Техническая информация
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[17].php
- %TEMP%\~!#40.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[16].php
- %TEMP%\~!#42.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[17].php
- %TEMP%\~!#41.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[16].php
- %TEMP%\~!#3D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[16].php
- %TEMP%\~!#3F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[16].php
- %TEMP%\~!#3E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[18].php
- %TEMP%\~!#46.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[18].php
- %TEMP%\~!#48.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[18].php
- %TEMP%\~!#47.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[17].php
- %TEMP%\~!#43.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[17].php
- %TEMP%\~!#45.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[18].php
- %TEMP%\~!#44.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[14].php
- %TEMP%\~!#34.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[13].php
- %TEMP%\~!#36.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[14].php
- %TEMP%\~!#35.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[13].php
- %TEMP%\~!#31.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[13].php
- %TEMP%\~!#33.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[13].php
- %TEMP%\~!#32.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[15].php
- %TEMP%\~!#3A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[15].php
- %TEMP%\~!#3C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[15].php
- %TEMP%\~!#3B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[14].php
- %TEMP%\~!#37.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[14].php
- %TEMP%\~!#39.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[15].php
- %TEMP%\~!#38.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[23].php
- %TEMP%\~!#58.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[22].php
- %TEMP%\~!#5A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[23].php
- %TEMP%\~!#59.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[22].php
- %TEMP%\~!#55.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[22].php
- %TEMP%\~!#57.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[22].php
- %TEMP%\~!#56.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[24].php
- %TEMP%\~!#5E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[24].php
- %TEMP%\~!#60.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[24].php
- %TEMP%\~!#5F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[23].php
- %TEMP%\~!#5B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[23].php
- %TEMP%\~!#5D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[24].php
- %TEMP%\~!#5C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[20].php
- %TEMP%\~!#4C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[19].php
- %TEMP%\~!#4E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[20].php
- %TEMP%\~!#4D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[19].php
- %TEMP%\~!#49.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[19].php
- %TEMP%\~!#4B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[19].php
- %TEMP%\~!#4A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[21].php
- %TEMP%\~!#52.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[21].php
- %TEMP%\~!#54.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[21].php
- %TEMP%\~!#53.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[20].php
- %TEMP%\~!#4F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[20].php
- %TEMP%\~!#51.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[21].php
- %TEMP%\~!#50.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[5].php
- %TEMP%\~!#10.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[4].php
- %TEMP%\~!#12.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[5].php
- %TEMP%\~!#11.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[4].php
- %TEMP%\~!#D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[4].php
- %TEMP%\~!#F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[4].php
- %TEMP%\~!#E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[6].php
- %TEMP%\~!#16.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[6].php
- %TEMP%\~!#18.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[6].php
- %TEMP%\~!#17.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[5].php
- %TEMP%\~!#13.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[5].php
- %TEMP%\~!#15.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[6].php
- %TEMP%\~!#14.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[2].php
- %TEMP%\~!#4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[1].php
- %TEMP%\~!#6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[2].php
- %TEMP%\~!#5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[1].php
- %TEMP%\~!#1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[1].php
- %TEMP%\~!#3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[1].php
- %TEMP%\~!#2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[3].php
- %TEMP%\~!#A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[3].php
- %TEMP%\~!#C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[3].php
- %TEMP%\~!#B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[2].php
- %TEMP%\~!#7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[2].php
- %TEMP%\~!#9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[3].php
- %TEMP%\~!#8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[11].php
- %TEMP%\~!#28.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[10].php
- %TEMP%\~!#2A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[11].php
- %TEMP%\~!#29.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[10].php
- %TEMP%\~!#25.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[10].php
- %TEMP%\~!#27.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[10].php
- %TEMP%\~!#26.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[12].php
- %TEMP%\~!#2E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[12].php
- %TEMP%\~!#30.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[12].php
- %TEMP%\~!#2F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[11].php
- %TEMP%\~!#2B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[11].php
- %TEMP%\~!#2D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[12].php
- %TEMP%\~!#2C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[8].php
- %TEMP%\~!#1C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[7].php
- %TEMP%\~!#1E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[8].php
- %TEMP%\~!#1D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[7].php
- %TEMP%\~!#19.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[7].php
- %TEMP%\~!#1B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[7].php
- %TEMP%\~!#1A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[9].php
- %TEMP%\~!#22.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\viewtopic[9].php
- %TEMP%\~!#24.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[9].php
- %TEMP%\~!#23.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\viewtopic[8].php
- %TEMP%\~!#1F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\viewtopic[8].php
- %TEMP%\~!#21.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\viewtopic[9].php
- %TEMP%\~!#20.tmp
Сетевая активность:
Подключается к:
- 'aj#####omputing.osa.pl':80
TCP:
Запросы HTTP GET:
- aj#####omputing.osa.pl/forum/viewtopic.php?f=#############################################
- aj#####omputing.osa.pl/forum/viewtopic.php?f=############################################
UDP:
- DNS ASK aj#####omputing.osa.pl
