Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERd190.dir00\svchost.exe.mdmp 16325836412029716
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WERd190.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '69.#.74.204':445
- '69.#.145.234':445
- '69.#.194.185':445
- '69.#.189.22':445
- '69.#.45.227':445
- '69.#.3.215':139
- '69.#.191.24':139
- '69.#.74.86':139
- '69.#.179.79':139
- '69.#.188.214':445
- '69.#.131.71':445
- '69.#.15.105':445
- '69.#.53.112':445
- '69.#.135.53':445
- '69.#.9.16':445
- '69.#.205.59':445
- '69.#.179.20':445
- '69.#.151.154':445
- '69.#.143.54':445
- '69.#.8.172':139
- '69.#.38.111':139
- '69.#.174.38':139
- '69.#.13.120':139
- '69.#.140.95':139
- '69.#.177.82':139
- '69.#.154.30':139
- '69.#.245.99':139
- '69.#.235.68':139
- '69.#.53.197':139
- '69.#.160.46':139
- '69.#.40.97':139
- '69.#.70.218':139
- '69.#.46.37':139
- '69.#.255.46':139
- '69.#.16.47':139
- '69.#.25.223':139
- '69.#.254.110':139
- '69.#.114.168':139
- '69.#.163.72':139
- '69.#.16.66':445
- '69.#.208.73':445
- '69.#.174.163':445
- '69.#.101.39':445
- '69.#.218.207':445
- '69.#.85.170':445
- '69.#.67.92':445
- '69.#.25.130':445
- '69.#.33.220':445
- '69.#.67.121':445
- '69.#.45.227':139
- '69.#.34.145':445
- '69.#.74.204':139
- '69.#.145.234':139
- '69.#.65.136':445
- '69.#.211.192':445
- '69.#.89.211':445
- '69.#.84.238':445
- '69.#.117.92':445
- '69.#.84.66':445
- '69.#.140.62':445
- '69.#.14.242':445
- '69.#.33.75':445
- '69.#.103.27':445
- '69.#.247.28':445
- '69.#.130.174':445
- '69.#.112.33':445
- '69.#.34.84':445
- '69.#.64.154':445
- '69.#.9.182':445
- '69.#.8.59':445
- '69.#.21.116':445
- '69.#.167.134':445
- '69.#.236.28':445
- '69.#.93.166':445
- '69.#.152.79':445
- '69.#.145.174':445
- '69.#.82.228':445
- '69.#.243.242':445
- '69.#.194.8':445
- '69.#.35.33':445
- '69.#.154.30':445
- '69.#.245.99':445
- '69.#.104.251':445
- '69.#.73.165':445
- '69.#.58.73':445
- '69.#.87.44':445
- '69.#.120.167':445
- '69.#.53.197':445
- '69.#.160.46':445
- '69.#.254.110':445
- '69.#.13.120':445
- '69.#.140.95':445
- '69.#.25.223':445
- '69.#.177.82':445
- '69.#.235.68':445
- '69.#.38.111':445
- '69.#.174.38':445
- '69.#.79.55':445
- '69.#.6.7':445
- '69.#.26.198':445
- '69.#.110.224':445
- '69.#.168.221':445
- '69.#.145.92':445
- '69.#.172.46':445
- '69.#.50.110':445
- '69.#.92.92':445
- '69.#.24.59':445
- '69.#.34.103':445
- '69.#.130.152':445
- '69.#.63.57':445
- '69.#.216.55':445
- '69.#.226.53':445
- '69.#.106.177':445
- '69.#.118.250':445
- '69.#.36.90':445
- '69.#.15.107':445
- '69.#.12.15':445
- '69.#.106.177':139
- '69.#.15.107':139
- '69.#.130.152':139
- '69.#.63.57':139
- '69.#.12.15':139
- '69.#.34.103':139
- '69.#.110.224':139
- '69.#.118.250':139
- '69.#.36.90':139
- '69.#.226.53':139
- '69.#.104.251':139
- '69.#.87.44':139
- '69.#.194.8':139
- '69.#.35.33':139
- '69.#.120.167':139
- '69.#.79.55':139
- '69.#.216.55':139
- '69.#.73.165':139
- '69.#.58.73':139
- '69.#.168.221':139
- '69.#.8.172':445
- '69.#.255.46':445
- '69.#.3.215':445
- '69.#.46.37':445
- '69.#.40.97':445
- '69.#.163.72':445
- '69.#.114.168':445
- '69.#.70.218':445
- '69.#.16.47':445
- '69.#.191.24':445
- '69.#.145.92':139
- '69.#.92.92':139
- '69.#.6.7':139
- '69.#.26.198':139
- '69.#.24.59':139
- '69.#.74.86':445
- '69.#.179.79':445
- '69.#.172.46':139
- '69.#.50.110':139
- '69.#.189.22':139
- '69.#.61.63':445
- '69.#.96.113':445
- '69.#.20.247':139
- '69.#.205.48':139
- '69.#.55.195':445
- '69.#.11.84':445
- '69.#.64.108':445
- '69.#.113.70':445
- '69.#.230.70':445
- '69.#.112.169':139
- '69.#.20.30':139
- '69.#.41.189':139
- '69.#.176.67':139
- '69.#.205.115':139
- '69.#.67.18':139
- '69.#.209.171':139
- '69.#.217.36':139
- '69.#.20.223':139
- '69.#.172.243':139
- '69.#.17.245':445
- '69.#.240.244':445
- '69.#.96.238':445
- '69.#.249.129':445
- '69.#.244.248':445
- '69.#.240.3':445
- '69.#.146.138':445
- '69.#.64.73':445
- '69.#.29.228':445
- '69.#.120.37':445
- '69.#.58.253':445
- '69.#.44.108':445
- '69.#.248.128':445
- '69.#.206.9':445
- '69.#.98.130':445
- '69.#.9.238':445
- '69.#.15.220':445
- '69.#.129.16':445
- '69.#.153.57':445
- '69.#.79.115':445
- '69.#.248.128':139
- '69.#.153.57':139
- '69.#.44.108':139
- '69.#.9.238':139
- '69.#.79.115':139
- '69.#.58.253':139
- '69.#.249.129':139
- '69.#.15.220':139
- '69.#.129.16':139
- '69.#.98.130':139
- '69.#.113.70':139
- '69.#.55.195':139
- '69.#.96.113':139
- '69.#.61.63':139
- '69.#.230.70':139
- '69.#.64.108':139
- '69.#.206.9':139
- '69.#.17.245':139
- '69.#.11.84':139
- '69.#.244.248':139
- '69.#.112.112':139
- '69.#.123.186':139
- '69.#.59.182':139
- '69.#.112.231':139
- '69.#.105.65':139
- '69.#.200.73':139
- '69.#.174.2':139
- '69.#.49.190':139
- '69.#.197.166':139
- '69.#.53.122':139
- '69.#.240.3':139
- '69.#.29.228':139
- '69.#.240.244':139
- '69.#.96.238':139
- '69.#.120.37':139
- '69.#.33.170':139
- '69.#.246.203':139
- '69.#.146.138':139
- '69.#.64.73':139
- '69.#.21.116':139
- '69.#.93.166':139
- '69.#.236.28':139
- '69.#.8.59':139
- '69.#.82.228':139
- '69.#.145.174':139
- '69.#.9.182':139
- '69.#.243.242':139
- '69.#.152.79':139
- '69.#.167.134':139
- '69.#.208.73':139
- '69.#.218.207':139
- '69.#.101.39':139
- '69.#.16.66':139
- '69.#.25.130':139
- '69.#.67.92':139
- '69.#.84.66':139
- '69.#.33.220':139
- '69.#.85.170':139
- '69.#.33.75':139
- '69.#.9.16':139
- '69.#.151.154':139
- '69.#.131.71':139
- '69.#.15.105':139
- '69.#.143.54':139
- '69.#.188.214':139
- '69.#.194.185':139
- '69.#.205.59':139
- '69.#.179.20':139
- '69.#.135.53':139
- '69.#.14.242':139
- '69.#.247.28':139
- '69.#.103.27':139
- '69.#.140.62':139
- '69.#.34.84':139
- '69.#.112.33':139
- '69.#.53.112':139
- '69.#.64.154':139
- '69.#.130.174':139
- '69.#.176.67':445
- '69.#.205.115':445
- '69.#.200.73':445
- '69.#.174.2':445
- '69.#.20.30':445
- '69.#.20.223':445
- '69.#.172.243':445
- '69.#.41.189':445
- '69.#.67.18':445
- '69.#.197.166':445
- '69.#.53.122':445
- '69.#.59.182':445
- '69.#.33.170':445
- '69.#.246.203':445
- '69.#.112.231':445
- '69.#.105.65':445
- '69.#.49.190':445
- '69.#.112.112':445
- '69.#.123.186':445
- '69.#.209.171':445
- '69.#.65.136':139
- '69.#.84.238':139
- '69.#.20.247':9988
- '69.#.34.145':139
- '69.#.117.92':139
- '69.#.67.121':139
- '69.#.174.163':139
- '69.#.211.192':139
- '69.#.89.211':139
- '69.#.174.2':9988
- '69.#.20.247':445
- '69.#.205.48':445
- '69.#.217.36':445
- '69.#.112.169':445
- '69.#.11.84':9988
- '69.#.240.244':9988
- '69.#.176.67':9988
- '69.#.64.108':9988
- '69.#.98.130':9988
