Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\upgrade.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\499d.tmp\499e.tmp\499f.bat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022101820221019\index.dat
Удаляет следующие файлы
- %TEMP%\499d.tmp\499e.tmp\499f.bat
Изменяет следующие файлы
Сетевая активность
Подключается к
- 'xv##eos.com':443
- 'xv##eos.com':80
- 'st######3.xvideos-cdn.com':80
- 'oc##.#ectigo.com':80
- 'im####.xvideos-cdn.com':80
TCP
Запросы HTTP GET
- http://st######3.xvideos-cdn.com/v-979545dc2e5/v3/css/default/main1.css
- http://im####.xvideos-cdn.com/videos/thumbs169ll/ef/8a/6a/ef8a6abc32cf73a9f08f20a835027669/ef8a6abc32cf73a9f08f20a835027669.14.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/30/42/79/304279962a5941a6437e8002742e492f/304279962a5941a6437e8002742e492f.26.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/01/7a/77/017a770c333f78bfbf9d75343bfa84b3/017a770c333f78bfbf9d75343bfa84b3.25.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/e4/d7/27/e4d727093aa5408f42efc9fc69a239f7/e4d727093aa5408f42efc9fc69a239f7.28.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/7c/06/37/7c06372e230470690127f0c50ec78184/7c06372e230470690127f0c50ec78184.9.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/68/b0/1e/68b01e7bfd996343dd3c4e273054f397/68b01e7bfd996343dd3c4e273054f397.20.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/6b/6a/1a/6b6a1a3eb134201bc0a7d06e18315074-1/6b6a1a3eb134201bc0a7d06e18315074.21.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/8b/9c/c4/8b9cc4f67c322c00207e881dd9a130a7-1/8b9cc4f67c322c00207e881dd9a130a7.4.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/f6/54/4a/f6544a7721459a629695a388fae80f29/f6544a7721459a629695a388fae80f29.26.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/34/df/96/34df9639d17d8d6a82c7b2a1c14196bf/34df9639d17d8d6a82c7b2a1c14196bf.13.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/fc/a2/e9/fca2e938743cd777b277958feda2181b/fca2e938743cd777b277958feda2181b.11.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/b3/2b/40/b32b4052302ce8b40661c07f8c60abb7/b32b4052302ce8b40661c07f8c60abb7.30.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/59/89/5d/59895d16f410360b649fd493c14b2232/59895d16f410360b649fd493c14b2232.23.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/fd/66/00/fd6600dbdf18f7f361fccfc2254e405e-2/fd6600dbdf18f7f361fccfc2254e405e.19.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/bf/8a/6d/bf8a6d9559a48a66c800d5d45180d590/bf8a6d9559a48a66c800d5d45180d590.9.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/da/68/37/da6837917cf099036ff63f690a471336/da6837917cf099036ff63f690a471336.15.jpg
- http://im####.xvideos-cdn.com/videos_new/thumbs169ll/a7/fd/fc/a7fdfcf039fb38ecf162d9f22c60dd4f-1/a7fdfcf039fb38ecf162d9f22c60dd4f.7.jpg
- http://st######3.xvideos-cdn.com/v-6bdd0cf08bd/v3/js/skins/min/default.footer.static.js
- http://st######3.xvideos-cdn.com/v3/js/libs/jquery.min.js
- http://im####.xvideos-cdn.com/videos/thumbs169ll/ed/43/a3/ed43a39ac3e12849b832bc5e9c24f1d9-1/ed43a39ac3e12849b832bc5e9c24f1d9.2.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/10/eb/ea/10ebea9f1d9e02064c6b0345ed12bd54/10ebea9f1d9e02064c6b0345ed12bd54.28.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/eb/f4/99/ebf499e8f5b7b323362f5c95f2349a4f/ebf499e8f5b7b323362f5c95f2349a4f.21.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/3a/c2/87/3ac2875aa058e819783eb9bc1483e9bb/3ac2875aa058e819783eb9bc1483e9bb.6.jpg
- http://st######3.xvideos-cdn.com/v3/js/skins/min/require.static.js
- http://im####.xvideos-cdn.com/videos/thumbs169ll/a3/f0/e9/a3f0e9be573202b6ae0d6a1216528b24/a3f0e9be573202b6ae0d6a1216528b24.27.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/b9/10/fb/b910fb375f6f3f457998ee36c68a4da9/b910fb375f6f3f457998ee36c68a4da9.3.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/09/ac/1b/09ac1b494c44f5a756f6d53e377fd861/09ac1b494c44f5a756f6d53e377fd861.20.jpg
- http://www.xv##eos.com/
- http://im####.xvideos-cdn.com/videos/thumbs169ll/a7/b8/82/a7b882bcb7f48b7e8224097011687896/a7b882bcb7f48b7e8224097011687896.3.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/8f/2d/3a/8f2d3aae1f560b0212890766be972ab3/8f2d3aae1f560b0212890766be972ab3.11.jpg
- http://im####.xvideos-cdn.com/videos_new/thumbs169ll/1d/e5/39/1de539e3cf50deb4cb3e0b4fa9ca91ad/1de539e3cf50deb4cb3e0b4fa9ca91ad.25.jpg
- http://im####.xvideos-cdn.com/videos_new/thumbs169ll/57/44/6f/57446fd859de2b8aa1032126c8d0a811/57446fd859de2b8aa1032126c8d0a811.1.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/8a/50/9b/8a509b0e85b5f22c69f7506b71e70fce/8a509b0e85b5f22c69f7506b71e70fce.14.jpg
- http://st######3.xvideos-cdn.com/v-979545dc2e5/v3/css/default/main2.css
- http://st######3.xvideos-cdn.com/v-979545dc2e5/v3/css/default/main3.css
- http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEBDl6DuyM9tW1qvCEWDq0Ng%3D
- http://st######3.xvideos-cdn.com/v-104c6e3bef4/v3/js/skins/min/default.header.static.js
- http://st######3.xvideos-cdn.com/v-02208190935/v3/fonts/skins/common/iconfont/iconfont.woff2?u6##################################################################################################...
- http://st######3.xvideos-cdn.com/v-730d8e4d2ee/v3/js/i18n/front/english.js
- http://www.xv##eos.com/function(e,t)%7Bfor(var%20i=t%7C%7C0,n=this.length;i%3Cn;i++)if(this[i]===e)return%20i;return-1%7D
- http://st######3.xvideos-cdn.com/v3/img/skins/default/xvideos.com.png
- http://st######3.xvideos-cdn.com/v-979545dc2e5/v3/img/flags/flat/flags-16.png
- http://st######3.xvideos-cdn.com/img/lightbox/lightbox-blank.gif
- http://im####.xvideos-cdn.com/videos/thumbs169ll/d6/87/4a/d6874a5618e7bcb4e89e246334599552/d6874a5618e7bcb4e89e246334599552.7.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/8e/cf/70/8ecf701124dda8a1e8d333804253ec49/8ecf701124dda8a1e8d333804253ec49.11.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/73/b6/86/73b6868718b7b8cbf1fd4783a4e4a779/73b6868718b7b8cbf1fd4783a4e4a779.9.jpg
- http://www.xv##eos.com/favicon.ico
- http://im####.xvideos-cdn.com/videos/thumbs169ll/0f/26/0a/0f260a36daba760d65d5374af77fb369/0f260a36daba760d65d5374af77fb369.8.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/7b/8e/34/7b8e343d32af3e4bd5dff01e04cb73f8/7b8e343d32af3e4bd5dff01e04cb73f8.11.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/e2/00/6a/e2006a16360457576884b2a82ae5a934/e2006a16360457576884b2a82ae5a934.30.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/09/7c/6c/097c6c174faae6ba15c1a88f78d24e8e/097c6c174faae6ba15c1a88f78d24e8e.1.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/9a/ee/ec/9aeeeca07eabd9d52b489fa350418f27/9aeeeca07eabd9d52b489fa350418f27.30.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/51/d5/ee/51d5ee6e0a8dcc545f4d5bf5724537d5/51d5ee6e0a8dcc545f4d5bf5724537d5.19.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/82/96/7f/82967f0cb1dc1eb65d6e0d5fcc341ed2/82967f0cb1dc1eb65d6e0d5fcc341ed2.8.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/74/79/73/74797320fceb8cc8710341531eb32eb3-1/74797320fceb8cc8710341531eb32eb3.30.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/99/be/e7/99bee74369e83d926bbf0bd9a6862eb8-1/99bee74369e83d926bbf0bd9a6862eb8.7.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/28/15/5b/28155b221332b0522ad9d044b4175060/28155b221332b0522ad9d044b4175060.15.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/03/e4/9c/03e49cae313896942a768b034b1198c8/03e49cae313896942a768b034b1198c8.20.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/ad/8e/c9/ad8ec92193bfa97e662efbdf8cd7d6f3/ad8ec92193bfa97e662efbdf8cd7d6f3.11.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/a7/c2/75/a7c275d2f4917db3f7e04d24af708a79/a7c275d2f4917db3f7e04d24af708a79.26.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/ce/48/25/ce4825ea4f35b84c840c6a7bd1845994/ce4825ea4f35b84c840c6a7bd1845994.1.jpg
- http://im####.xvideos-cdn.com/videos/thumbs169ll/7d/51/67/7d5167e1f47f4bb5c51d4164533a9dc5/7d5167e1f47f4bb5c51d4164533a9dc5.10.jpg
- http://st######3.xvideos-cdn.com/v-979545dc2e5/v3/css/default/main4.css
- http://im####.xvideos-cdn.com/videos/thumbs169ll/01/c8/a0/01c8a040b7a5a0615e318d934a6252be/01c8a040b7a5a0615e318d934a6252be.21.jpg
- http://st######3.xvideos-cdn.com/v-99f258edee5/v3/js/skins/min/default.js
Другие
- 'xv##eos.com':443
UDP
- DNS ASK xv##eos.com
- DNS ASK microsoft.com
- DNS ASK st######3.xvideos-cdn.com
- DNS ASK oc##.#ectigo.com
- DNS ASK im####.xvideos-cdn.com
Другое
Ищет следующие окна
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Создает и запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\499D.tmp\499E.tmp\499F.bat <Полный путь к файлу>"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\499D.tmp\499E.tmp\499F.bat <Полный путь к файлу>"
