Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe'
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Завершает или пытается завершить
следующие пользовательские процессы:
- ecmd.exe
Изменения в файловой системе:
Создает следующие файлы:
- <Служебный элемент>
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: 'CnQfhr'
- ClassName: '(null)' WindowName: 'i C'
- ClassName: '(null)' WindowName: 'fA Tiv'
- ClassName: '(null)' WindowName: 'gw jhf nlvHhr'
- ClassName: '(null)' WindowName: 's XIjrhTgmb olHRxr'
- ClassName: '(null)' WindowName: ' NemBicllOG '
- ClassName: '(null)' WindowName: 'imKl'
- ClassName: '(null)' WindowName: 'SOWiTAY y'
- ClassName: '(null)' WindowName: 'ugLIGunbyx'
- ClassName: '(null)' WindowName: 'xUfRvpov '
- ClassName: '(null)' WindowName: 'lfsKpo'
- ClassName: '(null)' WindowName: 'vi'
- ClassName: '(null)' WindowName: 'afkGLjqStg'
- ClassName: '(null)' WindowName: 'dAfhFpCClzs'
- ClassName: '(null)' WindowName: 'wPLTkye'
- ClassName: '(null)' WindowName: 'RFftjq p '
- ClassName: '(null)' WindowName: 'GrihcslO'
- ClassName: '(null)' WindowName: 'b wFklf o r'
- ClassName: '(null)' WindowName: 'dzgr eJ'
- ClassName: '(null)' WindowName: ' ObTgh'
- ClassName: '(null)' WindowName: 'mstunf L'
- ClassName: '(null)' WindowName: 'oFellx '
- ClassName: '(null)' WindowName: 'jpxfj byJ MdA'
- ClassName: '(null)' WindowName: ' skm FZocpexawWUpsl'
- ClassName: '(null)' WindowName: 'Sybgy'
- ClassName: '(null)' WindowName: 'nN'
- ClassName: '(null)' WindowName: 'Aaab '
- ClassName: '(null)' WindowName: 'zrnxjQ'
- ClassName: '(null)' WindowName: 'O Rl meq AS j'
- ClassName: '(null)' WindowName: 'a xvulaUcGUbHIwm'
- ClassName: '(null)' WindowName: 'udifuyR '
- ClassName: '(null)' WindowName: 'hjZ jhHC'
- ClassName: '(null)' WindowName: 'ZotegVc CH'
- ClassName: '(null)' WindowName: 'InFmrpUaPKq'
- ClassName: '(null)' WindowName: 'f m ypy'
- ClassName: '(null)' WindowName: 'IUz'
- ClassName: '(null)' WindowName: 'omxsnv Ob pAO'
- ClassName: '(null)' WindowName: 'bbmvtqh'
- ClassName: '(null)' WindowName: 'ktogaptxLh jNjknPv'
- ClassName: '(null)' WindowName: 'Rhbveahcrd'
- ClassName: '(null)' WindowName: 'yj nn'
- ClassName: '(null)' WindowName: 'rmHfsp'
- ClassName: '(null)' WindowName: 'n HrPoiaORu'
- ClassName: '(null)' WindowName: 'Jk i'
- ClassName: '(null)' WindowName: 'cpu Io'
- ClassName: '(null)' WindowName: 'Ccd AzVBUlC k'
- ClassName: '(null)' WindowName: 'occeTet'
- ClassName: '(null)' WindowName: 'xhZBr MeOKKl'
- ClassName: '(null)' WindowName: ' trWyLr '
- ClassName: '(null)' WindowName: 'xJH'
- ClassName: '(null)' WindowName: 'tmc Hfski'
- ClassName: '(null)' WindowName: 'QjJS'
- ClassName: '(null)' WindowName: 'A ojG'
- ClassName: '(null)' WindowName: 'qmgfxjwfmG'
- ClassName: '(null)' WindowName: ' rrOs'
- ClassName: '(null)' WindowName: ' YbfnCjhzzjiJxc '
- ClassName: '(null)' WindowName: 'CHJxjL'
- ClassName: '(null)' WindowName: 'hxc headycAnGy'
- ClassName: '(null)' WindowName: ' UzsiN'
- ClassName: '(null)' WindowName: 'BD wUntiij'
- ClassName: '(null)' WindowName: 'owuCgC g'
- ClassName: '(null)' WindowName: 'EBhbmxp ql'
- ClassName: '(null)' WindowName: 'uomwhHvxS'
- ClassName: '(null)' WindowName: ' bqRin '
- ClassName: '(null)' WindowName: ' hIlzg sVgMjOgx'
- ClassName: '(null)' WindowName: 'xu zqpLb'
- ClassName: '(null)' WindowName: 'gCMZzPcymS'
- ClassName: '(null)' WindowName: 'oXoSz mxdkaRCq'
- ClassName: '(null)' WindowName: 'Dhfakw MiGy'
- ClassName: '(null)' WindowName: ' rFZUJ r jW'
- ClassName: '(null)' WindowName: 'xyD'
- ClassName: '(null)' WindowName: 'x f Fmdrsy '
- ClassName: '(null)' WindowName: ' TmxpUdcUmbx'
- ClassName: '(null)' WindowName: 'ymyte'
- ClassName: '(null)' WindowName: 'UM VIbf jZs'
- ClassName: '(null)' WindowName: ' Sfb QMc x'
- ClassName: '(null)' WindowName: 'ld msOcbypv'
- ClassName: '(null)' WindowName: 'ZRssn'
- ClassName: '(null)' WindowName: 'fr'
- ClassName: '(null)' WindowName: 'cj'
- ClassName: '(null)' WindowName: ' CpbWg'
- ClassName: '(null)' WindowName: 'wHit L'
- ClassName: '(null)' WindowName: 'iz DaobL lGO'
- ClassName: '(null)' WindowName: 'O eBS rDWbvsrWuLB'
- ClassName: '(null)' WindowName: 'qvkur Iy'
- ClassName: '(null)' WindowName: ' wR nkEsc fu '
- ClassName: '(null)' WindowName: 'TshFcn'
- ClassName: '(null)' WindowName: 'rsDkbbkq '
- ClassName: '(null)' WindowName: 'yikte'
- ClassName: '(null)' WindowName: ' ogVoq'
- ClassName: '(null)' WindowName: 'xribfFzlgCxI'
- ClassName: '(null)' WindowName: ' JyGs whBEo'
- ClassName: '(null)' WindowName: 'gmc '
- ClassName: '(null)' WindowName: 'xQ Ya'
- ClassName: '(null)' WindowName: 'e pieUe '
- ClassName: '(null)' WindowName: 'hg oyCmg'
- ClassName: '(null)' WindowName: 'amzOgDV lJvvdagb'
- ClassName: '(null)' WindowName: 'gp'
- ClassName: '(null)' WindowName: 'ksGtRohq'
- ClassName: '(null)' WindowName: 'eJbBWU'
- ClassName: '(null)' WindowName: 'vdya q meZ Uk'
- ClassName: '(null)' WindowName: 'csYV'
- ClassName: '(null)' WindowName: 'pdq lbv e Pdy'
- ClassName: '(null)' WindowName: ' bNzF '
- ClassName: '(null)' WindowName: 'vHZ'
- ClassName: '(null)' WindowName: 'psv EVwfNmrA yX'
- ClassName: '(null)' WindowName: 'VTiaDilLuhEet wep cGx '
- ClassName: '(null)' WindowName: ' ebr fsy pOU'
- ClassName: '(null)' WindowName: ' rDy fkLSe uoKC'
- ClassName: '(null)' WindowName: 'uxzj N mNQ'
- ClassName: '(null)' WindowName: 'Sm'
- ClassName: '(null)' WindowName: 'QI yEeBX d'
- ClassName: '(null)' WindowName: 'XZ'
- ClassName: '(null)' WindowName: 'HZ qqNxUJp'
