Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%HOMEPATH%\My Documents\rwp20mkz.3in\mbl3b0t0.if0'
- '%HOMEPATH%\My Documents\lxhyyubr.r2w\tnuxfpon.qun' +H "%HOMEPATH%\My Documents\rwp20mkz.3in"
- '%HOMEPATH%\My Documents\omogckfz.qpr\kkzxbl1w.jga'
- '%HOMEPATH%\My Documents\zmvegsot.wrb\ylt4upgz.pgc' /c Attrib +H "%HOMEPATH%\My Documents\o3bzrs1a.5oq"
- '%HOMEPATH%\My Documents\kp55t1zl.2ia\djle5ads.br0' +H "%HOMEPATH%\My Documents\4od5hvnw.a0z"
- '%HOMEPATH%\My Documents\kk5kutnb.qgb\4t0waqw3.kma' /c Attrib +H "%HOMEPATH%\My Documents\4od5hvnw.a0z"
- '%HOMEPATH%\My Documents\5anngiey.ulw\vuetwww2.zvj' /pid=3128
- '%HOMEPATH%\My Documents\zmvegsot.wrb\ylt4upgz.pgc'
- '%HOMEPATH%\My Documents\b1p0qwfz.dfl\aw1i3o1z.fqp' /pid=3344
- '%HOMEPATH%\My Documents\xyt2fxxj.gdh\ryfug1xz.2ya'
- '%HOMEPATH%\My Documents\2i4gu1zz.4bs\4piyduce.3n2'
- '%HOMEPATH%\My Documents\gi4ciz1p.nyt\5ljtlmrz.cht'
- '%HOMEPATH%\My Documents\egxgbeqt.qyr\p3djhaox.itt'
- '%HOMEPATH%\My Documents\a5hojxvv.kiv\j5ufe1pz.ynb'
- '%HOMEPATH%\My Documents\m1fkvskg.xu3\qlmb4fut.mlw'
- '%HOMEPATH%\My Documents\kk5kutnb.qgb\4t0waqw3.kma' /c Attrib +H "%HOMEPATH%\My Documents\m1fkvskg.xu3"
- '%HOMEPATH%\My Documents\yonyxcos.nnb\5c3mencu.tou'
- '%HOMEPATH%\My Documents\de0fkk5y.ufw\p3k2oy01.zvq' +H "%HOMEPATH%\My Documents\yonyxcos.nnb"
- '%HOMEPATH%\My Documents\ws5zgcr1.v32\xqfqx23v.npq'
- '%HOMEPATH%\My Documents\cchj4ck2.wxm\yji5vl03.1w0'
- '%HOMEPATH%\My Documents\jx3ydvkp.xhu\x1vn2rih.bgw' /pid=2584
- '%HOMEPATH%\My Documents\dzrnvjnw.hw4\hq40hnux.hn0'
- '%HOMEPATH%\My Documents\o3bzrs1a.5oq\h0trgptf.zdk'
- '%HOMEPATH%\My Documents\kp55t1zl.2ia\djle5ads.br0' +H "%HOMEPATH%\My Documents\ybzjjeau.mlm"
- '%HOMEPATH%\My Documents\ybzjjeau.mlm\3fq2wuvr.vdz'
- '%HOMEPATH%\My Documents\5cf40zxd.l4n\vzt0cved.uxu'
- '%HOMEPATH%\My Documents\vyxkq25l.vya\o1yk5nqw.gu0'
- '%HOMEPATH%\My Documents\5anngiey.ulw\vuetwww2.zvj'
- '%HOMEPATH%\My Documents\31nx1b0f.kbq\55oligyw.ee5'
- '%HOMEPATH%\My Documents\1efoafqb.wju\ypf0gtwh.43i'
- '%HOMEPATH%\My Documents\de0fkk5y.ufw\p3k2oy01.zvq'
- '%HOMEPATH%\My Documents\tglvgqfe.jm1\3c51o2ev.dsq' /pid=3784
- '%HOMEPATH%\My Documents\kp55t1zl.2ia\djle5ads.br0'
- '%HOMEPATH%\My Documents\e00jrjrn.qhk\dw21aw13.5ve'
- '%HOMEPATH%\My Documents\tglvgqfe.jm1\3c51o2ev.dsq'
- '%HOMEPATH%\My Documents\njnmlu1a.ugl\miyzceuw.nhh'
- '%HOMEPATH%\My Documents\qvmjccnn.ic5\hms5uhv0.h2l'
- '%HOMEPATH%\My Documents\mi13xeq0.0tn\10wrcrpm.rtx'
- '%HOMEPATH%\My Documents\asabq2kx.zfl\x1imjrzx.5sg'
- '%HOMEPATH%\My Documents\0ahj4xmx.4tu\rtcfy22x.l2d'
- '%HOMEPATH%\My Documents\b1p0qwfz.dfl\aw1i3o1z.fqp'
- '%HOMEPATH%\My Documents\kk5kutnb.qgb\4t0waqw3.kma'
- '%HOMEPATH%\My Documents\fwzvacqg.o34\rnna1jb3.s5r'
- '%HOMEPATH%\My Documents\etahjki2.es4\tc50pzze.m4u'
- '%HOMEPATH%\My Documents\njnmlu1a.ugl\miyzceuw.nhh' /pid=4080
- '%HOMEPATH%\My Documents\jx3ydvkp.xhu\x1vn2rih.bgw'
- '%HOMEPATH%\My Documents\2ykq3vge.xj1\wupocxyo.bqs'
- '%HOMEPATH%\My Documents\kho5cywt.psk\kzd1e0fu.eou'
- '%HOMEPATH%\My Documents\e00jrjrn.qhk\dw21aw13.5ve' /pid=3332
- '%HOMEPATH%\My Documents\j02pv4im.ogc\jactgnyt.iz3'
- '%HOMEPATH%\My Documents\rvcxm5u4.agr\bzhqup15.ebu'
- '%HOMEPATH%\My Documents\ca2tptg0.ryt\1bmk5kgt.xzc'
- '%HOMEPATH%\My Documents\lxhyyubr.r2w\tnuxfpon.qun'
Запускает на исполнение:
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\gi4ciz1p.nyt"
- '<SYSTEM32>\attrib.exe' /pid=3028
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\egxgbeqt.qyr"
- '<SYSTEM32>\attrib.exe' /pid=3092
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\omogckfz.qpr"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\2i4gu1zz.4bs"
- '<SYSTEM32>\attrib.exe' /pid=2696
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\5ecu0aah.k0o"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\vyxkq25l.vya"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\zmvegsot.wrb"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\xyt2fxxj.gdh"
- '<SYSTEM32>\attrib.exe' /c Attrib +H "%HOMEPATH%\My Documents\xyt2fxxj.gdh"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\m1fkvskg.xu3"
- '<SYSTEM32>\attrib.exe' /pid=3108
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\cchj4ck2.wxm"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\ws5zgcr1.v32"
- '<SYSTEM32>\attrib.exe' /c Attrib +H "%HOMEPATH%\My Documents\ws5zgcr1.v32"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\a5hojxvv.kiv"
- '<SYSTEM32>\attrib.exe' /pid=3288
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\o3bzrs1a.5oq"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\ydigi34l.hxz"
- '<SYSTEM32>\attrib.exe' /pid=3132
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\5cf40zxd.l4n"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\dzrnvjnw.hw4"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\etahjki2.es4"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\31nx1b0f.kbq"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\1efoafqb.wju"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\e00jrjrn.qhk"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\de0fkk5y.ufw"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\kp55t1zl.2ia"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\5anngiey.ulw"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\tglvgqfe.jm1"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\njnmlu1a.ugl"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\qvmjccnn.ic5"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\mi13xeq0.0tn"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\asabq2kx.zfl"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\0ahj4xmx.4tu"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\fwzvacqg.o34"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\2ykq3vge.xj1"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\kp5qdsxe.vx2"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\jx3ydvkp.xhu"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\b1p0qwfz.dfl"
- '<SYSTEM32>\attrib.exe' /pid=2560
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\lxhyyubr.r2w"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\kho5cywt.psk"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\j02pv4im.ogc"
- '<SYSTEM32>\attrib.exe'
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\rvcxm5u4.agr"
- '<SYSTEM32>\attrib.exe' +H "%HOMEPATH%\My Documents\ca2tptg0.ryt"
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\attrib.exe
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\My Documents\gi4ciz1p.nyt\5ljtlmrz.cht
- %HOMEPATH%\My Documents\egxgbeqt.qyr\p3djhaox.itt
- %HOMEPATH%\My Documents\2i4gu1zz.4bs\4piyduce.3n2
- %HOMEPATH%\My Documents\rwp20mkz.3in\mbl3b0t0.if0
- %HOMEPATH%\My Documents\omogckfz.qpr\kkzxbl1w.jga
- %HOMEPATH%\My Documents\14f5lp4i.nae\coid4pcl.vmc
- %HOMEPATH%\My Documents\vyxkq25l.vya\o1yk5nqw.gu0
- %HOMEPATH%\My Documents\etahjki2.es4\tc50pzze.m4u
- %HOMEPATH%\My Documents\5ecu0aah.k0o\noub0geq.azl
- %HOMEPATH%\My Documents\zmvegsot.wrb\ylt4upgz.pgc
- %HOMEPATH%\My Documents\xyt2fxxj.gdh\ryfug1xz.2ya
- %HOMEPATH%\My Documents\ydigi34l.hxz\rbyastwm.o44
- %HOMEPATH%\My Documents\a5hojxvv.kiv\j5ufe1pz.ynb
- %HOMEPATH%\My Documents\m1fkvskg.xu3\qlmb4fut.mlw
- %HOMEPATH%\My Documents\ws5zgcr1.v32\xqfqx23v.npq
- %HOMEPATH%\My Documents\310du1p4.noh\0kcdusct.gv2
- %HOMEPATH%\My Documents\yonyxcos.nnb\5c3mencu.tou
- %HOMEPATH%\My Documents\cchj4ck2.wxm\yji5vl03.1w0
- %HOMEPATH%\My Documents\o3bzrs1a.5oq\h0trgptf.zdk
- %HOMEPATH%\My Documents\4od5hvnw.a0z\qlwtt22b.0wn
- %HOMEPATH%\My Documents\dzrnvjnw.hw4\hq40hnux.hn0
- %HOMEPATH%\My Documents\ybzjjeau.mlm\3fq2wuvr.vdz
- %HOMEPATH%\My Documents\5cf40zxd.l4n\vzt0cved.uxu
- %HOMEPATH%\My Documents\1efoafqb.wju\ypf0gtwh.43i
- %HOMEPATH%\My Documents\e00jrjrn.qhk\dw21aw13.5ve
- %HOMEPATH%\My Documents\31nx1b0f.kbq\55oligyw.ee5
- %HOMEPATH%\My Documents\kp55t1zl.2ia\djle5ads.br0
- %HOMEPATH%\My Documents\5anngiey.ulw\vuetwww2.zvj
- %HOMEPATH%\My Documents\mi13xeq0.0tn\10wrcrpm.rtx
- %HOMEPATH%\My Documents\njnmlu1a.ugl\miyzceuw.nhh
- %HOMEPATH%\My Documents\qvmjccnn.ic5\hms5uhv0.h2l
- %HOMEPATH%\My Documents\tglvgqfe.jm1\3c51o2ev.dsq
- %HOMEPATH%\My Documents\asabq2kx.zfl\x1imjrzx.5sg
- %HOMEPATH%\My Documents\0ahj4xmx.4tu\rtcfy22x.l2d
- %HOMEPATH%\My Documents\de0fkk5y.ufw\p3k2oy01.zvq
- %HOMEPATH%\My Documents\fwzvacqg.o34\rnna1jb3.s5r
- %HOMEPATH%\My Documents\2ykq3vge.xj1\wupocxyo.bqs
- %HOMEPATH%\My Documents\kk5kutnb.qgb\4t0waqw3.kma
- %HOMEPATH%\My Documents\jx3ydvkp.xhu\x1vn2rih.bgw
- %HOMEPATH%\My Documents\b1p0qwfz.dfl\aw1i3o1z.fqp
- %HOMEPATH%\My Documents\kp5qdsxe.vx2\ns0i552z.ylg
- %HOMEPATH%\My Documents\kho5cywt.psk\kzd1e0fu.eou
- %HOMEPATH%\My Documents\j02pv4im.ogc\jactgnyt.iz3
- %HOMEPATH%\My Documents\lxhyyubr.r2w\tnuxfpon.qun
- %HOMEPATH%\My Documents\rvcxm5u4.agr\bzhqup15.ebu
- %HOMEPATH%\My Documents\ca2tptg0.ryt\1bmk5kgt.xzc
