Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\Fed-750276'
- '%TEMP%\Fed-281266' /pid=3212
- '%TEMP%\Fed-125266' /pid=3028
- '%TEMP%\Fed-218276'
- '%TEMP%\Fed-437276'
- '%TEMP%\Fed-687286'
- '%TEMP%\Fed-562286'
- '%TEMP%\Fed-875276'
- '%TEMP%\Fed-734276'
- '%TEMP%\Fed-453276'
- '%TEMP%\Fed-687276'
- '%TEMP%\Fed-0276'
- '%TEMP%\Fed-578276'
- '%TEMP%\Fed-375276'
- '%TEMP%\Fed-828266'
- '%TEMP%\Fed-765276'
- '%TEMP%\Fed-328276'
- '%TEMP%\Fed-671276'
- '%TEMP%\Fed-953266' /pid=3892
- '%TEMP%\Fed-109276'
- '%TEMP%\Fed-812276'
- '%TEMP%\Fed-968286'
- '%TEMP%\Fed-578276' /pid=3828
- '%TEMP%\Fed-812286'
- '%TEMP%\Fed-906286'
- '%TEMP%\Fed-375276' /pid=3416
- '%TEMP%\Fed-156286'
- '%TEMP%\Fed-546286'
- '%TEMP%\Fed-921286'
- '%TEMP%\Fed-562286' /pid=3724
- '%TEMP%\Fed-484286'
- '%TEMP%\Fed-859266' /pid=3120
- '%TEMP%\Fed-359266' /pid=288
- '%TEMP%\Fed-578286'
- '%TEMP%\Fed-390286'
- '%TEMP%\Fed-296286'
- '%TEMP%\Fed-93286'
- '%TEMP%\Fed-187286'
- '%TEMP%\Fed-515266' /pid=3160
- '%TEMP%\Fed-46286'
- '%TEMP%\Fed-765286'
- '%TEMP%\Fed-828266' /pid=2780
- '%TEMP%\Fed-718256' /pid=2712
- '%TEMP%\Fed-609256'
- '%TEMP%\Fed-328256'
- '%TEMP%\Fed-828256'
- '%TEMP%\Fed-78256'
- '%TEMP%\Fed-781256'
- '%TEMP%\Fed-578256'
- '%TEMP%\Fed-718256'
- '%TEMP%\Fed-968256'
- '%TEMP%\Fed-171256'
- '%TEMP%\Fed-62256'
- '%TEMP%\Fed-875256'
- '%TEMP%\Fed-0256'
- '%TEMP%\Fed-812256'
- '%TEMP%\Fed-421256'
- '%TEMP%\Fed-156256'
- '%TEMP%\Fed-593256'
- '%TEMP%\Fed-984256'
- '%TEMP%\Fed-906256'
- '%TEMP%\Fed-46256'
- '%TEMP%\Fed-640256'
- '%TEMP%\Fed-203256'
- '%TEMP%\Fed-953266'
- '%TEMP%\Fed-46266'
- '%TEMP%\Fed-875266'
- '%TEMP%\Fed-703266'
- '%TEMP%\Fed-78266'
- '%TEMP%\Fed-890266'
- '%TEMP%\Fed-500266'
- '%TEMP%\Fed-359266'
- '%TEMP%\Fed-437266'
- '%TEMP%\Fed-968266'
- '%TEMP%\Fed-468266'
- '%TEMP%\Fed-578266'
- '%TEMP%\Fed-718266'
- '%TEMP%\Fed-343266'
- '%TEMP%\Fed-125256'
- '%TEMP%\Fed-125266'
- '%TEMP%\Fed-31266'
- '%TEMP%\Fed-265266'
- '%TEMP%\Fed-859266'
- '%TEMP%\Fed-515266'
- '%TEMP%\Fed-281266'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\Fed-78276
- %TEMP%\Fed-687276
- %TEMP%\Fed-671276
- %TEMP%\Fed-328276
- %TEMP%\Fed-828276
- %TEMP%\Fed-734276
- %TEMP%\Fed-453276
- %TEMP%\Fed-281276
- %TEMP%\Fed-218276
- %TEMP%\Fed-437276
- %TEMP%\Fed-375276
- %TEMP%\Fed-750276
- %TEMP%\Fed-765276
- %TEMP%\Fed-828266
- %TEMP%\Fed-62266
- %TEMP%\Fed-109276
- %TEMP%\Fed-812276
- %TEMP%\Fed-578276
- %TEMP%\Fed-125276
- %TEMP%\Fed-0276
- %TEMP%\Fed-875276
- %TEMP%\Fed-437286
- %TEMP%\Fed-906286
- %TEMP%\Fed-968286
- %TEMP%\Fed-46286
- %TEMP%\Fed-187286
- %TEMP%\Fed-156286
- %TEMP%\Fed-546286
- %TEMP%\Fed-921286
- %TEMP%\Fed-812286
- %TEMP%\Fed-484286
- %TEMP%\Fed-0286
- %TEMP%\Fed-296286
- %TEMP%\Fed-562286
- %TEMP%\Fed-62286
- %TEMP%\Fed-687286
- %TEMP%\Fed-765286
- %TEMP%\Fed-937286
- %TEMP%\Fed-578286
- %TEMP%\Fed-93286
- %TEMP%\Fed-390286
- %TEMP%\Fed-500266
- %TEMP%\Fed-828256
- %TEMP%\Fed-609256
- %TEMP%\Fed-781256
- %TEMP%\Fed-875256
- %TEMP%\Fed-78256
- %TEMP%\Fed-968256
- %TEMP%\Fed-578256
- %TEMP%\Fed-62256
- %TEMP%\Fed-328256
- %TEMP%\Fed-171256
- %TEMP%\Fed-0256
- %TEMP%\Fed-812256
- %TEMP%\Fed-421256
- %TEMP%\Fed-156256
- %TEMP%\Fed-593256
- %TEMP%\Fed-984256
- %TEMP%\Fed-906256
- %TEMP%\Fed-46256
- %TEMP%\Fed-640256
- %TEMP%\Fed-203256
- %TEMP%\Fed-718256
- %TEMP%\Fed-875266
- %TEMP%\Fed-953266
- %TEMP%\Fed-78266
- %TEMP%\Fed-468266
- %TEMP%\Fed-703266
- %TEMP%\Fed-359266
- %TEMP%\Fed-890266
- %TEMP%\Fed-968266
- %TEMP%\Fed-46266
- %TEMP%\Fed-437266
- %TEMP%\Fed-578266
- %TEMP%\Fed-718266
- %TEMP%\Fed-343266
- %TEMP%\Fed-125256
- %TEMP%\Fed-125266
- %TEMP%\Fed-31266
- %TEMP%\Fed-265266
- %TEMP%\Fed-859266
- %TEMP%\Fed-515266
- %TEMP%\Fed-281266
