Техническая информация
Вредоносные функции:
Запускает на исполнение:
- 'C:\prog\gans\vir1\cheat.exe'
- '<SYSTEM32>\taskkill.exe' /F /IM explorer.exe
- '<SYSTEM32>\cmd.exe' /c ""C:\prog\gans\vir1\start.bat" "
Завершает или пытается завершить
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- C:\prog\gans\vir1\70_cheat.exe
- C:\prog\gans\vir1\71_cheat.exe
- C:\prog\gans\vir1\72_cheat.exe
- C:\prog\gans\vir1\67_cheat.exe
- C:\prog\gans\vir1\68_cheat.exe
- C:\prog\gans\vir1\69_cheat.exe
- C:\prog\gans\vir1\76_cheat.exe
- C:\prog\gans\vir1\77_cheat.exe
- C:\prog\gans\vir1\78_cheat.exe
- C:\prog\gans\vir1\73_cheat.exe
- C:\prog\gans\vir1\74_cheat.exe
- C:\prog\gans\vir1\75_cheat.exe
- C:\prog\gans\vir1\66_cheat.exe
- C:\prog\gans\vir1\57_cheat.exe
- C:\prog\gans\vir1\58_cheat.exe
- C:\prog\gans\vir1\59_cheat.exe
- C:\prog\gans\vir1\54_cheat.exe
- C:\prog\gans\vir1\55_cheat.exe
- C:\prog\gans\vir1\56_cheat.exe
- C:\prog\gans\vir1\63_cheat.exe
- C:\prog\gans\vir1\64_cheat.exe
- C:\prog\gans\vir1\65_cheat.exe
- C:\prog\gans\vir1\60_cheat.exe
- C:\prog\gans\vir1\61_cheat.exe
- C:\prog\gans\vir1\62_cheat.exe
- C:\prog\gans\vir1\79_cheat.exe
- C:\prog\gans\vir1\96_cheat.exe
- C:\prog\gans\vir1\97_cheat.exe
- C:\prog\gans\vir1\98_cheat.exe
- C:\prog\gans\vir1\93_cheat.exe
- C:\prog\gans\vir1\94_cheat.exe
- C:\prog\gans\vir1\95_cheat.exe
- C:\prog\gans\vir1\1_cheat.exe
- C:\prog\gans\vir1\2_cheat.exe
- C:\prog\gans\vir1\cheat.exe
- C:\prog\gans\vir1\99_cheat.exe
- C:\prog\gans\vir1\100_cheat.exe
- C:\prog\gans\vir1\start.bat
- C:\prog\gans\vir1\92_cheat.exe
- C:\prog\gans\vir1\83_cheat.exe
- C:\prog\gans\vir1\84_cheat.exe
- C:\prog\gans\vir1\85_cheat.exe
- C:\prog\gans\vir1\80_cheat.exe
- C:\prog\gans\vir1\81_cheat.exe
- C:\prog\gans\vir1\82_cheat.exe
- C:\prog\gans\vir1\89_cheat.exe
- C:\prog\gans\vir1\90_cheat.exe
- C:\prog\gans\vir1\91_cheat.exe
- C:\prog\gans\vir1\86_cheat.exe
- C:\prog\gans\vir1\87_cheat.exe
- C:\prog\gans\vir1\88_cheat.exe
- C:\prog\gans\vir1\19_cheat.exe
- C:\prog\gans\vir1\20_cheat.exe
- C:\prog\gans\vir1\21_cheat.exe
- C:\prog\gans\vir1\16_cheat.exe
- C:\prog\gans\vir1\17_cheat.exe
- C:\prog\gans\vir1\18_cheat.exe
- C:\prog\gans\vir1\25_cheat.exe
- C:\prog\gans\vir1\26_cheat.exe
- C:\prog\gans\vir1\27_cheat.exe
- C:\prog\gans\vir1\22_cheat.exe
- C:\prog\gans\vir1\23_cheat.exe
- C:\prog\gans\vir1\24_cheat.exe
- C:\prog\gans\vir1\15_cheat.exe
- C:\prog\gans\vir1\6_cheat.exe
- C:\prog\gans\vir1\7_cheat.exe
- C:\prog\gans\vir1\8_cheat.exe
- C:\prog\gans\vir1\3_cheat.exe
- C:\prog\gans\vir1\4_cheat.exe
- C:\prog\gans\vir1\5_cheat.exe
- C:\prog\gans\vir1\12_cheat.exe
- C:\prog\gans\vir1\13_cheat.exe
- C:\prog\gans\vir1\14_cheat.exe
- C:\prog\gans\vir1\9_cheat.exe
- C:\prog\gans\vir1\10_cheat.exe
- C:\prog\gans\vir1\11_cheat.exe
- C:\prog\gans\vir1\28_cheat.exe
- C:\prog\gans\vir1\45_cheat.exe
- C:\prog\gans\vir1\46_cheat.exe
- C:\prog\gans\vir1\47_cheat.exe
- C:\prog\gans\vir1\42_cheat.exe
- C:\prog\gans\vir1\43_cheat.exe
- C:\prog\gans\vir1\44_cheat.exe
- C:\prog\gans\vir1\51_cheat.exe
- C:\prog\gans\vir1\52_cheat.exe
- C:\prog\gans\vir1\53_cheat.exe
- C:\prog\gans\vir1\48_cheat.exe
- C:\prog\gans\vir1\49_cheat.exe
- C:\prog\gans\vir1\50_cheat.exe
- C:\prog\gans\vir1\41_cheat.exe
- C:\prog\gans\vir1\32_cheat.exe
- C:\prog\gans\vir1\33_cheat.exe
- C:\prog\gans\vir1\34_cheat.exe
- C:\prog\gans\vir1\29_cheat.exe
- C:\prog\gans\vir1\30_cheat.exe
- C:\prog\gans\vir1\31_cheat.exe
- C:\prog\gans\vir1\38_cheat.exe
- C:\prog\gans\vir1\39_cheat.exe
- C:\prog\gans\vir1\40_cheat.exe
- C:\prog\gans\vir1\35_cheat.exe
- C:\prog\gans\vir1\36_cheat.exe
- C:\prog\gans\vir1\37_cheat.exe
Другое:
Ищет следующие окна:
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
