Техническая информация
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[18].php
- %TEMP%\~!#47.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[18].php
- %TEMP%\~!#49.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[19].php
- %TEMP%\~!#48.tmp
- %TEMP%\~!#46.tmp
- %TEMP%\~!#44.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[17].php
- %TEMP%\~!#43.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[18].php
- %TEMP%\~!#45.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[18].php
- %TEMP%\~!#4E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[20].php
- %TEMP%\~!#4D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[20].php
- %TEMP%\~!#4F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[20].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[20].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[19].php
- %TEMP%\~!#4A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[19].php
- %TEMP%\~!#4C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[19].php
- %TEMP%\~!#4B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[17].php
- %TEMP%\~!#3A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[15].php
- %TEMP%\~!#39.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[15].php
- %TEMP%\~!#3B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[15].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[15].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[14].php
- %TEMP%\~!#36.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[14].php
- %TEMP%\~!#38.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[14].php
- %TEMP%\~!#37.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[17].php
- %TEMP%\~!#40.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[16].php
- %TEMP%\~!#42.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[17].php
- %TEMP%\~!#41.tmp
- %TEMP%\~!#3F.tmp
- %TEMP%\~!#3D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[16].php
- %TEMP%\~!#3C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[16].php
- %TEMP%\~!#3E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[16].php
- %TEMP%\~!#62.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[25].php
- %TEMP%\~!#61.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[25].php
- %TEMP%\~!#63.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[25].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[25].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[24].php
- %TEMP%\~!#5E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[24].php
- %TEMP%\~!#60.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[24].php
- %TEMP%\~!#5F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[27].php
- %TEMP%\~!#68.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[26].php
- %TEMP%\~!#6A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[27].php
- %TEMP%\~!#69.tmp
- %TEMP%\~!#67.tmp
- %TEMP%\~!#65.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[26].php
- %TEMP%\~!#64.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[26].php
- %TEMP%\~!#66.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[26].php
- %TEMP%\~!#5D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[22].php
- %TEMP%\~!#54.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[21].php
- %TEMP%\~!#56.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[22].php
- %TEMP%\~!#55.tmp
- %TEMP%\~!#53.tmp
- %TEMP%\~!#51.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[21].php
- %TEMP%\~!#50.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[21].php
- %TEMP%\~!#52.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[21].php
- %TEMP%\~!#5B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[23].php
- %TEMP%\~!#5A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[24].php
- %TEMP%\~!#5C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[23].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[23].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[22].php
- %TEMP%\~!#57.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[22].php
- %TEMP%\~!#59.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[23].php
- %TEMP%\~!#58.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[5].php
- %TEMP%\~!#12.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[5].php
- %TEMP%\~!#14.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[5].php
- %TEMP%\~!#13.tmp
- %TEMP%\~!#11.tmp
- %TEMP%\~!#F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[4].php
- %TEMP%\~!#E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[5].php
- %TEMP%\~!#10.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[4].php
- %TEMP%\~!#19.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[7].php
- %TEMP%\~!#18.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[7].php
- %TEMP%\~!#1A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[6].php
- %TEMP%\~!#15.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[6].php
- %TEMP%\~!#17.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[6].php
- %TEMP%\~!#16.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[4].php
- %TEMP%\~!#5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[2].php
- %TEMP%\~!#4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[2].php
- %TEMP%\~!#6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[1].php
- %TEMP%\~!#1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[1].php
- %TEMP%\~!#3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[1].php
- %TEMP%\~!#2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[3].php
- %TEMP%\~!#B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[3].php
- %TEMP%\~!#D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[4].php
- %TEMP%\~!#C.tmp
- %TEMP%\~!#A.tmp
- %TEMP%\~!#8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[2].php
- %TEMP%\~!#7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[3].php
- %TEMP%\~!#9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[3].php
- %TEMP%\~!#2D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[12].php
- %TEMP%\~!#2C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[12].php
- %TEMP%\~!#2E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[12].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[11].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[11].php
- %TEMP%\~!#29.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[11].php
- %TEMP%\~!#2B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[11].php
- %TEMP%\~!#2A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[13].php
- %TEMP%\~!#33.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[13].php
- %TEMP%\~!#35.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[14].php
- %TEMP%\~!#34.tmp
- %TEMP%\~!#32.tmp
- %TEMP%\~!#30.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[12].php
- %TEMP%\~!#2F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[13].php
- %TEMP%\~!#31.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[13].php
- %TEMP%\~!#28.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[8].php
- %TEMP%\~!#1F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[8].php
- %TEMP%\~!#21.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[9].php
- %TEMP%\~!#20.tmp
- %TEMP%\~!#1E.tmp
- %TEMP%\~!#1C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[7].php
- %TEMP%\~!#1B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[8].php
- %TEMP%\~!#1D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[8].php
- %TEMP%\~!#26.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[10].php
- %TEMP%\~!#25.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[10].php
- %TEMP%\~!#27.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[10].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\viewtopic[10].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\viewtopic[9].php
- %TEMP%\~!#22.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\viewtopic[9].php
- %TEMP%\~!#24.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\viewtopic[9].php
- %TEMP%\~!#23.tmp
Сетевая активность:
Подключается к:
- 'ha#####ham.bigmoney.biz':80
TCP:
Запросы HTTP GET:
- ha#####ham.bigmoney.biz/forum/viewtopic.php?f=######################
- ha#####ham.bigmoney.biz/forum/viewtopic.php?f=#####################
- ha#####ham.bigmoney.biz/forum/viewtopic.php?f=####################
UDP:
- DNS ASK ha#####ham.bigmoney.biz
- '<IP-адрес в локальной сети>':1034
