Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvfhgw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtseys.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqooej.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemlvhkd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemddmvj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkwvtv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemyilet.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemspkfo.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgadwo.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqmnfh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzcmek.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrasmi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemyxmxf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemohfqk.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtmivr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjqxmf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwhumt.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemaivje.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxulcd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemifdgw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhisbd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfgcuc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxzjzi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkbast.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmwigk.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcedef.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxmqtq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxzzqi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfdlow.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemibehy.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqrcsq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemffenb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemshmnj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemsuqos.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxlvph.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtoube.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnjneb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkdfxx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemaubxn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemadjtk.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcleer.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempzfad.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfvjya.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemztkwc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnkbqu.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgpqlg.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjlqki.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhxqjh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemeweem.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemikocb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdcbco.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemldamw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtuiqs.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzuxae.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjbeao.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemumgtm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemwsooa.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemznbjt.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemohfno.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemobqin.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemghwgd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmferi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemezcsh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzhdxi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcyeny.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfpabu.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkqttq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemuzdus.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrljfw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkvrqv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempxjjr.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\Sysqemlvhkd.exe'
- '%TEMP%\Sysqemvfhgw.exe'
- '%TEMP%\Sysqemgadwo.exe'
- '%TEMP%\Sysqemqooej.exe'
- '%TEMP%\Sysqemspkfo.exe'
- '%TEMP%\Sysqemddmvj.exe'
- '%TEMP%\Sysqemtseys.exe'
- '%TEMP%\Sysqemyilet.exe'
- '%TEMP%\Sysqemtmivr.exe'
- '%TEMP%\Sysqemyxmxf.exe'
- '%TEMP%\Sysqemqmnfh.exe'
- '%TEMP%\Sysqemtoube.exe'
- '%TEMP%\Sysqemrasmi.exe'
- '%TEMP%\Sysqemwhumt.exe'
- '%TEMP%\Sysqemohfqk.exe'
- '%TEMP%\Sysqemzcmek.exe'
- '%TEMP%\Sysqemjqxmf.exe'
- '%TEMP%\Sysqemkwvtv.exe'
- '%TEMP%\Sysqemfgcuc.exe'
- '%TEMP%\Sysqemxulcd.exe'
- '%TEMP%\Sysqemxmqtq.exe'
- '%TEMP%\Sysqemhisbd.exe'
- '%TEMP%\Sysqemcedef.exe'
- '%TEMP%\Sysqemxzjzi.exe'
- '%TEMP%\Sysqemifdgw.exe'
- '%TEMP%\Sysqemmwigk.exe'
- '%TEMP%\Sysqemshmnj.exe'
- '%TEMP%\Sysqemqrcsq.exe'
- '%TEMP%\Sysqemxzzqi.exe'
- '%TEMP%\Sysqemaivje.exe'
- '%TEMP%\Sysqemibehy.exe'
- '%TEMP%\Sysqemxlvph.exe'
- '%TEMP%\Sysqemffenb.exe'
- '%TEMP%\Sysqemfdlow.exe'
- '%TEMP%\Sysqemsuqos.exe'
- '%TEMP%\Sysqemnjneb.exe'
- '%TEMP%\Sysqemkdfxx.exe'
- '%TEMP%\Sysqemaubxn.exe'
- '%TEMP%\Sysqemadjtk.exe'
- '%TEMP%\Sysqemcleer.exe'
- '%TEMP%\Sysqempzfad.exe'
- '%TEMP%\Sysqemfvjya.exe'
- '%TEMP%\Sysqemztkwc.exe'
- '%TEMP%\Sysqemnkbqu.exe'
- '%TEMP%\Sysqemgpqlg.exe'
- '%TEMP%\Sysqemjlqki.exe'
- '%TEMP%\Sysqemhxqjh.exe'
- '%TEMP%\Sysqemeweem.exe'
- '%TEMP%\Sysqemikocb.exe'
- '%TEMP%\Sysqemdcbco.exe'
- '%TEMP%\Sysqemldamw.exe'
- '%TEMP%\Sysqemtuiqs.exe'
- '%TEMP%\Sysqemzuxae.exe'
- '%TEMP%\Sysqemjbeao.exe'
- '%TEMP%\Sysqemumgtm.exe'
- '%TEMP%\Sysqemwsooa.exe'
- '%TEMP%\Sysqemznbjt.exe'
- '%TEMP%\Sysqemohfno.exe'
- '%TEMP%\Sysqemobqin.exe'
- '%TEMP%\Sysqemghwgd.exe'
- '%TEMP%\Sysqemmferi.exe'
- '%TEMP%\Sysqemezcsh.exe'
- '%TEMP%\Sysqemzhdxi.exe'
- '%TEMP%\Sysqemcyeny.exe'
- '%TEMP%\Sysqemfpabu.exe'
- '%TEMP%\Sysqemkqttq.exe'
- '%TEMP%\Sysqemuzdus.exe'
- '%TEMP%\Sysqemrljfw.exe'
- '%TEMP%\Sysqemkvrqv.exe'
- '%TEMP%\Sysqempxjjr.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\Sysqemlvhkd.exe
- %TEMP%\Sysqemvfhgw.exe
- %TEMP%\Sysqemgadwo.exe
- %TEMP%\Sysqemqooej.exe
- %TEMP%\Sysqemtseys.exe
- %TEMP%\Sysqemddmvj.exe
- %TEMP%\Sysqemkwvtv.exe
- %TEMP%\Sysqemyilet.exe
- %TEMP%\Sysqemspkfo.exe
- %TEMP%\Sysqemyxmxf.exe
- %TEMP%\Sysqemqmnfh.exe
- %TEMP%\Sysqemtoube.exe
- %TEMP%\Sysqemrasmi.exe
- %TEMP%\Sysqemzcmek.exe
- %TEMP%\Sysqemohfqk.exe
- %TEMP%\Sysqemtmivr.exe
- %TEMP%\Sysqemjqxmf.exe
- %TEMP%\Sysqemwhumt.exe
- %TEMP%\Sysqemfgcuc.exe
- %TEMP%\Sysqemxulcd.exe
- %TEMP%\Sysqemxmqtq.exe
- %TEMP%\Sysqemhisbd.exe
- %TEMP%\Sysqemifdgw.exe
- %TEMP%\Sysqemxzjzi.exe
- %TEMP%\Sysqemkbast.exe
- %TEMP%\Sysqemmwigk.exe
- %TEMP%\Sysqemcedef.exe
- %TEMP%\Sysqemqrcsq.exe
- %TEMP%\Sysqemxzzqi.exe
- %TEMP%\Sysqemaivje.exe
- %TEMP%\Sysqemibehy.exe
- %TEMP%\Sysqemfdlow.exe
- %TEMP%\Sysqemffenb.exe
- %TEMP%\Sysqemshmnj.exe
- %TEMP%\Sysqemsuqos.exe
- %TEMP%\Sysqemxlvph.exe
- %TEMP%\Sysqemobqin.exe
- %TEMP%\Sysqemaubxn.exe
- %TEMP%\Sysqemadjtk.exe
- %TEMP%\Sysqemdcbco.exe
- %TEMP%\Sysqemnkbqu.exe
- %TEMP%\Sysqemnjneb.exe
- %TEMP%\Sysqemztkwc.exe
- %TEMP%\Sysqemcleer.exe
- %TEMP%\Sysqemkdfxx.exe
- %TEMP%\Sysqemfvjya.exe
- %TEMP%\Sysqemhxqjh.exe
- %TEMP%\Sysqemeweem.exe
- %TEMP%\qpath.ini
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\Sysqemgpqlg.exe
- %TEMP%\Sysqemtuiqs.exe
- %TEMP%\Sysqemikocb.exe
- %TEMP%\Sysqemjlqki.exe
- %TEMP%\Sysqemldamw.exe
- %TEMP%\Sysqemwsooa.exe
- %TEMP%\Sysqemznbjt.exe
- %TEMP%\Sysqemrljfw.exe
- %TEMP%\Sysqemezcsh.exe
- %TEMP%\Sysqemjbeao.exe
- %TEMP%\Sysqemmferi.exe
- %TEMP%\Sysqemohfno.exe
- %TEMP%\Sysqemumgtm.exe
- %TEMP%\Sysqemghwgd.exe
- %TEMP%\Sysqemfpabu.exe
- %TEMP%\Sysqemkqttq.exe
- %TEMP%\Sysqempzfad.exe
- %TEMP%\Sysqemzuxae.exe
- %TEMP%\Sysqemzhdxi.exe
- %TEMP%\Sysqempxjjr.exe
- %TEMP%\Sysqemuzdus.exe
- %TEMP%\Sysqemcyeny.exe
- %TEMP%\Sysqemkvrqv.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\Sysqemlvhkd.exe
- %TEMP%\Sysqemvfhgw.exe
- %TEMP%\Sysqemgadwo.exe
- %TEMP%\Sysqemqooej.exe
- %TEMP%\Sysqemtseys.exe
- %TEMP%\Sysqemddmvj.exe
- %TEMP%\Sysqemkwvtv.exe
- %TEMP%\Sysqemyilet.exe
- %TEMP%\Sysqemspkfo.exe
- %TEMP%\Sysqemyxmxf.exe
- %TEMP%\Sysqemqmnfh.exe
- %TEMP%\Sysqemtoube.exe
- %TEMP%\Sysqemrasmi.exe
- %TEMP%\Sysqemzcmek.exe
- %TEMP%\Sysqemohfqk.exe
- %TEMP%\Sysqemtmivr.exe
- %TEMP%\Sysqemjqxmf.exe
- %TEMP%\Sysqemwhumt.exe
- %TEMP%\Sysqemfgcuc.exe
- %TEMP%\Sysqemxulcd.exe
- %TEMP%\Sysqemxmqtq.exe
- %TEMP%\Sysqemhisbd.exe
- %TEMP%\Sysqemifdgw.exe
- %TEMP%\Sysqemxzjzi.exe
- %TEMP%\Sysqemkbast.exe
- %TEMP%\Sysqemmwigk.exe
- %TEMP%\Sysqemcedef.exe
- %TEMP%\Sysqemqrcsq.exe
- %TEMP%\Sysqemxzzqi.exe
- %TEMP%\Sysqemaivje.exe
- %TEMP%\Sysqemibehy.exe
- %TEMP%\Sysqemfdlow.exe
- %TEMP%\Sysqemffenb.exe
- %TEMP%\Sysqemshmnj.exe
- %TEMP%\Sysqemsuqos.exe
- %TEMP%\Sysqemxlvph.exe
- %TEMP%\Sysqemadjtk.exe
- %TEMP%\Sysqemnjneb.exe
- %TEMP%\Sysqemnkbqu.exe
- %TEMP%\Sysqemaubxn.exe
- %TEMP%\Sysqemkdfxx.exe
- %TEMP%\Sysqemcleer.exe
- %TEMP%\Sysqempzfad.exe
- %TEMP%\Sysqemfvjya.exe
- %TEMP%\Sysqemztkwc.exe
- %TEMP%\Sysqemeweem.exe
- %TEMP%\Sysqemgpqlg.exe
- %TEMP%\Sysqemhxqjh.exe
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\Sysqemjlqki.exe
- %TEMP%\Sysqemikocb.exe
- %TEMP%\Sysqemdcbco.exe
- %TEMP%\Sysqemldamw.exe
- %TEMP%\Sysqemtuiqs.exe
- %TEMP%\Sysqemznbjt.exe
- %TEMP%\Sysqemjbeao.exe
- %TEMP%\Sysqemezcsh.exe
- %TEMP%\Sysqemwsooa.exe
- %TEMP%\Sysqemumgtm.exe
- %TEMP%\Sysqemohfno.exe
- %TEMP%\Sysqemobqin.exe
- %TEMP%\Sysqemghwgd.exe
- %TEMP%\Sysqemmferi.exe
- %TEMP%\Sysqemkqttq.exe
- %TEMP%\Sysqemzhdxi.exe
- %TEMP%\Sysqemzuxae.exe
- %TEMP%\Sysqemfpabu.exe
- %TEMP%\Sysqemcyeny.exe
- %TEMP%\Sysqemuzdus.exe
- %TEMP%\Sysqemrljfw.exe
- %TEMP%\Sysqemkvrqv.exe
- %TEMP%\Sysqempxjjr.exe
