Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkpxrj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxjedp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemyceat.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqeminbke.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqeminqzn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxcreu.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemixuhj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtrrqv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemlruav.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqooej.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfbjro.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvjvwq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemiwbie.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemivboj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhkixp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxvfhu.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempghwc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhzsgi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmmdtc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempguam.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempybar.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemawhvk.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxphhv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfmrew.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemheacx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemngzwd.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcgaih.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemysngb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemaeyfv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdgebs.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembctcp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqpvaq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemscmyj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemoknhx.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrkrgm.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemotqss.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcrzec.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcucqo.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemeppck.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrpcnf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrpqpp.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxiywi.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzqpfz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemblwlq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgwurg.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdxzlq.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqchil.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemyjltv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrjasa.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemneyml.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempcjfg.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkidlf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhqqwf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxfrfh.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjseyg.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\Sysqemkpxrj.exe'
- '%TEMP%\Sysqemxjedp.exe'
- '%TEMP%\Sysqemyceat.exe'
- '%TEMP%\Sysqeminbke.exe'
- '%TEMP%\Sysqeminqzn.exe'
- '%TEMP%\Sysqemxcreu.exe'
- '%TEMP%\Sysqemixuhj.exe'
- '%TEMP%\Sysqemtrrqv.exe'
- '%TEMP%\Sysqemlruav.exe'
- '%TEMP%\Sysqemqooej.exe'
- '%TEMP%\Sysqemfbjro.exe'
- '%TEMP%\Sysqemvjvwq.exe'
- '%TEMP%\Sysqemiwbie.exe'
- '%TEMP%\Sysqemivboj.exe'
- '%TEMP%\Sysqemhkixp.exe'
- '%TEMP%\Sysqemxvfhu.exe'
- '%TEMP%\Sysqempghwc.exe'
- '%TEMP%\Sysqemhzsgi.exe'
- '%TEMP%\Sysqemmmdtc.exe'
- '%TEMP%\Sysqempguam.exe'
- '%TEMP%\Sysqempybar.exe'
- '%TEMP%\Sysqemawhvk.exe'
- '%TEMP%\Sysqemxphhv.exe'
- '%TEMP%\Sysqemfmrew.exe'
- '%TEMP%\Sysqemheacx.exe'
- '%TEMP%\Sysqemngzwd.exe'
- '%TEMP%\Sysqemcgaih.exe'
- '%TEMP%\Sysqemysngb.exe'
- '%TEMP%\Sysqemaeyfv.exe'
- '%TEMP%\Sysqemdgebs.exe'
- '%TEMP%\Sysqembctcp.exe'
- '%TEMP%\Sysqemqpvaq.exe'
- '%TEMP%\Sysqemscmyj.exe'
- '%TEMP%\Sysqemoknhx.exe'
- '%TEMP%\Sysqemrkrgm.exe'
- '%TEMP%\Sysqemotqss.exe'
- '%TEMP%\Sysqemcrzec.exe'
- '%TEMP%\Sysqemcucqo.exe'
- '%TEMP%\Sysqemeppck.exe'
- '%TEMP%\Sysqemrpcnf.exe'
- '%TEMP%\Sysqemrpqpp.exe'
- '%TEMP%\Sysqemxiywi.exe'
- '%TEMP%\Sysqemzqpfz.exe'
- '%TEMP%\Sysqemblwlq.exe'
- '%TEMP%\Sysqemgwurg.exe'
- '%TEMP%\Sysqemdxzlq.exe'
- '%TEMP%\Sysqemqchil.exe'
- '%TEMP%\Sysqemyjltv.exe'
- '%TEMP%\Sysqemrjasa.exe'
- '%TEMP%\Sysqemneyml.exe'
- '%TEMP%\Sysqempcjfg.exe'
- '%TEMP%\Sysqemkidlf.exe'
- '%TEMP%\Sysqemhqqwf.exe'
- '%TEMP%\Sysqemxfrfh.exe'
- '%TEMP%\Sysqemjseyg.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\Sysqemxjedp.exe
- %TEMP%\Sysqemyceat.exe
- %TEMP%\Sysqemixuhj.exe
- %TEMP%\Sysqemkpxrj.exe
- %TEMP%\Sysqeminbke.exe
- %TEMP%\Sysqeminqzn.exe
- %TEMP%\Sysqemxcreu.exe
- %TEMP%\Sysqemlruav.exe
- %TEMP%\Sysqemqooej.exe
- %TEMP%\Sysqemysngb.exe
- %TEMP%\Sysqemtrrqv.exe
- %TEMP%\Sysqemfbjro.exe
- %TEMP%\Sysqemvjvwq.exe
- %TEMP%\Sysqemiwbie.exe
- %TEMP%\Sysqemxvfhu.exe
- %TEMP%\Sysqempghwc.exe
- %TEMP%\Sysqempybar.exe
- %TEMP%\Sysqemhkixp.exe
- %TEMP%\Sysqemhzsgi.exe
- %TEMP%\Sysqemmmdtc.exe
- %TEMP%\Sysqempguam.exe
- %TEMP%\Sysqemxphhv.exe
- %TEMP%\Sysqemfmrew.exe
- %TEMP%\Sysqemivboj.exe
- %TEMP%\Sysqemawhvk.exe
- %TEMP%\Sysqemheacx.exe
- %TEMP%\Sysqemngzwd.exe
- %TEMP%\Sysqemcgaih.exe
- %TEMP%\Sysqemdxzlq.exe
- %TEMP%\Sysqembctcp.exe
- %TEMP%\Sysqemrkrgm.exe
- %TEMP%\Sysqemeppck.exe
- %TEMP%\Sysqemdgebs.exe
- %TEMP%\Sysqemscmyj.exe
- %TEMP%\Sysqemoknhx.exe
- %TEMP%\Sysqemaeyfv.exe
- %TEMP%\Sysqemcucqo.exe
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\qpath.ini
- %TEMP%\Sysqemcrzec.exe
- %TEMP%\Sysqemrpcnf.exe
- %TEMP%\Sysqemrpqpp.exe
- %TEMP%\Sysqemotqss.exe
- %TEMP%\Sysqemgwurg.exe
- %TEMP%\Sysqemrjasa.exe
- %TEMP%\Sysqemhqqwf.exe
- %TEMP%\Sysqemblwlq.exe
- %TEMP%\Sysqemqchil.exe
- %TEMP%\Sysqemyjltv.exe
- %TEMP%\Sysqemzqpfz.exe
- %TEMP%\Sysqemkidlf.exe
- %TEMP%\Sysqemxiywi.exe
- %TEMP%\Sysqemqpvaq.exe
- %TEMP%\Sysqempcjfg.exe
- %TEMP%\Sysqemxfrfh.exe
- %TEMP%\Sysqemjseyg.exe
- %TEMP%\Sysqemneyml.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\Sysqemxjedp.exe
- %TEMP%\Sysqemyceat.exe
- %TEMP%\Sysqemixuhj.exe
- %TEMP%\Sysqemkpxrj.exe
- %TEMP%\Sysqeminbke.exe
- %TEMP%\Sysqeminqzn.exe
- %TEMP%\Sysqemxcreu.exe
- %TEMP%\Sysqemlruav.exe
- %TEMP%\Sysqemqooej.exe
- %TEMP%\Sysqemysngb.exe
- %TEMP%\Sysqemtrrqv.exe
- %TEMP%\Sysqemfbjro.exe
- %TEMP%\Sysqemvjvwq.exe
- %TEMP%\Sysqemiwbie.exe
- %TEMP%\Sysqemxvfhu.exe
- %TEMP%\Sysqempghwc.exe
- %TEMP%\Sysqempybar.exe
- %TEMP%\Sysqemhkixp.exe
- %TEMP%\Sysqemhzsgi.exe
- %TEMP%\Sysqemmmdtc.exe
- %TEMP%\Sysqempguam.exe
- %TEMP%\Sysqemxphhv.exe
- %TEMP%\Sysqemfmrew.exe
- %TEMP%\Sysqemivboj.exe
- %TEMP%\Sysqemawhvk.exe
- %TEMP%\Sysqemheacx.exe
- %TEMP%\Sysqemngzwd.exe
- %TEMP%\Sysqemcgaih.exe
- %TEMP%\Sysqemdgebs.exe
- %TEMP%\Sysqembctcp.exe
- %TEMP%\Sysqemrkrgm.exe
- %TEMP%\Sysqemaeyfv.exe
- %TEMP%\Sysqemqpvaq.exe
- %TEMP%\Sysqemscmyj.exe
- %TEMP%\Sysqemoknhx.exe
- %TEMP%\Sysqemcrzec.exe
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\Sysqemcucqo.exe
- %TEMP%\Sysqemotqss.exe
- %TEMP%\Sysqemeppck.exe
- %TEMP%\Sysqemrpcnf.exe
- %TEMP%\Sysqemrpqpp.exe
- %TEMP%\Sysqemblwlq.exe
- %TEMP%\Sysqemgwurg.exe
- %TEMP%\Sysqemrjasa.exe
- %TEMP%\Sysqemzqpfz.exe
- %TEMP%\Sysqemdxzlq.exe
- %TEMP%\Sysqemqchil.exe
- %TEMP%\Sysqemyjltv.exe
- %TEMP%\Sysqempcjfg.exe
- %TEMP%\Sysqemkidlf.exe
- %TEMP%\Sysqemxiywi.exe
- %TEMP%\Sysqemneyml.exe
- %TEMP%\Sysqemhqqwf.exe
- %TEMP%\Sysqemxfrfh.exe
- %TEMP%\Sysqemjseyg.exe
