.tmp
- %TEMP%\4F3F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[8].php
- %TEMP%\6090.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[39].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[39].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[39].php
- %TEMP%\6235.tmp
- %TEMP%\5EEA.tmp
- %TEMP%\5BAE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[38].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[38].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[38].php
- %TEMP%\5D53.tmp
- %TEMP%\63CC.tmp
- %TEMP%\6A73.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[40].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[40].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[41].php
- %TEMP%\6C09.tmp
- %TEMP%\68BD.tmp
- %TEMP%\6572.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[39].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[40].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[40].php
- %TEMP%\6727.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[36].php
- %TEMP%\4D27.tmp
- %TEMP%\4EBD.tmp
- %TEMP%\5053.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[36].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[36].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[35].php
- %TEMP%\4854.tmp
- %TEMP%\49FA.tmp
- %TEMP%\4B91.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[35].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[36].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[37].php
- %TEMP%\56CC.tmp
- %TEMP%\5862.tmp
- %TEMP%\5A08.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[38].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[37].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[37].php
- %TEMP%\51F9.tmp
- %TEMP%\538F.tmp
- %TEMP%\5535.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[37].php
- %TEMP%\8638.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[44].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[45].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[45].php
- %TEMP%\87DE.tmp
- %TEMP%\8492.tmp
- %TEMP%\8147.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[44].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[44].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[44].php
- %TEMP%\82FC.tmp
- %TEMP%\8974.tmp
- %TEMP%\900C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[46].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[46].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[46].php
- %TEMP%\91E1.tmp
- %TEMP%\8E66.tmp
- %TEMP%\8B2A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[45].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[45].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[46].php
- %TEMP%\8CC0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[42].php
- %TEMP%\7281.tmp
- %TEMP%\7427.tmp
- %TEMP%\75BD.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[42].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[41].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[41].php
- %TEMP%\6D9F.tmp
- %TEMP%\6F45.tmp
- %TEMP%\70DB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[41].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[42].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[43].php
- %TEMP%\7C45.tmp
- %TEMP%\7E0A.tmp
- %TEMP%\7FB0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[43].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[43].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[42].php
- %TEMP%\7763.tmp
- %TEMP%\78FA.tmp
- %TEMP%\7A9F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[43].php
- %TEMP%\16F4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[27].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[27].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[28].php
- %TEMP%\188A.tmp
- %TEMP%\155E.tmp
- %TEMP%\1241.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[26].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[27].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[27].php
- %TEMP%\13D7.tmp
- %TEMP%\1A20.tmp
- %TEMP%\206A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[29].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[29].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[29].php
- %TEMP%\21F0.tmp
- %TEMP%\1ED3.tmp
- %TEMP%\1BB7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[28].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[28].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[28].php
- %TEMP%\1D3D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[24].php
- %TEMP%\427.tmp
- %TEMP%\5BE.tmp
- %TEMP%\744.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[25].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[24].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[24].php
- %TEMP%\FF74.tmp
- %TEMP%\10A.tmp
- %TEMP%\291.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[24].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[25].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[26].php
- %TEMP%\D8E.tmp
- %TEMP%\F14.tmp
- %TEMP%\10AA.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[26].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[26].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[25].php
- %TEMP%\8DA.tmp
- %TEMP%\A71.tmp
- %TEMP%\BF7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[25].php
- %TEMP%\3B64.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[33].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[33].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[33].php
- %TEMP%\3D0A.tmp
- %TEMP%\39CE.tmp
- %TEMP%\36A1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[32].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[32].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[33].php
- %TEMP%\3837.tmp
- %TEMP%\3EA0.tmp
- %TEMP%\44F9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[34].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[35].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[35].php
- %TEMP%\46BE.tmp
- %TEMP%\4372.tmp
- %TEMP%\4036.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[34].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[34].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[34].php
- %TEMP%\41CD.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[30].php
- %TEMP%\2859.tmp
- %TEMP%\29EF.tmp
- %TEMP%\2B85.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[30].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[30].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[29].php
- %TEMP%\2396.tmp
- %TEMP%\251D.tmp
- %TEMP%\26B3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[30].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[31].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[32].php
- %TEMP%\31DE.tmp
- %TEMP%\3375.tmp
- %TEMP%\350B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[32].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[31].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[31].php
- %TEMP%\2D1C.tmp
- %TEMP%\2EB2.tmp
- %TEMP%\3048.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[31].php
Удаляет следующие файлы:
- %TEMP%\FAFB.tmp
- %TEMP%\FCB0.tmp
- %TEMP%\F936.tmp
- %TEMP%\F5CB.tmp
- %TEMP%\F780.tmp
- %TEMP%\FE56.tmp
- %TEMP%\55B.tmp
- %TEMP%\720.tmp
- %TEMP%\396.tmp
- %TEMP%\1B.tmp
- %TEMP%\1D1.tmp
- %TEMP%\E81F.tmp
- %TEMP%\E9C5.tmp
- %TEMP%\E669.tmp
- %TEMP%\E2EF.tmp
- %TEMP%\E4A4.tmp
- %TEMP%\EB7A.tmp
- %TEMP%\F250.tmp
- %TEMP%\F406.tmp
- %TEMP%\F09B.tmp
- %TEMP%\ED20.tmp
- %TEMP%\EEE5.tmp
- %TEMP%\8D6.tmp
- %TEMP%\2547.tmp
- %TEMP%\270C.tmp
- %TEMP%\2372.tmp
- %TEMP%\1FF8.tmp
- %TEMP%\21AD.tmp
- %TEMP%\28D1.tmp
- %TEMP%\2FB7.tmp
- %TEMP%\317C.tmp
- %TEMP%\2DF2.tmp
- %TEMP%\2A87.tmp
- %TEMP%\2C3C.tmp
- %TEMP%\FEA.tmp
- %TEMP%\13B3.tmp
- %TEMP%\E25.tmp
- %TEMP%\A8B.tmp
- %TEMP%\C50.tmp
- %TEMP%\1568.tmp
- %TEMP%\1C6D.tmp
- %TEMP%\1E23.tmp
- %TEMP%\1A99.tmp
- %TEMP%\171E.tmp
- %TEMP%\18E3.tmp
- %TEMP%\E129.tmp
- %TEMP%\AC5E.tmp
- %TEMP%\AE04.tmp
- %TEMP%\AAB8.tmp
- %TEMP%\A76C.tmp
- %TEMP%\A912.tmp
- %TEMP%\AFAA.tmp
- %TEMP%\B670.tmp
- %TEMP%\B816.tmp
- %TEMP%\B4BA.tmp
- %TEMP%\B16F.tmp
- %TEMP%\B315.tmp
- %TEMP%\9A1E.tmp
- %TEMP%\9BB4.tmp
- %TEMP%\9868.tmp
- %TEMP%\951D.tmp
- %TEMP%\96C3.tmp
- %TEMP%\9D89.tmp
- %TEMP%\A411.tmp
- %TEMP%\A5C6.tmp
- %TEMP%\A26B.tmp
- %TEMP%\9F1F.tmp
- %TEMP%\A0C5.tmp
- %TEMP%\B9BC.tmp
- %TEMP%\D37D.tmp
- %TEMP%\D533.tmp
- %TEMP%\D1D8.tmp
- %TEMP%\CE1E.tmp
- %TEMP%\CFC4.tmp
- %TEMP%\D6E8.tmp
- %TEMP%\DDCE.tmp
- %TEMP%\DF74.tmp
- %TEMP%\DC09.tmp
- %TEMP%\D89E.tmp
- %TEMP%\DA63.tmp
- %TEMP%\C063.tmp
- %TEMP%\C228.tmp
- %TEMP%\BEBD.tmp
- %TEMP%\BB71.tmp
- %TEMP%\BD17.tmp
- %TEMP%\C3CE.tmp
- %TEMP%\CAA4.tmp
- %TEMP%\CC59.tmp
- %TEMP%\C8FE.tmp
- %TEMP%\C593.tmp
- %TEMP%\C739.tmp
- %TEMP%\3331.tmp
- %TEMP%\AAC3.tmp
- %TEMP%\ACC6.tmp
- %TEMP%\A8B0.tmp
- %TEMP%\A4B8.tmp
- %TEMP%\A69C.tmp
- %TEMP%\AEDA.tmp
- %TEMP%\B717.tmp
- %TEMP%\B92A.tmp
- %TEMP%\B504.tmp
- %TEMP%\B0ED.tmp
- %TEMP%\B2F1.tmp
- %TEMP%\944D.tmp
- %TEMP%\9650.tmp
- %TEMP%\923A.tmp
- %TEMP%\8E23.tmp
- %TEMP%\9026.tmp
- %TEMP%\9864.tmp
- %TEMP%\A0B1.tmp
- %TEMP%\A2B4.tmp
- %TEMP%\9E8E.tmp
- %TEMP%\9A67.tmp
- %TEMP%\9C8A.tmp
- %TEMP%\BB3E.tmp
- %TEMP%\DBD5.tmp
- %TEMP%\DDE9.tmp
- %TEMP%\D9A3.tmp
- %TEMP%\D58C.tmp
- %TEMP%\D79F.tmp
- %TEMP%\E22E.tmp
- %TEMP%\ECAE.tmp
- %TEMP%\EED1.tmp
- %TEMP%\EA3D.tmp
- %TEMP%\E451.tmp
- %TEMP%\E664.tmp
- %TEMP%\C37B.tmp
- %TEMP%\C58E.tmp
- %TEMP%\C168.tmp
- %TEMP%\BD51.tmp
- %TEMP%\BF54.tmp
- %TEMP%\C7A1.tmp
- %TEMP%\D146.tmp
- %TEMP%\D379.tmp
- %TEMP%\CE39.tmp
- %TEMP%\C9C4.tmp
- %TEMP%\CBC8.tmp
- %TEMP%\8C0F.tmp
- %TEMP%\4DCE.tmp
- %TEMP%\4FC2.tmp
- %TEMP%\4BCA.tmp
- %TEMP%\4850.tmp
- %TEMP%\4A15.tmp
- %TEMP%\51C6.tmp
- %TEMP%\59D4.tmp
- %TEMP%\5BD8.tmp
- %TEMP%\57D0.tmp
- %TEMP%\53BA.tmp
- %TEMP%\55BD.tmp
- %TEMP%\3A46.tmp
- %TEMP%\3C0B.tmp
- %TEMP%\3881.tmp
- %TEMP%\34F7.tmp
- %TEMP%\36BC.tmp
- %TEMP%\3DE0.tmp
- %TEMP%\44D5.tmp
- %TEMP%\468B.tmp
- %TEMP%\4310.tmp
- %TEMP%\3FA5.tmp
- %TEMP%\415A.tmp
- %TEMP%\5DDB.tmp
- %TEMP%\7BF2.tmp
- %TEMP%\7DF6.tmp
- %TEMP%\79EF.tmp
- %TEMP%\75D8.tmp
- %TEMP%\77EB.tmp
- %TEMP%\8009.tmp
- %TEMP%\8818.tmp
- %TEMP%\89FC.tmp
- %TEMP%\8614.tmp
- %TEMP%\81FD.tmp
- %TEMP%\8411.tmp
- %TEMP%\65CB.tmp
- %TEMP%\67CE.tmp
- %TEMP%\63C7.tmp
- %TEMP%\5FCF.tmp
- %TEMP%\61D3.tmp
- %TEMP%\69D2.tmp
- %TEMP%\71C1.tmp
- %TEMP%\73E4.tmp
- %TEMP%\6FCD.tmp
- %TEMP%\6BD5.tmp
- %TEMP%\6DC9.tmp
- %TEMP%\9377.tmp
- %TEMP%\CF9A.tmp
- %TEMP%\D121.tmp
- %TEMP%\CE14.tmp
- %TEMP%\CB06.tmp
- %TEMP%\CC7D.tmp
- %TEMP%\D2A7.tmp
- %TEMP%\D8D2.tmp
- %TEMP%\DA58.tmp
- %TEMP%\D74B.tmp
- %TEMP%\D42E.tmp
- %TEMP%\D5B5.tmp
- %TEMP%\A8F8.tmp
- %TEMP%\ADAB.tmp
- %TEMP%\A435.tmp
- %TEMP%\9ADE.tmp
- %TEMP%\9F91.tmp
- %TEMP%\B28D.tmp
- %TEMP%\C559.tmp
- %TEMP%\C980.tmp
- %TEMP%\C0A6.tmp
- %TEMP%\B740.tmp
- %TEMP%\BBF3.tmp
- %TEMP%\DBDF.tmp
- %TEMP%\F301.tmp
- %TEMP%\F497.tmp
- %TEMP%\F17A.tmp
- %TEMP%\EE5D.tmp
- %TEMP%\EFE4.tmp
- %TEMP%\F61E.tmp
- %TEMP%\FC57.tmp
- %TEMP%\FDDE.tmp
- %TEMP%\FAD1.tmp
- %TEMP%\F7A4.tmp
- %TEMP%\F93A.tmp
- %TEMP%\E1F9.tmp
- %TEMP%\E390.tmp
- %TEMP%\E073.tmp
- %TEMP%\DD65.tmp
- %TEMP%\DEEC.tmp
- %TEMP%\E516.tmp
- %TEMP%\EB40.tmp
- %TEMP%\ECC7.tmp
- %TEMP%\E9BA.tmp
- %TEMP%\E69D.tmp
- %TEMP%\E823.tmp
- %TEMP%\961B.tmp
- %TEMP%\44B.tmp
- %TEMP%\8EF.tmp
- %TEMP%\FFB7.tmp
- %TEMP%\F651.tmp
- %TEMP%\FAF5.tmp
- %TEMP%\DA2.tmp
- %TEMP%\204F.tmp
- %TEMP%\2502.tmp
- %TEMP%\1BAC.tmp
- %TEMP%\1255.tmp
- %TEMP%\16F9.tmp
- %TEMP%\CACD.tmp
- %TEMP%\D193.tmp
- %TEMP%\C5CB.tmp
- %TEMP%\A562.tmp
- %TEMP%\BE49.tmp
- %TEMP%\D740.tmp
- %TEMP%\ECEB.tmp
- %TEMP%\F18E.tmp
- %TEMP%\E828.tmp
- %TEMP%\DD6A.tmp
- %TEMP%\E2F8.tmp
- %TEMP%\29C5.tmp
- %TEMP%\6FF6.tmp
- %TEMP%\74A9.tmp
- %TEMP%\6B52.tmp
- %TEMP%\61EC.tmp
- %TEMP%\669F.tmp
- %TEMP%\795C.tmp
- %TEMP%\8CB5.tmp
- %TEMP%\9178.tmp
- %TEMP%\8766.tmp
- %TEMP%\7E0F.tmp
- %TEMP%\82C2.tmp
- %TEMP%\3C92.tmp
- %TEMP%\4145.tmp
- %TEMP%\37CF.tmp
- %TEMP%\2E69.tmp
- %TEMP%\331C.tmp
- %TEMP%\45F8.tmp
- %TEMP%\58A5.tmp
- %TEMP%\5D49.tmp
- %TEMP%\53F2.tmp
- %TEMP%\4A9B.tmp
- %TEMP%\4F3F.tmp
- %TEMP%\FF74.tmp
- %TEMP%\6090.tmp
- %TEMP%\6235.tmp
- %TEMP%\5EEA.tmp
- %TEMP%\5BAE.tmp
- %TEMP%\5D53.tmp
- %TEMP%\63CC.tmp
- %TEMP%\6A73.tmp
- %TEMP%\6C09.tmp
- %TEMP%\68BD.tmp
- %TEMP%\6572.tmp
- %TEMP%\6727.tmp
- %TEMP%\4EBD.tmp
- %TEMP%\5053.tmp
- %TEMP%\4D27.tmp
- %TEMP%\49FA.tmp
- %TEMP%\4B91.tmp
- %TEMP%\51F9.tmp
- %TEMP%\5862.tmp
- %TEMP%\5A08.tmp
- %TEMP%\56CC.tmp
- %TEMP%\538F.tmp
- %TEMP%\5535.tmp
- %TEMP%\6D9F.tmp
- %TEMP%\8638.tmp
- %TEMP%\87DE.tmp
- %TEMP%\8492.tmp
- %TEMP%\8147.tmp
- %TEMP%\82FC.tmp
- %TEMP%\8974.tmp
- %TEMP%\900C.tmp
- %TEMP%\91E1.tmp
- %TEMP%\8E66.tmp
- %TEMP%\8B2A.tmp
- %TEMP%\8CC0.tmp
- %TEMP%\7427.tmp
- %TEMP%\75BD.tmp
- %TEMP%\7281.tmp
- %TEMP%\6F45.tmp
- %TEMP%\70DB.tmp
- %TEMP%\7763.tmp
- %TEMP%\7E0A.tmp
- %TEMP%\7FB0.tmp
- %TEMP%\7C45.tmp
- %TEMP%\78FA.tmp
- %TEMP%\7A9F.tmp
- %TEMP%\4854.tmp
- %TEMP%\16F4.tmp
- %TEMP%\188A.tmp
- %TEMP%\155E.tmp
- %TEMP%\1241.tmp
- %TEMP%\13D7.tmp
- %TEMP%\1A20.tmp
- %TEMP%\206A.tmp
- %TEMP%\21F0.tmp
- %TEMP%\1ED3.tmp
- %TEMP%\1BB7.tmp
- %TEMP%\1D3D.tmp
- %TEMP%\5BE.tmp
- %TEMP%\744.tmp
- %TEMP%\427.tmp
- %TEMP%\10A.tmp
- %TEMP%\291.tmp
- %TEMP%\8DA.tmp
- %TEMP%\F14.tmp
- %TEMP%\10AA.tmp
- %TEMP%\D8E.tmp
- %TEMP%\A71.tmp
- %TEMP%\BF7.tmp
- %TEMP%\2396.tmp
- %TEMP%\3B64.tmp
- %TEMP%\3D0A.tmp
- %TEMP%\39CE.tmp
- %TEMP%\36A1.tmp
- %TEMP%\3837.tmp
- %TEMP%\3EA0.tmp
- %TEMP%\44F9.tmp
- %TEMP%\46BE.tmp
- %TEMP%\4372.tmp
- %TEMP%\4036.tmp
- %TEMP%\41CD.tmp
- %TEMP%\29EF.tmp
- %TEMP%\2B85.tmp
- %TEMP%\2859.tmp
- %TEMP%\251D.tmp
- %TEMP%\26B3.tmp
- %TEMP%\2D1C.tmp
- %TEMP%\3375.tmp
- %TEMP%\350B.tmp
- %TEMP%\31DE.tmp
- %TEMP%\2EB2.tmp
- %TEMP%\3048.tmp
Сетевая активность:
Подключается к:
- 'b0###fd1515.com':80
- 'b0###531c4.com':80
- 'localhost':1035
TCP:
Запросы HTTP GET:
- b0###fd1515.com/bt.php?mo################################################
- b0###531c4.com/bt.php?mo################################################
UDP:
- DNS ASK b0###fd1515.com
- DNS ASK b0###531c4.com
