Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%HOMEPATH%\qixqt\kulc.exe' 5229160.GGJ
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /IM mshta.exe
- '<SYSTEM32>\mshta.exe'
- '<SYSTEM32>\wscript.exe' "%HOMEPATH%\qixqt\4596853.vbs"
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\qixqt\83375.rpz
- %HOMEPATH%\qixqt\42594.jlb
- %HOMEPATH%\qixqt\53013.gxs
- %HOMEPATH%\qixqt\28113.vzm
- %HOMEPATH%\qixqt\84248.flm
- %HOMEPATH%\qixqt\67721.fig
- %HOMEPATH%\qixqt\7981.rjr
- %HOMEPATH%\qixqt\41300.bia
- %HOMEPATH%\qixqt\74415.dew
- %HOMEPATH%\qixqt\72493.vyt
- %HOMEPATH%\qixqt\49498.bfu
- %HOMEPATH%\qixqt\7631.jgu
- %HOMEPATH%\qixqt\6155.dhg
- %HOMEPATH%\qixqt\52356.qvh
- %HOMEPATH%\qixqt\82972.nre
- %HOMEPATH%\qixqt\10627.sfx
- %HOMEPATH%\qixqt\58263.xei
- %HOMEPATH%\qixqt\70290.hzw
- %HOMEPATH%\qixqt\20088.wwq
- %HOMEPATH%\qixqt\96954.jir
- %HOMEPATH%\qixqt\26035.ubp
- %HOMEPATH%\qixqt\88279.psn
- %HOMEPATH%\qixqt\28528.rft
- %HOMEPATH%\qixqt\16117.whr
- %HOMEPATH%\qixqt\89812.uyl
- %HOMEPATH%\qixqt\71902.etv
- %HOMEPATH%\qixqt\87881.zwt
- %HOMEPATH%\qixqt\30710.bpt
- %HOMEPATH%\qixqt\53629.ncw
- %HOMEPATH%\qixqt\58315.vrq
- %HOMEPATH%\qixqt\27352.bku
- %HOMEPATH%\qixqt\6989.qnn
- %HOMEPATH%\qixqt\57820.hnf
- %HOMEPATH%\qixqt\93274.wlv
- %HOMEPATH%\qixqt\50926.zse
- %HOMEPATH%\qixqt\60483.ext
- %HOMEPATH%\qixqt\81133.bth
- %HOMEPATH%\qixqt\65707.chl
- %HOMEPATH%\qixqt\43159.yio
- %HOMEPATH%\qixqt\86703.mdy
- %HOMEPATH%\qixqt\95662.csw
- %HOMEPATH%\qixqt\11910.gxd
- %HOMEPATH%\qixqt\89377.baj
- %HOMEPATH%\qixqt\93755.dqp
- %HOMEPATH%\qixqt\53120.qmo
- %HOMEPATH%\qixqt\46579.lls
- %HOMEPATH%\qixqt\12579.kog
- %HOMEPATH%\qixqt\36129.uuj
- %HOMEPATH%\qixqt\10818.pgl
- %HOMEPATH%\qixqt\98221.swg
- %HOMEPATH%\qixqt\71759.clb
- %HOMEPATH%\qixqt\53928.fme
- %HOMEPATH%\qixqt\14280.jdk
- %HOMEPATH%\qixqt\29578.wlv
- %HOMEPATH%\qixqt\39476.jid
- %HOMEPATH%\qixqt\31593.jpk
- %HOMEPATH%\qixqt\34543.idz
- %HOMEPATH%\qixqt\53322.zbj
- %HOMEPATH%\qixqt\16632.gmv
- %HOMEPATH%\qixqt\95264.mmf
- %HOMEPATH%\qixqt\18136.mjh
- %HOMEPATH%\qixqt\84798.mte
- %HOMEPATH%\qixqt\20227.trl
- %HOMEPATH%\qixqt\62011.njz
- %HOMEPATH%\qixqt\86585.bqc
- %HOMEPATH%\qixqt\51755.fao
- %HOMEPATH%\qixqt\16905.jsz
- %HOMEPATH%\qixqt\22501.gfr
- %HOMEPATH%\qixqt\72325.gmi
- %HOMEPATH%\qixqt\45432.utg
- %HOMEPATH%\qixqt\42313.aaq
- %HOMEPATH%\qixqt\68423.kvg
- %HOMEPATH%\qixqt\81548.kyz
- %HOMEPATH%\qixqt\89767.nea
- %HOMEPATH%\qixqt\89622.qst
- %HOMEPATH%\qixqt\2907.mjj
- %HOMEPATH%\qixqt\5813.pvj
- %HOMEPATH%\qixqt\41556.nqc
- %HOMEPATH%\qixqt\64566.rxn
- %HOMEPATH%\qixqt\78853.wiw
- %HOMEPATH%\qixqt\10608.rph
- %HOMEPATH%\qixqt\97929.ibm
- %HOMEPATH%\qixqt\29132.eiy
- %HOMEPATH%\qixqt\99864.jyb
- %HOMEPATH%\qixqt\12485.xdz
- %HOMEPATH%\qixqt\19599.rvy
- %HOMEPATH%\qixqt\93826.gvv
- %HOMEPATH%\qixqt\8210.rrv
- %HOMEPATH%\qixqt\99985.crk
- %HOMEPATH%\qixqt\38521.tys
- %HOMEPATH%\qixqt\57759.xaa
- %HOMEPATH%\qixqt\87539.aha
- %HOMEPATH%\qixqt\51123.zqv
- %HOMEPATH%\qixqt\71773.fqh
- %HOMEPATH%\qixqt\60118.skt
- %HOMEPATH%\qixqt\89695.esb
- %HOMEPATH%\qixqt\14023.sbp
- %HOMEPATH%\qixqt\46460.mpp
- %HOMEPATH%\qixqt\6021.pvo
- %HOMEPATH%\qixqt\52830.aof
- %HOMEPATH%\qixqt\56521.tcw
- %HOMEPATH%\qixqt\60206.jcq
- %HOMEPATH%\qixqt\33638.vhn
- %HOMEPATH%\qixqt\83081.xia
- %HOMEPATH%\qixqt\73777.sko
- %HOMEPATH%\qixqt\22824.zcd
- %HOMEPATH%\qixqt\87625.taj
- %HOMEPATH%\qixqt\54310.kqa
- %HOMEPATH%\qixqt\23610.mmk
- %HOMEPATH%\qixqt\62214.dny
- %HOMEPATH%\qixqt\95109.lnm
- %HOMEPATH%\qixqt\75046.ykb
- %HOMEPATH%\qixqt\58712.hfg
- %HOMEPATH%\qixqt\63396.qts
- %HOMEPATH%\qixqt\35775.wjt
- %HOMEPATH%\qixqt\kulc.exe
- %HOMEPATH%\qixqt\65835.DAF
- %HOMEPATH%\qixqt\4596853.vbs
- %HOMEPATH%\qixqt\20653.TBC
- %HOMEPATH%\qixqt\5229160.GGJ
- %HOMEPATH%\qixqt\14466.kyz
- %HOMEPATH%\qixqt\61551.hre
- %HOMEPATH%\qixqt\66996.cvy
- %HOMEPATH%\qixqt\16565.tuy
- %HOMEPATH%\qixqt\5353.eli
- %HOMEPATH%\qixqt\12658.nji
- %HOMEPATH%\qixqt\81706.pmq
- %HOMEPATH%\qixqt\14426.oky
- %HOMEPATH%\qixqt\47931.itt
- %HOMEPATH%\qixqt\95899.ipm
- %HOMEPATH%\qixqt\3528.ixx
- %HOMEPATH%\qixqt\60015.ugg
- %HOMEPATH%\qixqt\48858.tjj
- %HOMEPATH%\qixqt\99032.twj
- %HOMEPATH%\qixqt\88165.xov
- %HOMEPATH%\qixqt\37208.yyz
- %HOMEPATH%\qixqt\61664.rdz
- %HOMEPATH%\qixqt\89531.uqz
- %HOMEPATH%\qixqt\39043.wiv
- %HOMEPATH%\qixqt\88457.wte
- %HOMEPATH%\qixqt\67478.vbn
- %HOMEPATH%\qixqt\58450.iof
- %HOMEPATH%\qixqt\88994.waa
- %HOMEPATH%\qixqt\75940.yuc
- %HOMEPATH%\qixqt\80488.thn
- %HOMEPATH%\qixqt\64546.ztn
- %HOMEPATH%\qixqt\68353.vrs
- %HOMEPATH%\qixqt\79353.ety
- %HOMEPATH%\qixqt\68982.dwu
- %HOMEPATH%\qixqt\75829.ulo
- %HOMEPATH%\qixqt\54853.mhf
- %HOMEPATH%\qixqt\78300.urj
- %HOMEPATH%\qixqt\77338.die
- %HOMEPATH%\qixqt\21304.xxr
- %HOMEPATH%\qixqt\52639.saw
- %HOMEPATH%\qixqt\3684.jdy
- %HOMEPATH%\qixqt\92964.xfh
- %HOMEPATH%\qixqt\11514.lej
- %HOMEPATH%\qixqt\60028.suu
- %HOMEPATH%\qixqt\94798.mcx
- %HOMEPATH%\qixqt\95955.pyz
- %HOMEPATH%\qixqt\74858.eqx
- %HOMEPATH%\qixqt\26852.ous
- %HOMEPATH%\qixqt\90870.fjs
- %HOMEPATH%\qixqt\39961.pvp
- %HOMEPATH%\qixqt\65812.pfv
- %HOMEPATH%\qixqt\34996.fel
- %HOMEPATH%\qixqt\82457.wpk
- %HOMEPATH%\qixqt\85829.rnn
- %HOMEPATH%\qixqt\52356.eks
- %HOMEPATH%\qixqt\59589.omx
- %HOMEPATH%\qixqt\73230.qkp
- %HOMEPATH%\qixqt\2153.whx
- %HOMEPATH%\qixqt\93265.gom
- %HOMEPATH%\qixqt\31035.dzp
Присваивает атрибут 'скрытый' для следующих файлов:
- %HOMEPATH%\qixqt\83375.rpz
- %HOMEPATH%\qixqt\42594.jlb
- %HOMEPATH%\qixqt\53013.gxs
- %HOMEPATH%\qixqt\28113.vzm
- %HOMEPATH%\qixqt\84248.flm
- %HOMEPATH%\qixqt\67721.fig
- %HOMEPATH%\qixqt\7981.rjr
- %HOMEPATH%\qixqt\41300.bia
- %HOMEPATH%\qixqt\74415.dew
- %HOMEPATH%\qixqt\72493.vyt
- %HOMEPATH%\qixqt\49498.bfu
- %HOMEPATH%\qixqt\7631.jgu
- %HOMEPATH%\qixqt\6155.dhg
- %HOMEPATH%\qixqt\52356.qvh
- %HOMEPATH%\qixqt\82972.nre
- %HOMEPATH%\qixqt\10627.sfx
- %HOMEPATH%\qixqt\58263.xei
- %HOMEPATH%\qixqt\70290.hzw
- %HOMEPATH%\qixqt\20088.wwq
- %HOMEPATH%\qixqt\96954.jir
- %HOMEPATH%\qixqt\26035.ubp
- %HOMEPATH%\qixqt\88279.psn
- %HOMEPATH%\qixqt\28528.rft
- %HOMEPATH%\qixqt\16117.whr
- %HOMEPATH%\qixqt\89812.uyl
- %HOMEPATH%\qixqt\71902.etv
- %HOMEPATH%\qixqt\87881.zwt
- %HOMEPATH%\qixqt\30710.bpt
- %HOMEPATH%\qixqt\53629.ncw
- %HOMEPATH%\qixqt\58315.vrq
- %HOMEPATH%\qixqt\27352.bku
- %HOMEPATH%\qixqt\6989.qnn
- %HOMEPATH%\qixqt\57820.hnf
- %HOMEPATH%\qixqt\93274.wlv
- %HOMEPATH%\qixqt\50926.zse
- %HOMEPATH%\qixqt\60483.ext
- %HOMEPATH%\qixqt\81133.bth
- %HOMEPATH%\qixqt\65707.chl
- %HOMEPATH%\qixqt\43159.yio
- %HOMEPATH%\qixqt\86703.mdy
- %HOMEPATH%\qixqt\95662.csw
- %HOMEPATH%\qixqt\11910.gxd
- %HOMEPATH%\qixqt\89377.baj
- %HOMEPATH%\qixqt\93755.dqp
- %HOMEPATH%\qixqt\53120.qmo
- %HOMEPATH%\qixqt\46579.lls
- %HOMEPATH%\qixqt\12579.kog
- %HOMEPATH%\qixqt\36129.uuj
- %HOMEPATH%\qixqt\10818.pgl
- %HOMEPATH%\qixqt\98221.swg
- %HOMEPATH%\qixqt\71759.clb
- %HOMEPATH%\qixqt\53928.fme
- %HOMEPATH%\qixqt\14280.jdk
- %HOMEPATH%\qixqt\29578.wlv
- %HOMEPATH%\qixqt\39476.jid
- %HOMEPATH%\qixqt\31593.jpk
- %HOMEPATH%\qixqt\34543.idz
- %HOMEPATH%\qixqt\53322.zbj
- %HOMEPATH%\qixqt\16632.gmv
- %HOMEPATH%\qixqt\95264.mmf
- %HOMEPATH%\qixqt\18136.mjh
- %HOMEPATH%\qixqt\84798.mte
- %HOMEPATH%\qixqt\20227.trl
- %HOMEPATH%\qixqt\62011.njz
- %HOMEPATH%\qixqt\86585.bqc
- %HOMEPATH%\qixqt\51755.fao
- %HOMEPATH%\qixqt\16905.jsz
- %HOMEPATH%\qixqt\22501.gfr
- %HOMEPATH%\qixqt\72325.gmi
- %HOMEPATH%\qixqt\45432.utg
- %HOMEPATH%\qixqt\42313.aaq
- %HOMEPATH%\qixqt\68423.kvg
- %HOMEPATH%\qixqt\81548.kyz
- %HOMEPATH%\qixqt\89767.nea
- %HOMEPATH%\qixqt\89622.qst
- %HOMEPATH%\qixqt\2907.mjj
- %HOMEPATH%\qixqt\5813.pvj
- %HOMEPATH%\qixqt\41556.nqc
- %HOMEPATH%\qixqt\64566.rxn
- %HOMEPATH%\qixqt\78853.wiw
- %HOMEPATH%\qixqt\10608.rph
- %HOMEPATH%\qixqt\97929.ibm
- %HOMEPATH%\qixqt\29132.eiy
- %HOMEPATH%\qixqt\99864.jyb
- %HOMEPATH%\qixqt\12485.xdz
- %HOMEPATH%\qixqt\19599.rvy
- %HOMEPATH%\qixqt\93826.gvv
- %HOMEPATH%\qixqt\57759.xaa
- %HOMEPATH%\qixqt\99985.crk
- %HOMEPATH%\qixqt\51123.zqv
- %HOMEPATH%\qixqt\6021.pvo
- %HOMEPATH%\qixqt\87539.aha
- %HOMEPATH%\qixqt\89695.esb
- %HOMEPATH%\qixqt\71773.fqh
- %HOMEPATH%\qixqt\46460.mpp
- %HOMEPATH%\qixqt\38521.tys
- %HOMEPATH%\qixqt\14023.sbp
- %HOMEPATH%\qixqt\22824.zcd
- %HOMEPATH%\qixqt\60206.jcq
- %HOMEPATH%\qixqt\52830.aof
- %HOMEPATH%\qixqt\83081.xia
- %HOMEPATH%\qixqt\60015.ugg
- %HOMEPATH%\qixqt\33638.vhn
- %HOMEPATH%\qixqt\87625.taj
- %HOMEPATH%\qixqt\73777.sko
- %HOMEPATH%\qixqt\23610.mmk
- %HOMEPATH%\qixqt\56521.tcw
- %HOMEPATH%\qixqt\54310.kqa
- %HOMEPATH%\qixqt\60118.skt
- %HOMEPATH%\qixqt\58712.hfg
- %HOMEPATH%\qixqt\95109.lnm
- %HOMEPATH%\qixqt\35775.wjt
- %HOMEPATH%\qixqt\14466.kyz
- %HOMEPATH%\qixqt\63396.qts
- %HOMEPATH%\qixqt\kulc.exe
- %HOMEPATH%\qixqt\65835.DAF
- %HOMEPATH%\qixqt\4596853.vbs
- %HOMEPATH%\qixqt\75046.ykb
- %HOMEPATH%\qixqt\5229160.GGJ
- %HOMEPATH%\qixqt\14426.oky
- %HOMEPATH%\qixqt\16565.tuy
- %HOMEPATH%\qixqt\61551.hre
- %HOMEPATH%\qixqt\12658.nji
- %HOMEPATH%\qixqt\62214.dny
- %HOMEPATH%\qixqt\5353.eli
- %HOMEPATH%\qixqt\47931.itt
- %HOMEPATH%\qixqt\81706.pmq
- %HOMEPATH%\qixqt\3528.ixx
- %HOMEPATH%\qixqt\66996.cvy
- %HOMEPATH%\qixqt\95899.ipm
- %HOMEPATH%\qixqt\95955.pyz
- %HOMEPATH%\qixqt\88165.xov
- %HOMEPATH%\qixqt\48858.tjj
- %HOMEPATH%\qixqt\61664.rdz
- %HOMEPATH%\qixqt\88994.waa
- %HOMEPATH%\qixqt\37208.yyz
- %HOMEPATH%\qixqt\88457.wte
- %HOMEPATH%\qixqt\89531.uqz
- %HOMEPATH%\qixqt\58450.iof
- %HOMEPATH%\qixqt\99032.twj
- %HOMEPATH%\qixqt\67478.vbn
- %HOMEPATH%\qixqt\75829.ulo
- %HOMEPATH%\qixqt\64546.ztn
- %HOMEPATH%\qixqt\75940.yuc
- %HOMEPATH%\qixqt\79353.ety
- %HOMEPATH%\qixqt\8210.rrv
- %HOMEPATH%\qixqt\68353.vrs
- %HOMEPATH%\qixqt\54853.mhf
- %HOMEPATH%\qixqt\68982.dwu
- %HOMEPATH%\qixqt\77338.die
- %HOMEPATH%\qixqt\80488.thn
- %HOMEPATH%\qixqt\78300.urj
- %HOMEPATH%\qixqt\39043.wiv
- %HOMEPATH%\qixqt\92964.xfh
- %HOMEPATH%\qixqt\52639.saw
- %HOMEPATH%\qixqt\60028.suu
- %HOMEPATH%\qixqt\39961.pvp
- %HOMEPATH%\qixqt\11514.lej
- %HOMEPATH%\qixqt\74858.eqx
- %HOMEPATH%\qixqt\94798.mcx
- %HOMEPATH%\qixqt\90870.fjs
- %HOMEPATH%\qixqt\3684.jdy
- %HOMEPATH%\qixqt\26852.ous
- %HOMEPATH%\qixqt\73230.qkp
- %HOMEPATH%\qixqt\82457.wpk
- %HOMEPATH%\qixqt\65812.pfv
- %HOMEPATH%\qixqt\52356.eks
- %HOMEPATH%\qixqt\21304.xxr
- %HOMEPATH%\qixqt\85829.rnn
- %HOMEPATH%\qixqt\2153.whx
- %HOMEPATH%\qixqt\59589.omx
- %HOMEPATH%\qixqt\31035.dzp
- %HOMEPATH%\qixqt\34996.fel
- %HOMEPATH%\qixqt\93265.gom
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
