Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\tmp3138.exe'
- '%TEMP%\tmp1794.exe'
- '%TEMP%\tmp5198.exe' /pid=3856
- '%TEMP%\tmp2726.exe'
- '%TEMP%\tmp1153.exe' /pid=3184
- '%TEMP%\tmp3728.exe' /pid=3376
- '%TEMP%\tmp7112.exe'
- '%TEMP%\tmp2855.exe'
- '%TEMP%\tmp5525.exe'
- '%TEMP%\tmp2051.exe'
- '%TEMP%\tmp9580.exe' /pid=2216
- '%TEMP%\tmp8988.exe'
- '%TEMP%\tmp9901.exe'
- '%TEMP%\tmp6486.exe'
- '%TEMP%\tmp1005.exe'
- '%TEMP%\tmp8973.exe'
- '%TEMP%\tmp5058.exe'
- '%TEMP%\tmp6892.exe'
- '%TEMP%\tmp5871.exe'
- '%TEMP%\tmp5782.exe'
- '%TEMP%\tmp2368.exe'
- '%TEMP%\tmp8720.exe'
- '%TEMP%\tmp3403.exe' /pid=3084
- '%TEMP%\tmp7573.exe'
- '%TEMP%\tmp2664.exe'
- '%TEMP%\tmp2841.exe'
- '%TEMP%\tmp2311.exe'
- '%TEMP%\tmp2753.exe'
- '%TEMP%\tmp6164.exe'
- '%TEMP%\tmp1909.exe'
- '%TEMP%\tmp2160.exe' /pid=3316
- '%TEMP%\tmp1949.exe'
- '%TEMP%\tmp7064.exe' /pid=2960
- '%TEMP%\tmp9896.exe'
- '%TEMP%\tmp6873.exe' /pid=2904
- '%TEMP%\tmp7767.exe'
- '%TEMP%\tmp9091.exe' /pid=3956
- '%TEMP%\tmp1666.exe'
- '%TEMP%\tmp2885.exe' /pid=2416
- '%TEMP%\tmp6513.exe'
- '%TEMP%\tmp8789.exe'
- '%TEMP%\tmp2930.exe'
- '%TEMP%\tmp3138.exe' /pid=3704
- '%TEMP%\tmp6400.exe'
- '%TEMP%\tmp9983.exe'
- '%TEMP%\tmp1024.exe'
- '%TEMP%\tmp5016.exe'
- '%TEMP%\tmp7047.exe'
- '%TEMP%\tmp2160.exe'
- '%TEMP%\tmp7227.exe' /pid=3160
- '%TEMP%\tmp5194.exe' /pid=2516
- '%TEMP%\tmp5843.exe'
- '%TEMP%\tmp6285.exe'
- '%TEMP%\tmp1947.exe'
- '%TEMP%\tmp8178.exe'
- '%TEMP%\tmp2386.exe' /pid=3984
- '%TEMP%\tmp9091.exe'
- '%TEMP%\tmp5271.exe'
- '%TEMP%\tmp3701.exe'
- '%TEMP%\tmp2386.exe'
- '%TEMP%\tmp3270.exe'
- '%TEMP%\tmp2975.exe'
- '%TEMP%\tmp7478.exe'
- '%TEMP%\tmp8676.exe'
- '%TEMP%\tmp2062.exe'
- '%TEMP%\tmp9905.exe'
- '%TEMP%\tmp2633.exe'
- '%TEMP%\tmp2604.exe'
- '%TEMP%\tmp1436.exe'
- '%TEMP%\tmp5154.exe'
- '%TEMP%\tmp9580.exe'
- '%TEMP%\tmp5194.exe'
- '%TEMP%\tmp7064.exe'
- '%TEMP%\tmp2991.exe'
- '%TEMP%\tmp3403.exe'
- '%TEMP%\tmp5837.exe'
- '%TEMP%\tmp2126.exe'
- '%TEMP%\tmp7240.exe'
- '%TEMP%\tmp4610.exe'
- '%TEMP%\tmp3768.exe'
- '%TEMP%\tmp4681.exe'
- '%TEMP%\tmp5594.exe'
- '%TEMP%\tmp2885.exe'
- '%TEMP%\tmp5789.exe'
- '%TEMP%\tmp6515.exe'
- '%TEMP%\tmp3728.exe'
- '%TEMP%\tmp6873.exe'
- '%TEMP%\tmp6750.exe'
- '%TEMP%\tmp5877.exe'
- '%TEMP%\tmp9017.exe'
- '%TEMP%\tmp8879.exe'
- '%TEMP%\tmp5198.exe'
- '%TEMP%\tmp4826.exe'
- '%TEMP%\tmp6994.exe'
- '%TEMP%\tmp3789.exe'
- '%TEMP%\tmp5789.exe' /pid=3096
- '%TEMP%\tmp2916.exe'
- '%TEMP%\tmp1522.exe'
- '%TEMP%\tmp2325.exe'
- '%TEMP%\tmp1482.exe'
- '%TEMP%\tmp7380.exe'
- '%TEMP%\tmp1682.exe'
- '%TEMP%\tmp1153.exe'
- '%TEMP%\tmp2880.exe'
- '%TEMP%\tmp7227.exe'
- '%TEMP%\tmp9542.exe'
- '%TEMP%\tmp2271.exe'
- '%TEMP%\tmp5837.exe' /pid=2988
- '%TEMP%\tmp8387.exe'
- '%TEMP%\tmp5594.exe' /pid=3628
- '%TEMP%\tmp4786.exe'
- '%TEMP%\tmp2489.exe'
- '%TEMP%\tmp1379.exe'
- '%TEMP%\tmp3421.exe'
- '%TEMP%\tmp5589.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\tmp3138.exe
- %TEMP%\tmp1794.exe
- %TEMP%\tmp2707.exe
- %TEMP%\tmp2726.exe
- %TEMP%\tmp7573.exe
- %TEMP%\tmp8957.exe
- %TEMP%\tmp7112.exe
- %TEMP%\tmp2855.exe
- %TEMP%\tmp5525.exe
- %TEMP%\tmp8194.exe
- %TEMP%\tmp6486.exe
- %TEMP%\tmp6348.exe
- %TEMP%\tmp8988.exe
- %TEMP%\tmp9901.exe
- %TEMP%\tmp1988.exe
- %TEMP%\tmp9562.exe
- %TEMP%\tmp1005.exe
- %TEMP%\tmp8973.exe
- %TEMP%\tmp6892.exe
- %TEMP%\tmp5782.exe
- %TEMP%\tmp2368.exe
- %TEMP%\tmp8737.exe
- %TEMP%\tmp2664.exe
- %TEMP%\tmp8720.exe
- %TEMP%\tmp4618.exe
- %TEMP%\tmp2753.exe
- %TEMP%\tmp5058.exe
- %TEMP%\tmp2841.exe
- %TEMP%\tmp2311.exe
- %TEMP%\tmp2051.exe
- %TEMP%\tmp1949.exe
- %TEMP%\tmp8789.exe
- %TEMP%\tmp2930.exe
- %TEMP%\tmp6522.exe
- %TEMP%\tmp9896.exe
- %TEMP%\tmp7767.exe
- %TEMP%\tmp1909.exe
- %TEMP%\tmp1666.exe
- %TEMP%\tmp3550.exe
- %TEMP%\tmp7976.exe
- %TEMP%\tmp8466.exe
- %TEMP%\tmp2087.exe
- %TEMP%\tmp6513.exe
- %TEMP%\tmp8555.exe
- %TEMP%\tmp6285.exe
- %TEMP%\tmp6400.exe
- %TEMP%\tmp2799.exe
- %TEMP%\tmp9983.exe
- %TEMP%\tmp5016.exe
- %TEMP%\tmp6164.exe
- %TEMP%\tmp7047.exe
- %TEMP%\tmp2160.exe
- %TEMP%\tmp1947.exe
- %TEMP%\tmp7658.exe
- %TEMP%\tmp5843.exe
- %TEMP%\tmp9091.exe
- %TEMP%\tmp8639.exe
- %TEMP%\tmp1024.exe
- %TEMP%\tmp8178.exe
- %TEMP%\tmp2386.exe
- %TEMP%\tmp3270.exe
- %TEMP%\tmp5154.exe
- %TEMP%\tmp3701.exe
- %TEMP%\tmp8676.exe
- %TEMP%\tmp2062.exe
- %TEMP%\tmp2975.exe
- %TEMP%\tmp2633.exe
- %TEMP%\tmp2604.exe
- %TEMP%\tmp6873.exe
- %TEMP%\tmp9905.exe
- %TEMP%\tmp9580.exe
- %TEMP%\tmp5194.exe
- %TEMP%\tmp1436.exe
- %TEMP%\tmp7478.exe
- %TEMP%\tmp7064.exe
- %TEMP%\tmp2991.exe
- %TEMP%\tmp3403.exe
- %TEMP%\tmp5837.exe
- %TEMP%\tmp2126.exe
- %TEMP%\tmp7240.exe
- %TEMP%\tmp4610.exe
- %TEMP%\tmp3768.exe
- %TEMP%\tmp4681.exe
- %TEMP%\tmp5594.exe
- %TEMP%\tmp2885.exe
- %TEMP%\tmp5789.exe
- %TEMP%\tmp6515.exe
- %TEMP%\tmp3728.exe
- %TEMP%\tmp9542.exe
- %TEMP%\tmp1501.exe
- %TEMP%\tmp2325.exe
- %TEMP%\tmp1482.exe
- %TEMP%\tmp6388.exe
- %TEMP%\tmp6750.exe
- %TEMP%\tmp5877.exe
- %TEMP%\tmp9017.exe
- %TEMP%\tmp2916.exe
- %TEMP%\tmp5271.exe
- %TEMP%\tmp5871.exe
- %TEMP%\tmp3789.exe
- %TEMP%\tmp7380.exe
- %TEMP%\tmp1522.exe
- %TEMP%\tmp7891.exe
- %TEMP%\tmp8879.exe
- %TEMP%\tmp2880.exe
- %TEMP%\tmp1379.exe
- %TEMP%\tmp3421.exe
- %TEMP%\tmp1153.exe
- %TEMP%\tmp2271.exe
- %TEMP%\tmp7227.exe
- %TEMP%\tmp1682.exe
- %TEMP%\tmp5198.exe
- %TEMP%\tmp4826.exe
- %TEMP%\tmp6994.exe
- %TEMP%\tmp4786.exe
- %TEMP%\tmp5589.exe
- %TEMP%\tmp2489.exe
- %TEMP%\tmp8387.exe
