Техническая информация
Вредоносные функции:
Скрывает следующие процессы:
- <Полный путь к вирусу>
Изменения в файловой системе:
Создает следующие файлы:
- <Текущая директория>\h323piltqyd.sys
- %TEMP%\qpgcvdtbwl.dll
Удаляет следующие файлы:
- <Текущая директория>\h323piltqyd.sys
Сетевая активность:
Подключается к:
- 'hi.##idu.com':80
- 'localhost':1037
TCP:
Запросы HTTP GET:
- hi.##idu.com/qifanwushuang/blog/item/60ffafe067ce9a20269791ab.html
UDP:
- DNS ASK xu#.##login2.qq.com
- DNS ASK hi.##idu.com
- '<IP-адрес в локальной сети>':1039
Другое:
Ищет следующие окна:
- ClassName: 'u29ayp9' WindowName: 'y5gw4lnpw2'
- ClassName: 'njxqitv' WindowName: 'eyqvnefyv78w'
- ClassName: 'shrbwgvob' WindowName: 'hh6e2nbw9'
- ClassName: 'sy2po643q' WindowName: 'g8yiuqcrynn5qq'
- ClassName: 'otc710g' WindowName: 'x78k781egd'
- ClassName: 'i26hlu646fo5885' WindowName: 'fh1rqqm70k6r'
- ClassName: 'g8be8x6t2vhs' WindowName: 'hehglms6ss8dsh69'
- ClassName: 't8r5ubbu' WindowName: 'f26q08py4kxv'
- ClassName: 'phvjkjs9o7f' WindowName: 'hlyvqsdxnhj03b'
- ClassName: 'fno0g0j7' WindowName: 'mdokhvp8siihqdo'
- ClassName: 'eehdqcewankpkd8' WindowName: 'e0c6uiu4'
- ClassName: 'ahl4413' WindowName: 'hjcg488dnkaep1q8'
- ClassName: 'kqgvgvdu249e' WindowName: 'tw4tgq2b8j3t1lf'
- ClassName: 'kis4yy633h9yu' WindowName: 'k1v19q06nwrdix'
- ClassName: 'ql4dni8wvaxay0ia' WindowName: 'rgor06lu7psdcr'
- ClassName: 'ko11fs3orc' WindowName: 'odweq4pett3j'
- ClassName: 'a4rppnv' WindowName: 'b10tv99isn70yu9'
- ClassName: 'bi6pbo3m' WindowName: 'qurrjchrj5uw44b4'
- ClassName: 'ifbi304k6lnncu' WindowName: 'y93g5ac74euhelnw'
- ClassName: 'cvd6vhsb8vrn' WindowName: 'l4k58u4vgkr4wi'
- ClassName: 'o8bcvhuljo1wio' WindowName: 'jc85bxfyo2bv5'
- ClassName: 'byw0mjbpy' WindowName: 'xph3rrq2'
- ClassName: 'vu4iqw25u' WindowName: 'dpu82703mua'
- ClassName: 'h52b0n81h3o' WindowName: 'oo0ckubjoqnsr15'
- ClassName: 'v4tjytx7' WindowName: 'hwda3116'
- ClassName: 'xa1g4i4wnmdg' WindowName: 'ww6h4pig7h9'
- ClassName: 'ydfei3ve' WindowName: 'bss7imuv3b4sx6i2'
- ClassName: 'ujpysul6577nr3la' WindowName: 'i6adx3k6xol8'
- ClassName: 'rul3w119hf' WindowName: 'ylpsw7u53tsv3'
- ClassName: 'wfaolrqw9hdjrm0y' WindowName: 's3rtrdpbycfoyu'
- ClassName: 'eytqr0ssn2hritrs' WindowName: 'c5gkridrnvym4to'
- ClassName: 'dbwf0vnjvnl' WindowName: 'ubdbcvg751ok4p'
- ClassName: 'f73yvhr2h21kv9ev' WindowName: 'wnqq23e7fl8ugc'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'pqty8tv7ru3w5uxb' WindowName: 'ddfce2u7kchi'
- ClassName: 'fpw4d7hjccrqn' WindowName: 'gv7bp7tqnm3nq'
- ClassName: 'TForm1' WindowName: 'YZHook'
- ClassName: 'wy9gdnnx6wjq5' WindowName: 'qbppdjvxeamktm'
- ClassName: 'lkvcgywnbi' WindowName: 'nlwvnx5uc99m7qct'
- ClassName: 'n5sn6uah' WindowName: 'yx33dhyqh8j4yemg'
- ClassName: 'uet8fgtfwib' WindowName: 'qabirs97cy8exfe9'
- ClassName: 'l1xloboed9fj' WindowName: 'dx1tnrro'
- ClassName: 'ut3s1ca' WindowName: 'yonk5i678'
- ClassName: 'q198hm0d3q7uky4q' WindowName: 'tqr9mvm19diu'
- ClassName: 'j1guhniada' WindowName: 'gnfgsl5mid'
- ClassName: 'ssalClortnoCresUerawMV' WindowName: 'VMwareUserControlTitle'
- ClassName: 'yj3b826pc6e' WindowName: 'gbmxlfyuegde0vmm'
- ClassName: 'inshsmr' WindowName: 'q9vc3782m'
- ClassName: 'xccec9x2lfxdl' WindowName: 'qv24ih25p41y'
- ClassName: 'sfaqpss43x0i' WindowName: 'ni00potxv7win9q'
- ClassName: 'mben0fik859qtsyu' WindowName: 'jfwi91mqujmmy6ym'
- ClassName: 'qwhqg5n' WindowName: 'dkqsfamexkw4d'
- ClassName: 'lspmphkcp8d' WindowName: 'i7gqv2bky09s'
- ClassName: 'wfu4kwc10au6qi' WindowName: 'a5d5p5yo5w'
- ClassName: 'q5dghj3oh' WindowName: 'afrirsj3'
- ClassName: 'jcc41cpq' WindowName: 'g50556l1'
- ClassName: 'igtp3lxkq6o' WindowName: 'w90d3fhotcdl'
- ClassName: 'yt4qh2j176nyb' WindowName: 'ncyhtq16qchser'
- ClassName: 'xord2v7s2bu' WindowName: 'mefo7qmr0'
- ClassName: 'ppxhtjv0fawbc' WindowName: 'yvtpryx7q'
- ClassName: 'v2q0k1qyh0p' WindowName: 'a4l5s12di50'
- ClassName: 'rr639j0v8s' WindowName: 'rdskf43d8v8'
- ClassName: 'io3onyol4happ4f7' WindowName: 'x327ri5b284'
- ClassName: 'g3gfoishl4vx' WindowName: 'q1knnyohi8'
- ClassName: 'dqrimiw80xtaghc' WindowName: 'jbg5rewuv'
- ClassName: 'r8u6wej6qq' WindowName: 'yatuv737wd'
- ClassName: 'a5s93tsfa2mv4' WindowName: 'q93w7or'
- ClassName: 'wa2210he4gmbd' WindowName: 'po7idn2'
- ClassName: 'ksajxus' WindowName: 'eqqq1667120f'
- ClassName: 'bkmatcpn63uro' WindowName: 'cjp1106rm25xcj'
- ClassName: 'c7hu9p708k34r53l' WindowName: 'sl1pgoc81xf3u'
- ClassName: 'ssb1ow0r3thhamgf' WindowName: 'g93t3y1xgue0udcj'
- ClassName: 'wjupl8boeh4bxr8' WindowName: 'q9wemfk5m5b'
- ClassName: 'svokpjkiflh' WindowName: 'oq7u2w1bu1d0ptyc'
- ClassName: 'r01tl2y1' WindowName: 'dsjlq920'
- ClassName: 'enlhbxhs1ner73yw' WindowName: 'jefmnkvl'
- ClassName: 'num2squt9b4bm71' WindowName: 'skar48ej02lsj'
- ClassName: 'bnscm6jos' WindowName: 'vspokxpbco'
- ClassName: 'tw82seg7opjx' WindowName: 'g8qvgkn04ua'
- ClassName: 'kmr9pe0aq' WindowName: 'iymd4hdtr'
- ClassName: 'rg643p5kncyfcn' WindowName: 'aryk9b86kyxa9l3'
- ClassName: 'k93wog79ysmg9' WindowName: 'i9gj1m2y9naub2dp'
- ClassName: 'iuqk1l1pqv' WindowName: 'jf9v7vfb7lpds0ow'
- ClassName: 'cnhhg5fm' WindowName: 'ivhimdowl2s'
- ClassName: 'hw2vpogeux' WindowName: 'htibtv70g'
- ClassName: 'smfy761gse' WindowName: 's82gdq4xshe'
- ClassName: 'ajtesj8bsdj' WindowName: 'fonc1ubsfa38bafc'
- ClassName: 'o2srsar47' WindowName: 'f6u5yicr690'
- ClassName: 'la81leddjhvujht' WindowName: 'dkqilwsa83'
- ClassName: 'epk9w6d4xl9wwo' WindowName: 'fllirx2'
- ClassName: 'p63q38vrr6qb' WindowName: 'go934gt0'
- ClassName: 'on35cu3fhqsxeja' WindowName: 'ukp04u5m'
- ClassName: 'b45aq427ra2' WindowName: 'd1rn2fv39u'
- ClassName: 'ooi268vkw4' WindowName: 'snvvj93'
- ClassName: 'l6qqyn4' WindowName: 'xt4yw4sn'
- ClassName: 'hfyj68e6' WindowName: 'g3fakc25vii50i'
- ClassName: 'qhyfbg9ko49130g' WindowName: 'ywedba57an8bkvs'
- ClassName: 'tgfy3f2haavuxei' WindowName: 'nksfe3ebo7j9q'
- ClassName: 'xplceooxt0q6' WindowName: 'eoewek15a4pq5lrg'
- ClassName: 'f574pd8lsm2' WindowName: 'uq5s2o7nhyp25'
- ClassName: 'ettr7s3x' WindowName: 'v51gj4uun4650'
- ClassName: 'a33cwc9' WindowName: 'p6tlw63qocjb0j'
- ClassName: 'jaranhxi' WindowName: 'pjyermc'
