Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt] 'DLLName' = 'crypts.dll'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[23].php
- %TEMP%\7395.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[23].php
- %TEMP%\6D6B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[23].php
- %TEMP%\8009.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[23].php
- %TEMP%\7A1D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[22].php
- %TEMP%\5B2B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[22].php
- %TEMP%\5530.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[22].php
- %TEMP%\6770.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[22].php
- %TEMP%\6155.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[24].php
- %TEMP%\A8DE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[25].php
- %TEMP%\A217.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[25].php
- %TEMP%\B67A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[26].php
- %TEMP%\AFC3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[25].php
- %TEMP%\8D86.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[24].php
- %TEMP%\86DF.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[24].php
- %TEMP%\9B32.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[25].php
- %TEMP%\943C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[24].php
- %TEMP%\4E98.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[19].php
- %TEMP%\337.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[18].php
- %TEMP%\FD0D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[19].php
- %TEMP%\10A5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[19].php
- %TEMP%\9BF.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[18].php
- %TEMP%\EAAE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[17].php
- %TEMP%\E3C9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[18].php
- %TEMP%\F6F3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[18].php
- %TEMP%\F0E8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[19].php
- %TEMP%\3A84.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[21].php
- %TEMP%\3072.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[21].php
- %TEMP%\47C2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[21].php
- %TEMP%\40EC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[21].php
- %TEMP%\1DD4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[20].php
- %TEMP%\178B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[20].php
- %TEMP%\2A38.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[20].php
- %TEMP%\23EE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[20].php
- %TEMP%\4C71.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[31].php
- %TEMP%\45D9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[31].php
- %TEMP%\5942.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[32].php
- %TEMP%\52BA.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[32].php
- %TEMP%\3290.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[30].php
- %TEMP%\2BC9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[30].php
- %TEMP%\3F80.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[31].php
- %TEMP%\3927.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[31].php
- %TEMP%\5F9B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[33].php
- %TEMP%\8AE1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[33].php
- %TEMP%\8052.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[34].php
- %TEMP%\9800.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[34].php
- %TEMP%\9179.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[32].php
- %TEMP%\6CF9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[32].php
- %TEMP%\6632.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[33].php
- %TEMP%\7A28.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[33].php
- %TEMP%\72F4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[30].php
- %TEMP%\DF9D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[27].php
- %TEMP%\D8D7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[27].php
- %TEMP%\EC20.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[28].php
- %TEMP%\E5C7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[27].php
- %TEMP%\C436.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[26].php
- %TEMP%\BD60.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[26].php
- %TEMP%\D24F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[27].php
- %TEMP%\CAEC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[26].php
- %TEMP%\F299.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[29].php
- %TEMP%\190C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[29].php
- %TEMP%\12B3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[30].php
- %TEMP%\2522.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[29].php
- %TEMP%\1F08.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[28].php
- %TEMP%\FFC8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[28].php
- %TEMP%\F901.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[29].php
- %TEMP%\C89.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[28].php
- %TEMP%\650.tmp
- %TEMP%\DD60.tmp
- %TEMP%\B2CA.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[6].php
- %TEMP%\AA00.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[6].php
- %TEMP%\C46E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[7].php
- %TEMP%\BD0B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[6].php
- %TEMP%\8B7C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[5].php
- %TEMP%\83EA.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[5].php
- %TEMP%\A1E2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[6].php
- %TEMP%\99E3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[5].php
- %TEMP%\CCAB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[8].php
- %TEMP%\F199.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[8].php
- %TEMP%\EB40.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[9].php
- %TEMP%\FE3B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[8].php
- %TEMP%\F794.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[7].php
- %TEMP%\D93E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[7].php
- %TEMP%\D381.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[8].php
- %TEMP%\E544.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[7].php
- %TEMP%\DF49.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[5].php
- %TEMP%\3899.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[2].php
- %TEMP%\2FDF.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[2].php
- %TEMP%\45F7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[2].php
- %TEMP%\3F50.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[2].php
- %TEMP%\14D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[1].php
- <SYSTEM32>\crypts.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[1].php
- %TEMP%\280F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[1].php
- %TEMP%\1A53.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[1].php
- %TEMP%\4C50.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[4].php
- %TEMP%\70EF.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[4].php
- %TEMP%\6A86.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[4].php
- %TEMP%\7D43.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[4].php
- %TEMP%\76EA.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[3].php
- %TEMP%\5847.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[3].php
- %TEMP%\526B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[3].php
- %TEMP%\648B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[3].php
- %TEMP%\5E32.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[14].php
- %TEMP%\975E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[14].php
- %TEMP%\9124.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[15].php
- %TEMP%\A46E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[15].php
- %TEMP%\9DE6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[13].php
- %TEMP%\7CE1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[13].php
- %TEMP%\761A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[14].php
- %TEMP%\8A5E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[14].php
- %TEMP%\83B7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[15].php
- %TEMP%\CA74.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[17].php
- %TEMP%\C41B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[16].php
- %TEMP%\D736.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[17].php
- %TEMP%\D0FC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[17].php
- %TEMP%\B0E1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[16].php
- %TEMP%\AAD6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[15].php
- %TEMP%\BD93.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[16].php
- %TEMP%\B769.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[16].php
- %TEMP%\6F54.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[10].php
- %TEMP%\2606.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[10].php
- %TEMP%\1F40.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[11].php
- %TEMP%\3345.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[10].php
- %TEMP%\2CCD.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[9].php
- %TEMP%\BB8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[9].php
- %TEMP%\4F2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[10].php
- %TEMP%\18F7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[9].php
- %TEMP%\1250.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[11].php
- %TEMP%\5AD2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[12].php
- %TEMP%\542B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[12].php
- %TEMP%\687E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[13].php
- %TEMP%\6198.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[13].php
- %TEMP%\3FD8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[11].php
- %TEMP%\396F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[11].php
- %TEMP%\4D65.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[12].php
- %TEMP%\468F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[12].php
Удаляет следующие файлы:
- %TEMP%\7395.tmp
- %TEMP%\6D6B.tmp
- %TEMP%\8009.tmp
- %TEMP%\7A1D.tmp
- %TEMP%\5B2B.tmp
- %TEMP%\5530.tmp
- %TEMP%\6770.tmp
- %TEMP%\6155.tmp
- %TEMP%\A8DE.tmp
- %TEMP%\A217.tmp
- %TEMP%\B67A.tmp
- %TEMP%\AFC3.tmp
- %TEMP%\8D86.tmp
- %TEMP%\86DF.tmp
- %TEMP%\9B32.tmp
- %TEMP%\943C.tmp
- %TEMP%\4E98.tmp
- %TEMP%\337.tmp
- %TEMP%\FD0D.tmp
- %TEMP%\10A5.tmp
- %TEMP%\9BF.tmp
- %TEMP%\EAAE.tmp
- %TEMP%\E3C9.tmp
- %TEMP%\F6F3.tmp
- %TEMP%\F0E8.tmp
- %TEMP%\3A84.tmp
- %TEMP%\3072.tmp
- %TEMP%\47C2.tmp
- %TEMP%\40EC.tmp
- %TEMP%\1DD4.tmp
- %TEMP%\178B.tmp
- %TEMP%\2A38.tmp
- %TEMP%\23EE.tmp
- %TEMP%\BD60.tmp
- %TEMP%\52BA.tmp
- %TEMP%\4C71.tmp
- %TEMP%\5F9B.tmp
- %TEMP%\5942.tmp
- %TEMP%\3927.tmp
- %TEMP%\3290.tmp
- %TEMP%\45D9.tmp
- %TEMP%\3F80.tmp
- %TEMP%\8AE1.tmp
- %TEMP%\8052.tmp
- %TEMP%\9800.tmp
- %TEMP%\9179.tmp
- %TEMP%\6CF9.tmp
- %TEMP%\6632.tmp
- %TEMP%\7A28.tmp
- %TEMP%\72F4.tmp
- %TEMP%\2BC9.tmp
- %TEMP%\E5C7.tmp
- %TEMP%\DF9D.tmp
- %TEMP%\F299.tmp
- %TEMP%\EC20.tmp
- %TEMP%\CAEC.tmp
- %TEMP%\C436.tmp
- %TEMP%\D8D7.tmp
- %TEMP%\D24F.tmp
- %TEMP%\190C.tmp
- %TEMP%\12B3.tmp
- %TEMP%\2522.tmp
- %TEMP%\1F08.tmp
- %TEMP%\FFC8.tmp
- %TEMP%\F901.tmp
- %TEMP%\C89.tmp
- %TEMP%\650.tmp
- %TEMP%\BD0B.tmp
- %TEMP%\B2CA.tmp
- %TEMP%\CCAB.tmp
- %TEMP%\C46E.tmp
- %TEMP%\99E3.tmp
- %TEMP%\8B7C.tmp
- %TEMP%\AA00.tmp
- %TEMP%\A1E2.tmp
- %TEMP%\F199.tmp
- %TEMP%\EB40.tmp
- %TEMP%\FE3B.tmp
- %TEMP%\F794.tmp
- %TEMP%\D93E.tmp
- %TEMP%\D381.tmp
- %TEMP%\E544.tmp
- %TEMP%\DF49.tmp
- %TEMP%\83EA.tmp
- %TEMP%\3F50.tmp
- %TEMP%\3899.tmp
- %TEMP%\4C50.tmp
- %TEMP%\45F7.tmp
- %TEMP%\1A53.tmp
- %TEMP%\14D.tmp
- %TEMP%\2FDF.tmp
- %TEMP%\280F.tmp
- %TEMP%\70EF.tmp
- %TEMP%\6A86.tmp
- %TEMP%\7D43.tmp
- %TEMP%\76EA.tmp
- %TEMP%\5847.tmp
- %TEMP%\526B.tmp
- %TEMP%\648B.tmp
- %TEMP%\5E32.tmp
- %TEMP%\4F2.tmp
- %TEMP%\9DE6.tmp
- %TEMP%\975E.tmp
- %TEMP%\AAD6.tmp
- %TEMP%\A46E.tmp
- %TEMP%\83B7.tmp
- %TEMP%\7CE1.tmp
- %TEMP%\9124.tmp
- %TEMP%\8A5E.tmp
- %TEMP%\D0FC.tmp
- %TEMP%\CA74.tmp
- %TEMP%\DD60.tmp
- %TEMP%\D736.tmp
- %TEMP%\B769.tmp
- %TEMP%\B0E1.tmp
- %TEMP%\C41B.tmp
- %TEMP%\BD93.tmp
- %TEMP%\761A.tmp
- %TEMP%\2CCD.tmp
- %TEMP%\2606.tmp
- %TEMP%\396F.tmp
- %TEMP%\3345.tmp
- %TEMP%\1250.tmp
- %TEMP%\BB8.tmp
- %TEMP%\1F40.tmp
- %TEMP%\18F7.tmp
- %TEMP%\6198.tmp
- %TEMP%\5AD2.tmp
- %TEMP%\6F54.tmp
- %TEMP%\687E.tmp
- %TEMP%\468F.tmp
- %TEMP%\3FD8.tmp
- %TEMP%\542B.tmp
- %TEMP%\4D65.tmp
Сетевая активность:
Подключается к:
- 'df###cfaaf.com':80
- 'ef#####cdfddfbda.com':80
- 'fb####bafaecfb.com':80
- 'localhost':1036
- 'fb####fbdede.com':80
TCP:
Запросы HTTP GET:
- df###cfaaf.com/bt.php?mo#############################################
- ef#####cdfddfbda.com/bt.php?mo#############################################
- fb####fbdede.com/bt.php?mo#############################################
- fb####bafaecfb.com/bt.php?mo#############################################
UDP:
- DNS ASK df###cfaaf.com
- DNS ASK ef#####cdfddfbda.com
- DNS ASK fb####fbdede.com
- DNS ASK fb####bafaecfb.com
