Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WER9963.dir00\svchost.exe.mdmp 16325836412032000
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER9963.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '59.##3.5.192':445
- '59.##3.209.192':445
- '59.##3.236.92':445
- '59.##3.152.8':445
- '59.##3.116.214':445
- '59.##3.100.110':445
- '59.##3.45.117':445
- '59.##3.249.50':445
- '59.##3.196.2':445
- '59.##3.43.58':445
- '59.##3.185.78':445
- '59.##3.124.159':445
- '59.##3.79.152':445
- '59.##3.152.88':445
- '59.##3.52.84':445
- '59.##3.32.216':445
- '59.##3.225.23':445
- '59.##3.50.200':445
- '59.##3.208.113':445
- '59.##3.110.115':445
- '59.##3.64.107':445
- '59.##3.103.222':445
- '59.##3.28.206':445
- '59.##3.29.66':445
- '59.##3.40.43':445
- '59.##3.226.86':445
- '59.##3.108.208':445
- '59.##3.113.254':445
- '59.##3.100.116':445
- '59.##3.11.27':445
- '59.##3.68.30':445
- '59.##3.223.115':445
- '59.##3.90.80':445
- '59.##3.225.23':9988
- '59.##3.152.8':9988
- '59.##3.79.152':9988
- '59.##3.43.58':9988
- '59.##3.50.200':9988
- '59.##3.103.222':9988
- '59.##3.196.2':9988
- '59.##3.100.110':9988
- '59.##3.108.208':9988
- '59.##3.10.214':9988
- '59.##3.5.192':9988
- '59.##3.29.66':9988
- '59.##3.185.78':9988
- '59.##3.94.11':9988
- '59.##3.236.92':9988
- '59.##3.169.42':9988
- '59.##3.109.137':9988
- '59.##3.167.18':9988
- '59.##3.226.86':9988
- '59.##3.113.254':9988
- '59.##3.209.192':9988
- '59.##3.169.42':445
- '59.##3.94.11':445
- '59.##3.28.238':9988
- '59.##3.41.159':9988
- '59.##3.45.117':9988
- '59.##3.210.159':9988
- '59.##3.64.107':9988
- '59.##3.28.206':9988
- '59.##3.34.81':9988
- '59.##3.152.88':9988
- '59.##3.208.113':9988
- '59.##3.29.54':9988
- '59.##3.64.107':139
- '59.##3.50.200':139
- '59.##3.100.116':139
- '59.##3.223.115':139
- '59.##3.208.113':139
- '59.##3.29.66':139
- '59.##3.68.30':139
- '59.##3.110.115':139
- '59.##3.45.117':139
- '59.##3.226.86':139
- '59.##3.113.254':139
- '59.##3.10.214':139
- '59.##3.90.80':139
- '59.##3.116.214':139
- '59.##3.108.208':139
- '59.##3.11.27':139
- '59.##3.28.206':139
- '59.##3.139.157':139
- '59.#13.88.5':139
- '59.##3.34.81':139
- '59.##3.166.63':139
- '59.##3.239.249':139
- '59.##3.28.238':139
- '59.##3.137.165':139
- '59.##3.167.18':139
- '59.##3.109.137':139
- '59.##3.40.43':139
- '59.##3.103.222':139
- '59.##3.228.140':139
- '59.##3.210.159':139
- '59.##3.128.224':139
- '59.##3.164.122':139
- '59.##3.29.54':139
- '59.##3.167.18':445
- '59.##3.137.165':445
- '59.##3.34.81':445
- '59.##3.239.249':445
- '59.##3.10.214':445
- '59.##3.41.159':445
- '59.##3.28.238':445
- '59.##3.41.159':139
- '59.##3.29.54':445
- '59.##3.210.159':445
- '59.##3.228.140':445
- '59.##3.109.137':445
- '59.#13.88.5':445
- '59.##3.166.63':445
- '59.##3.164.122':445
- '59.##3.139.157':445
- '59.##3.169.42':139
- '59.##3.5.192':139
- '59.##3.152.88':139
- '59.##3.152.8':139
- '59.##3.236.92':139
- '59.##3.100.110':139
- '59.##3.225.23':139
- '59.##3.209.192':139
- '59.##3.249.50':139
- '59.##3.185.78':139
- '59.##3.79.152':139
- '59.##3.94.11':139
- '59.##3.43.58':139
- '59.##3.32.216':139
- '59.##3.52.84':139
- '59.##3.124.159':139
- '59.##3.196.2':139
