Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Java Libre' = '%TEMP%\Svchost.bat'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\Svchost.bat'
Запускает на исполнение:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pibz72di.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jutz83bf.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8it_tunb.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qroyfp5u.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\h6wjxyud.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\4jsmcg-z.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7zwxxgmx.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ywdorj-j.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\w3lrdpxf.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2zmv_h7u.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\moemoczc.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\a2xivd0d.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qybdoxof.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\stz9bg5b.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sffqthaf.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rppzucjo.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l3ba6zwk.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lygtx40q.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dzx285vn.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\09ng8h7d.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dcnpvfwl.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1llv14fm.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wewc6ion.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nnerj6pk.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kj7yseas.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\84gtozrr.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fqlrs2ta.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ttn9zwkm.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\re6jxeg0.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tj8rxwmx.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wuyyj8vx.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_4motx-s.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nytqtdhj.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\u06yjcxd.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rvwv4o67.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ow-9neo6.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8vo0bhcg.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j-asrytw.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_qod_soi.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cgwuro4s.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\to-oyqrq.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qwc-7f_g.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\klrm8_uq.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\julyvqkb.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\h1l-ne0h.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xvb5xiuf.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yet_sivb.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zboobdbr.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bsjqn8qk.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iwvwg--t.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qklwkwbo.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\igxgmebg.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\91e_lnhu.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f3p5asny.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\chvekimr.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j-ruucsm.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zji5saht.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pcaq_p4r.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\glwniyfn.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zyqeu8je.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wflvet0x.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nz09403p.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\p9rdknzn.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ekbhwbt6.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mlxewqnv.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\idd97lqm.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l2n0xqpl.cmdline"
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\pibz72di.cmdline
- %TEMP%\pibz72di.0.vb
- %TEMP%\qroyfp5u.out
- %TEMP%\jutz83bf.cmdline
- %TEMP%\jutz83bf.0.vb
- %TEMP%\pibz72di.out
- %TEMP%\8it_tunb.cmdline
- %TEMP%\8it_tunb.0.vb
- %TEMP%\stz9bg5b.out
- %TEMP%\qroyfp5u.cmdline
- %TEMP%\qroyfp5u.0.vb
- %TEMP%\8it_tunb.out
- %TEMP%\jutz83bf.out
- %TEMP%\h6wjxyud.out
- %TEMP%\h6wjxyud.cmdline
- %TEMP%\h6wjxyud.0.vb
- %TEMP%\4jsmcg-z.out
- %TEMP%\4jsmcg-z.cmdline
- %TEMP%\4jsmcg-z.0.vb
- %TEMP%\7zwxxgmx.out
- %TEMP%\7zwxxgmx.cmdline
- %TEMP%\7zwxxgmx.0.vb
- %TEMP%\ywdorj-j.out
- %TEMP%\ywdorj-j.cmdline
- %TEMP%\ywdorj-j.0.vb
- %TEMP%\w3lrdpxf.0.vb
- %TEMP%\a2xivd0d.out
- %TEMP%\a2xivd0d.cmdline
- %TEMP%\2zmv_h7u.0.vb
- %TEMP%\w3lrdpxf.out
- %TEMP%\w3lrdpxf.cmdline
- %TEMP%\moemoczc.0.vb
- %TEMP%\u06yjcxd.out
- %TEMP%\u06yjcxd.cmdline
- %TEMP%\a2xivd0d.0.vb
- %TEMP%\moemoczc.out
- %TEMP%\moemoczc.cmdline
- %TEMP%\2zmv_h7u.cmdline
- %TEMP%\qybdoxof.cmdline
- %TEMP%\qybdoxof.0.vb
- %TEMP%\rppzucjo.out
- %TEMP%\stz9bg5b.cmdline
- %TEMP%\stz9bg5b.0.vb
- %TEMP%\qybdoxof.out
- %TEMP%\sffqthaf.cmdline
- %TEMP%\sffqthaf.0.vb
- %TEMP%\2zmv_h7u.out
- %TEMP%\rppzucjo.cmdline
- %TEMP%\rppzucjo.0.vb
- %TEMP%\sffqthaf.out
- %TEMP%\l3ba6zwk.0.vb
- %TEMP%\lygtx40q.cmdline
- %TEMP%\lygtx40q.0.vb
- %TEMP%\dcnpvfwl.out
- %TEMP%\dzx285vn.cmdline
- %TEMP%\dzx285vn.0.vb
- %TEMP%\lygtx40q.out
- %TEMP%\09ng8h7d.cmdline
- %TEMP%\09ng8h7d.0.vb
- %TEMP%\wuyyj8vx.out
- %TEMP%\dcnpvfwl.cmdline
- %TEMP%\dcnpvfwl.0.vb
- %TEMP%\09ng8h7d.out
- %TEMP%\dzx285vn.out
- %TEMP%\1llv14fm.out
- %TEMP%\1llv14fm.cmdline
- %TEMP%\1llv14fm.0.vb
- %TEMP%\wewc6ion.out
- %TEMP%\wewc6ion.cmdline
- %TEMP%\wewc6ion.0.vb
- %TEMP%\nnerj6pk.out
- %TEMP%\nnerj6pk.cmdline
- %TEMP%\nnerj6pk.0.vb
- %TEMP%\kj7yseas.out
- %TEMP%\kj7yseas.cmdline
- %TEMP%\kj7yseas.0.vb
- %TEMP%\84gtozrr.0.vb
- %TEMP%\re6jxeg0.out
- %TEMP%\re6jxeg0.cmdline
- %TEMP%\fqlrs2ta.0.vb
- %TEMP%\84gtozrr.out
- %TEMP%\84gtozrr.cmdline
- %TEMP%\ttn9zwkm.0.vb
- %TEMP%\l3ba6zwk.out
- %TEMP%\l3ba6zwk.cmdline
- %TEMP%\re6jxeg0.0.vb
- %TEMP%\ttn9zwkm.out
- %TEMP%\ttn9zwkm.cmdline
- %TEMP%\fqlrs2ta.cmdline
- %TEMP%\tj8rxwmx.cmdline
- %TEMP%\tj8rxwmx.0.vb
- %TEMP%\nytqtdhj.out
- %TEMP%\wuyyj8vx.cmdline
- %TEMP%\wuyyj8vx.0.vb
- %TEMP%\tj8rxwmx.out
- %TEMP%\_4motx-s.cmdline
- %TEMP%\_4motx-s.0.vb
- %TEMP%\fqlrs2ta.out
- %TEMP%\nytqtdhj.cmdline
- %TEMP%\nytqtdhj.0.vb
- %TEMP%\_4motx-s.out
- %TEMP%\rvwv4o67.out
- %TEMP%\rvwv4o67.cmdline
- %TEMP%\rvwv4o67.0.vb
- %TEMP%\ow-9neo6.out
- %TEMP%\ow-9neo6.cmdline
- %TEMP%\ow-9neo6.0.vb
- %TEMP%\8vo0bhcg.out
- %TEMP%\8vo0bhcg.cmdline
- %TEMP%\8vo0bhcg.0.vb
- %TEMP%\j-asrytw.out
- %TEMP%\j-asrytw.cmdline
- %TEMP%\j-asrytw.0.vb
- %TEMP%\to-oyqrq.0.vb
- %TEMP%\cgwuro4s.0.vb
- %TEMP%\_qod_soi.out
- %TEMP%\_qod_soi.cmdline
- %TEMP%\qklwkwbo.0.vb
- %TEMP%\cgwuro4s.out
- %TEMP%\cgwuro4s.cmdline
- %TEMP%\qwc-7f_g.0.vb
- %TEMP%\to-oyqrq.out
- %TEMP%\to-oyqrq.cmdline
- %TEMP%\_qod_soi.0.vb
- %TEMP%\qwc-7f_g.out
- %TEMP%\qwc-7f_g.cmdline
- %TEMP%\klrm8_uq.cmdline
- %TEMP%\klrm8_uq.0.vb
- %TEMP%\xvb5xiuf.out
- %TEMP%\julyvqkb.cmdline
- %TEMP%\julyvqkb.0.vb
- %TEMP%\klrm8_uq.out
- %TEMP%\h1l-ne0h.cmdline
- %TEMP%\h1l-ne0h.0.vb
- %TEMP%\Svchost.bat
- %TEMP%\xvb5xiuf.cmdline
- %TEMP%\xvb5xiuf.0.vb
- %TEMP%\h1l-ne0h.out
- %TEMP%\julyvqkb.out
- %TEMP%\yet_sivb.out
- %TEMP%\yet_sivb.cmdline
- %TEMP%\yet_sivb.0.vb
- %TEMP%\zboobdbr.out
- %TEMP%\zboobdbr.cmdline
- %TEMP%\zboobdbr.0.vb
- %TEMP%\bsjqn8qk.out
- %TEMP%\bsjqn8qk.cmdline
- %TEMP%\bsjqn8qk.0.vb
- %TEMP%\iwvwg--t.out
- %TEMP%\iwvwg--t.cmdline
- %TEMP%\iwvwg--t.0.vb
- %TEMP%\qklwkwbo.cmdline
- %TEMP%\igxgmebg.out
- %TEMP%\igxgmebg.cmdline
- %TEMP%\igxgmebg.0.vb
- %TEMP%\91e_lnhu.out
- %TEMP%\91e_lnhu.cmdline
- %TEMP%\91e_lnhu.0.vb
- %TEMP%\f3p5asny.out
- %TEMP%\f3p5asny.cmdline
- %TEMP%\f3p5asny.0.vb
- %TEMP%\chvekimr.out
- %TEMP%\chvekimr.cmdline
- %TEMP%\chvekimr.0.vb
- %TEMP%\pcaq_p4r.0.vb
- %TEMP%\zji5saht.0.vb
- %TEMP%\j-ruucsm.out
- %TEMP%\j-ruucsm.cmdline
- %TEMP%\u06yjcxd.0.vb
- %TEMP%\zji5saht.out
- %TEMP%\zji5saht.cmdline
- %TEMP%\glwniyfn.0.vb
- %TEMP%\pcaq_p4r.out
- %TEMP%\pcaq_p4r.cmdline
- %TEMP%\j-ruucsm.0.vb
- %TEMP%\glwniyfn.out
- %TEMP%\glwniyfn.cmdline
- %TEMP%\zyqeu8je.cmdline
- %TEMP%\zyqeu8je.0.vb
- %TEMP%\p9rdknzn.out
- %TEMP%\wflvet0x.cmdline
- %TEMP%\wflvet0x.0.vb
- %TEMP%\zyqeu8je.out
- %TEMP%\nz09403p.cmdline
- %TEMP%\nz09403p.0.vb
- %TEMP%\qklwkwbo.out
- %TEMP%\p9rdknzn.cmdline
- %TEMP%\p9rdknzn.0.vb
- %TEMP%\nz09403p.out
- %TEMP%\wflvet0x.out
- %TEMP%\ekbhwbt6.out
- %TEMP%\ekbhwbt6.cmdline
- %TEMP%\ekbhwbt6.0.vb
- %TEMP%\mlxewqnv.out
- %TEMP%\mlxewqnv.cmdline
- %TEMP%\mlxewqnv.0.vb
- %TEMP%\idd97lqm.out
- %TEMP%\idd97lqm.cmdline
- %TEMP%\idd97lqm.0.vb
- %TEMP%\l2n0xqpl.out
- %TEMP%\l2n0xqpl.cmdline
- %TEMP%\l2n0xqpl.0.vb
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\Svchost.bat
Удаляет следующие файлы:
- %TEMP%\pibz72di.out
- %TEMP%\qroyfp5u.0.vb
- %TEMP%\qroyfp5u.cmdline
- %TEMP%\jutz83bf.out
- %TEMP%\pibz72di.cmdline
- %TEMP%\pibz72di.0.vb
- %TEMP%\8it_tunb.0.vb
- %TEMP%\stz9bg5b.cmdline
- %TEMP%\stz9bg5b.0.vb
- %TEMP%\qroyfp5u.out
- %TEMP%\8it_tunb.cmdline
- %TEMP%\8it_tunb.out
- %TEMP%\h6wjxyud.cmdline
- %TEMP%\ywdorj-j.cmdline
- %TEMP%\ywdorj-j.0.vb
- %TEMP%\4jsmcg-z.out
- %TEMP%\h6wjxyud.0.vb
- %TEMP%\h6wjxyud.out
- %TEMP%\7zwxxgmx.0.vb
- %TEMP%\jutz83bf.cmdline
- %TEMP%\jutz83bf.0.vb
- %TEMP%\ywdorj-j.out
- %TEMP%\7zwxxgmx.out
- %TEMP%\7zwxxgmx.cmdline
- %TEMP%\stz9bg5b.out
- %TEMP%\a2xivd0d.cmdline
- %TEMP%\a2xivd0d.0.vb
- %TEMP%\a2xivd0d.out
- %TEMP%\w3lrdpxf.out
- %TEMP%\w3lrdpxf.cmdline
- %TEMP%\w3lrdpxf.0.vb
- %TEMP%\u06yjcxd.out
- %TEMP%\u06yjcxd.0.vb
- %TEMP%\u06yjcxd.cmdline
- %TEMP%\moemoczc.cmdline
- %TEMP%\moemoczc.out
- %TEMP%\moemoczc.0.vb
- %TEMP%\rppzucjo.0.vb
- %TEMP%\rppzucjo.cmdline
- %TEMP%\rppzucjo.out
- %TEMP%\qybdoxof.0.vb
- %TEMP%\qybdoxof.cmdline
- %TEMP%\qybdoxof.out
- %TEMP%\2zmv_h7u.out
- %TEMP%\2zmv_h7u.0.vb
- %TEMP%\2zmv_h7u.cmdline
- %TEMP%\sffqthaf.0.vb
- %TEMP%\sffqthaf.out
- %TEMP%\sffqthaf.cmdline
- %TEMP%\4jsmcg-z.0.vb
- %TEMP%\dcnpvfwl.0.vb
- %TEMP%\dcnpvfwl.cmdline
- %TEMP%\dcnpvfwl.out
- %TEMP%\lygtx40q.out
- %TEMP%\lygtx40q.cmdline
- %TEMP%\lygtx40q.0.vb
- %TEMP%\wuyyj8vx.0.vb
- %TEMP%\wuyyj8vx.cmdline
- %TEMP%\wuyyj8vx.out
- %TEMP%\09ng8h7d.out
- %TEMP%\09ng8h7d.cmdline
- %TEMP%\09ng8h7d.0.vb
- %TEMP%\kj7yseas.cmdline
- %TEMP%\kj7yseas.out
- %TEMP%\kj7yseas.0.vb
- %TEMP%\1llv14fm.0.vb
- %TEMP%\1llv14fm.cmdline
- %TEMP%\1llv14fm.out
- %TEMP%\dzx285vn.cmdline
- %TEMP%\dzx285vn.0.vb
- %TEMP%\dzx285vn.out
- %TEMP%\nnerj6pk.0.vb
- %TEMP%\nnerj6pk.out
- %TEMP%\nnerj6pk.cmdline
- %TEMP%\tj8rxwmx.out
- %TEMP%\re6jxeg0.0.vb
- %TEMP%\re6jxeg0.cmdline
- %TEMP%\ttn9zwkm.out
- %TEMP%\84gtozrr.cmdline
- %TEMP%\84gtozrr.0.vb
- %TEMP%\re6jxeg0.out
- %TEMP%\l3ba6zwk.cmdline
- %TEMP%\l3ba6zwk.out
- %TEMP%\4jsmcg-z.cmdline
- %TEMP%\ttn9zwkm.cmdline
- %TEMP%\ttn9zwkm.0.vb
- %TEMP%\l3ba6zwk.0.vb
- %TEMP%\nytqtdhj.cmdline
- %TEMP%\nytqtdhj.out
- %TEMP%\_4motx-s.0.vb
- %TEMP%\tj8rxwmx.cmdline
- %TEMP%\tj8rxwmx.0.vb
- %TEMP%\nytqtdhj.0.vb
- %TEMP%\fqlrs2ta.out
- %TEMP%\fqlrs2ta.cmdline
- %TEMP%\84gtozrr.out
- %TEMP%\_4motx-s.cmdline
- %TEMP%\_4motx-s.out
- %TEMP%\fqlrs2ta.0.vb
- %TEMP%\ow-9neo6.out
- %TEMP%\rvwv4o67.0.vb
- %TEMP%\rvwv4o67.out
- %TEMP%\to-oyqrq.out
- %TEMP%\ow-9neo6.cmdline
- %TEMP%\ow-9neo6.0.vb
- %TEMP%\j-asrytw.cmdline
- %TEMP%\8vo0bhcg.0.vb
- %TEMP%\8vo0bhcg.out
- %TEMP%\rvwv4o67.cmdline
- %TEMP%\j-asrytw.0.vb
- %TEMP%\j-asrytw.out
- %TEMP%\cgwuro4s.0.vb
- %TEMP%\_qod_soi.out
- %TEMP%\_qod_soi.cmdline
- %TEMP%\qklwkwbo.cmdline
- %TEMP%\cgwuro4s.out
- %TEMP%\cgwuro4s.cmdline
- %TEMP%\qwc-7f_g.0.vb
- %TEMP%\to-oyqrq.0.vb
- %TEMP%\to-oyqrq.cmdline
- %TEMP%\_qod_soi.0.vb
- %TEMP%\qwc-7f_g.cmdline
- %TEMP%\qwc-7f_g.out
- %TEMP%\8vo0bhcg.cmdline
- %TEMP%\klrm8_uq.0.vb
- %TEMP%\klrm8_uq.cmdline
- %TEMP%\klrm8_uq.out
- %TEMP%\julyvqkb.out
- %TEMP%\julyvqkb.cmdline
- %TEMP%\julyvqkb.0.vb
- %TEMP%\h1l-ne0h.0.vb
- %TEMP%\h1l-ne0h.cmdline
- %TEMP%\h1l-ne0h.out
- %TEMP%\xvb5xiuf.out
- %TEMP%\xvb5xiuf.cmdline
- %TEMP%\xvb5xiuf.0.vb
- %TEMP%\yet_sivb.out
- %TEMP%\yet_sivb.cmdline
- %TEMP%\yet_sivb.0.vb
- %TEMP%\zboobdbr.cmdline
- %TEMP%\zboobdbr.out
- %TEMP%\zboobdbr.0.vb
- %TEMP%\bsjqn8qk.0.vb
- %TEMP%\bsjqn8qk.out
- %TEMP%\bsjqn8qk.cmdline
- %TEMP%\iwvwg--t.cmdline
- %TEMP%\iwvwg--t.0.vb
- %TEMP%\iwvwg--t.out
- %TEMP%\qklwkwbo.out
- %TEMP%\igxgmebg.out
- %TEMP%\igxgmebg.cmdline
- %TEMP%\igxgmebg.0.vb
- %TEMP%\91e_lnhu.cmdline
- %TEMP%\91e_lnhu.0.vb
- %TEMP%\91e_lnhu.out
- %TEMP%\f3p5asny.0.vb
- %TEMP%\f3p5asny.cmdline
- %TEMP%\f3p5asny.out
- %TEMP%\chvekimr.0.vb
- %TEMP%\chvekimr.cmdline
- %TEMP%\chvekimr.out
- %TEMP%\j-ruucsm.0.vb
- %TEMP%\j-ruucsm.out
- %TEMP%\j-ruucsm.cmdline
- %TEMP%\zji5saht.cmdline
- %TEMP%\zji5saht.0.vb
- %TEMP%\zji5saht.out
- %TEMP%\pcaq_p4r.cmdline
- %TEMP%\pcaq_p4r.out
- %TEMP%\pcaq_p4r.0.vb
- %TEMP%\glwniyfn.cmdline
- %TEMP%\glwniyfn.0.vb
- %TEMP%\glwniyfn.out
- %TEMP%\mlxewqnv.0.vb
- %TEMP%\zyqeu8je.out
- %TEMP%\zyqeu8je.cmdline
- %TEMP%\p9rdknzn.cmdline
- %TEMP%\wflvet0x.cmdline
- %TEMP%\wflvet0x.out
- %TEMP%\zyqeu8je.0.vb
- %TEMP%\nz09403p.0.vb
- %TEMP%\nz09403p.out
- %TEMP%\qklwkwbo.0.vb
- %TEMP%\p9rdknzn.out
- %TEMP%\p9rdknzn.0.vb
- %TEMP%\nz09403p.cmdline
- %TEMP%\ekbhwbt6.0.vb
- %TEMP%\ekbhwbt6.cmdline
- %TEMP%\l2n0xqpl.0.vb
- %TEMP%\mlxewqnv.out
- %TEMP%\mlxewqnv.cmdline
- %TEMP%\ekbhwbt6.out
- %TEMP%\idd97lqm.out
- %TEMP%\idd97lqm.0.vb
- %TEMP%\wflvet0x.0.vb
- %TEMP%\l2n0xqpl.cmdline
- %TEMP%\l2n0xqpl.out
- %TEMP%\idd97lqm.cmdline
Сетевая активность:
Подключается к:
- 'vi######yles.servehttp.com':2323
UDP:
- DNS ASK vi######yles.servehttp.com
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
