Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\config14[1].txt
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar741b.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab73fb.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar732f.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab732e.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar6f95.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab6f84.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar6ec8.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab6ec7.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar6b2e.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab6b2d.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab76ea.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar6571.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar6273.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab6272.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar611a.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab6119.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar5d9f.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab5d8e.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar5cb3.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab5cb2.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar5995.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab5994.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab6570.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar76eb.tmp
Удаляет следующие файлы
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab5994.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar741b.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab73fb.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar732f.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab732e.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar6f95.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab6f84.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar6ec8.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab6ec7.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar6b2e.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab6b2d.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar6571.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab6570.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar6273.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab6272.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar611a.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab6119.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar5d9f.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab5d8e.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar5cb3.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab5cb2.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar5995.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\cab76ea.tmp
- %WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\tar76eb.tmp
Сетевая активность
Подключается к
- 'wx.ax':80
- 'wx.ax':443
- '17#.#34.216.245':80
TCP
Запросы HTTP GET
- http://wx.ax/Xm6
- http://17#.#34.216.245/44/bcc/simplethingsmakeverygoodthingsaroundtheworldtogetmebacksweetthingstoberarethinendsheisverysweetgirl___________ireallylovegirlmetobegirl.doc
Другие
- 'wx.ax':443
UDP
- DNS ASK wx.ax
Другое
Запускает на исполнение
- '%ProgramFiles%\microsoft office\office14\winword.exe' -Embedding
