Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt] 'DLLName' = 'crypts.dll'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[21].php
- %TEMP%\B9C6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[21].php
- %TEMP%\BFE1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[22].php
- %TEMP%\C5EC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[22].php
- %TEMP%\B35E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[20].php
- %TEMP%\9EAD.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[20].php
- %TEMP%\A62F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[21].php
- %TEMP%\ACD6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[21].php
- %TEMP%\CBF6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[23].php
- %TEMP%\E9B0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[23].php
- %TEMP%\EF7C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[24].php
- %TEMP%\F587.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[24].php
- %TEMP%\E3E3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[22].php
- %TEMP%\D1D2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[22].php
- %TEMP%\D7DD.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[23].php
- %TEMP%\DDD9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[23].php
- %TEMP%\5CA2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[17].php
- %TEMP%\56F5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[18].php
- %TEMP%\68A9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[18].php
- %TEMP%\627E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[17].php
- %TEMP%\4477.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[16].php
- %TEMP%\3E9B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[17].php
- %TEMP%\5129.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[17].php
- %TEMP%\4AD0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[18].php
- %TEMP%\8C6D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[19].php
- %TEMP%\8691.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[20].php
- %TEMP%\9873.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[20].php
- %TEMP%\9249.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[19].php
- %TEMP%\7480.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[18].php
- %TEMP%\6E85.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[19].php
- %TEMP%\8067.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[19].php
- %TEMP%\7A5C.tmp
- %TEMP%\FB63.tmp
- %TEMP%\7D84.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[29].php
- %TEMP%\7769.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[29].php
- %TEMP%\89A9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[30].php
- %TEMP%\838E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[29].php
- %TEMP%\6383.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[28].php
- %TEMP%\5D69.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[28].php
- %TEMP%\7016.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[29].php
- %TEMP%\69DC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[30].php
- %TEMP%\AF52.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[31].php
- %TEMP%\A985.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[31].php
- %TEMP%\BB96.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[32].php
- %TEMP%\B5AB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[31].php
- %TEMP%\964B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[30].php
- %TEMP%\8FE3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[30].php
- %TEMP%\A37A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[31].php
- %TEMP%\9D9E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[25].php
- %TEMP%\19F7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[25].php
- %TEMP%\209E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[26].php
- %TEMP%\26A9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[26].php
- %TEMP%\140C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[24].php
- %TEMP%\13F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[24].php
- %TEMP%\798.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[25].php
- %TEMP%\E20.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[25].php
- %TEMP%\2CA4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[27].php
- %TEMP%\4ADB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[27].php
- %TEMP%\5143.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[28].php
- %TEMP%\574E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[28].php
- %TEMP%\44E0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[26].php
- %TEMP%\3280.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[26].php
- %TEMP%\387C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[27].php
- %TEMP%\3E87.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[27].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[16].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[6].php
- %TEMP%\8D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[5].php
- %TEMP%\9C4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[6].php
- %TEMP%\109A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[6].php
- %TEMP%\F9D6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[5].php
- %TEMP%\E66E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[4].php
- %TEMP%\ED92.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[5].php
- %TEMP%\F3FA.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[5].php
- %TEMP%\1751.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[8].php
- %TEMP%\3808.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[7].php
- %TEMP%\3E90.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[8].php
- %TEMP%\474A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[8].php
- %TEMP%\31A0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[7].php
- %TEMP%\1D8B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[6].php
- %TEMP%\2461.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[7].php
- %TEMP%\2B08.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[7].php
- %TEMP%\7BCD.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[2].php
- %TEMP%\6EAD.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[2].php
- %TEMP%\94A4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[2].php
- %TEMP%\8959.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[1].php
- %TEMP%\3A9D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[1].php
- <SYSTEM32>\crypts.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[1].php
- %TEMP%\6363.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[1].php
- %TEMP%\5624.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[2].php
- %TEMP%\D249.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[4].php
- %TEMP%\CC1F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[4].php
- %TEMP%\DE30.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[4].php
- %TEMP%\D864.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[3].php
- %TEMP%\A5EA.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[3].php
- %TEMP%\9ED5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[3].php
- %TEMP%\C578.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[3].php
- %TEMP%\B125.tmp
- %TEMP%\4E01.tmp
- %TEMP%\E2CF.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[13].php
- %TEMP%\D5DE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[14].php
- %TEMP%\FF11.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[14].php
- %TEMP%\F3B7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[13].php
- %TEMP%\C2B4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[12].php
- %TEMP%\BC4C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[13].php
- %TEMP%\CEAB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[13].php
- %TEMP%\C8AF.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[14].php
- %TEMP%\2C8A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[15].php
- %TEMP%\1D48.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[16].php
- %TEMP%\3880.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[16].php
- %TEMP%\3276.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[15].php
- %TEMP%\AC9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[14].php
- %TEMP%\4DE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[15].php
- %TEMP%\1691.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[15].php
- %TEMP%\10B5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[10].php
- %TEMP%\6E6A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[9].php
- %TEMP%\7511.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[10].php
- %TEMP%\7B6A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[10].php
- %TEMP%\6830.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[9].php
- %TEMP%\5499.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[8].php
- %TEMP%\5B40.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[9].php
- %TEMP%\61A8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[9].php
- %TEMP%\8165.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[12].php
- %TEMP%\9EF0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[11].php
- %TEMP%\A559.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[12].php
- %TEMP%\B20B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[12].php
- %TEMP%\9914.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[11].php
- %TEMP%\8751.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[10].php
- %TEMP%\8D1D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[11].php
- %TEMP%\9348.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[11].php
Удаляет следующие файлы:
- %TEMP%\BFE1.tmp
- %TEMP%\C5EC.tmp
- %TEMP%\CBF6.tmp
- %TEMP%\B9C6.tmp
- %TEMP%\A62F.tmp
- %TEMP%\ACD6.tmp
- %TEMP%\B35E.tmp
- %TEMP%\D1D2.tmp
- %TEMP%\EF7C.tmp
- %TEMP%\F587.tmp
- %TEMP%\FB63.tmp
- %TEMP%\E9B0.tmp
- %TEMP%\D7DD.tmp
- %TEMP%\DDD9.tmp
- %TEMP%\E3E3.tmp
- %TEMP%\9EAD.tmp
- %TEMP%\5CA2.tmp
- %TEMP%\627E.tmp
- %TEMP%\68A9.tmp
- %TEMP%\56F5.tmp
- %TEMP%\4477.tmp
- %TEMP%\4AD0.tmp
- %TEMP%\5129.tmp
- %TEMP%\6E85.tmp
- %TEMP%\8C6D.tmp
- %TEMP%\9249.tmp
- %TEMP%\9873.tmp
- %TEMP%\8691.tmp
- %TEMP%\7480.tmp
- %TEMP%\7A5C.tmp
- %TEMP%\8067.tmp
- %TEMP%\7D84.tmp
- %TEMP%\838E.tmp
- %TEMP%\89A9.tmp
- %TEMP%\7769.tmp
- %TEMP%\6383.tmp
- %TEMP%\69DC.tmp
- %TEMP%\7016.tmp
- %TEMP%\8FE3.tmp
- %TEMP%\AF52.tmp
- %TEMP%\B5AB.tmp
- %TEMP%\BB96.tmp
- %TEMP%\A985.tmp
- %TEMP%\964B.tmp
- %TEMP%\9D9E.tmp
- %TEMP%\A37A.tmp
- %TEMP%\5D69.tmp
- %TEMP%\19F7.tmp
- %TEMP%\209E.tmp
- %TEMP%\26A9.tmp
- %TEMP%\140C.tmp
- %TEMP%\13F.tmp
- %TEMP%\798.tmp
- %TEMP%\E20.tmp
- %TEMP%\2CA4.tmp
- %TEMP%\4ADB.tmp
- %TEMP%\5143.tmp
- %TEMP%\574E.tmp
- %TEMP%\44E0.tmp
- %TEMP%\3280.tmp
- %TEMP%\387C.tmp
- %TEMP%\3E87.tmp
- %TEMP%\3E9B.tmp
- %TEMP%\9C4.tmp
- %TEMP%\109A.tmp
- %TEMP%\1751.tmp
- %TEMP%\8D.tmp
- %TEMP%\ED92.tmp
- %TEMP%\F3FA.tmp
- %TEMP%\F9D6.tmp
- %TEMP%\1D8B.tmp
- %TEMP%\3E90.tmp
- %TEMP%\474A.tmp
- %TEMP%\4E01.tmp
- %TEMP%\3808.tmp
- %TEMP%\2461.tmp
- %TEMP%\2B08.tmp
- %TEMP%\31A0.tmp
- %TEMP%\E66E.tmp
- %TEMP%\7BCD.tmp
- %TEMP%\8959.tmp
- %TEMP%\94A4.tmp
- %TEMP%\6EAD.tmp
- %TEMP%\3A9D.tmp
- %TEMP%\5624.tmp
- %TEMP%\6363.tmp
- %TEMP%\9ED5.tmp
- %TEMP%\D249.tmp
- %TEMP%\D864.tmp
- %TEMP%\DE30.tmp
- %TEMP%\CC1F.tmp
- %TEMP%\A5EA.tmp
- %TEMP%\B125.tmp
- %TEMP%\C578.tmp
- %TEMP%\E2CF.tmp
- %TEMP%\F3B7.tmp
- %TEMP%\FF11.tmp
- %TEMP%\D5DE.tmp
- %TEMP%\C2B4.tmp
- %TEMP%\C8AF.tmp
- %TEMP%\CEAB.tmp
- %TEMP%\4DE.tmp
- %TEMP%\2C8A.tmp
- %TEMP%\3276.tmp
- %TEMP%\3880.tmp
- %TEMP%\1D48.tmp
- %TEMP%\AC9.tmp
- %TEMP%\10B5.tmp
- %TEMP%\1691.tmp
- %TEMP%\BC4C.tmp
- %TEMP%\6E6A.tmp
- %TEMP%\7511.tmp
- %TEMP%\7B6A.tmp
- %TEMP%\6830.tmp
- %TEMP%\5499.tmp
- %TEMP%\5B40.tmp
- %TEMP%\61A8.tmp
- %TEMP%\8165.tmp
- %TEMP%\9EF0.tmp
- %TEMP%\A559.tmp
- %TEMP%\B20B.tmp
- %TEMP%\9914.tmp
- %TEMP%\8751.tmp
- %TEMP%\8D1D.tmp
- %TEMP%\9348.tmp
Сетевая активность:
Подключается к:
- 'it###rying.com':80
- 'li####soring.com':80
- 'localhost':1037
TCP:
Запросы HTTP GET:
- it###rying.com/bt.php?mo###############################################
- li####soring.com/bt.php?mo###############################################
UDP:
- DNS ASK it###rying.com
- DNS ASK li####soring.com
