Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERfc5a.dir00\svchost.exe.mdmp 16325836412032492
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WERfc5a.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '69.##1.48.54':9988
- '69.##1.139.198':445
- '69.##1.47.143':9988
- '69.##1.166.28':9988
- '69.##1.108.241':445
- '69.##1.166.28':445
- '69.##1.127.254':445
- '69.##1.16.86':445
- '69.##1.93.165':445
- '69.##1.5.220':9988
- '69.##1.207.212':9988
- '69.##1.112.98':9988
- '69.##1.80.222':9988
- '69.##1.235.55':9988
- '69.##1.4.243':9988
- '69.##1.83.245':9988
- '69.##1.72.100':9988
- '69.#51.56.7':9988
- '69.##1.76.104':9988
- '69.##1.11.248':445
- '69.##1.123.166':445
- '69.##1.147.32':445
- '69.##1.33.75':445
- '69.##1.74.110':445
- '69.##1.169.55':445
- '69.##1.47.167':445
- '69.##1.83.52':445
- '69.##1.162.123':445
- '69.##1.171.211':445
- '69.#51.3.48':445
- '69.##1.79.253':445
- '69.##1.130.29':445
- '69.##1.78.79':445
- '69.##1.202.50':445
- '69.##1.38.56':445
- '69.##1.4.126':445
- '69.##1.66.88':445
- '69.##1.206.196':445
- '69.##1.17.109':9988
- '69.##1.37.137':9988
- '69.##1.148.30':9988
- '69.##1.212.9':9988
- '69.##1.56.109':9988
- '69.##1.139.198':9988
- '69.##1.93.165':9988
- '69.##1.130.29':9988
- '69.##1.123.166':9988
- '69.##1.17.142':9988
- '69.##1.74.110':9988
- '69.##1.83.52':9988
- '69.##1.38.56':9988
- '69.##1.11.248':9988
- '69.##1.169.55':9988
- '69.##1.24.101':9988
- '69.#51.7.8':9988
- '69.##1.47.167':9988
- '69.##1.245.68':9988
- '69.##1.33.75':9988
- '69.##1.147.32':9988
- '69.##1.171.211':9988
- '69.##1.162.123':9988
- '69.##1.157.201':9988
- '69.##1.44.202':9988
- '69.##1.136.83':9988
- '69.##1.101.81':9988
- '69.##1.221.214':9988
- '69.##1.4.126':9988
- '69.##1.108.241':9988
- '69.#51.3.48':9988
- '69.##1.16.86':9988
- '69.##1.127.254':9988
- '69.##1.206.196':9988
- '69.##1.78.79':9988
- '69.##1.79.253':9988
- '69.##1.66.88':9988
- '69.##1.202.50':9988
- '69.##1.101.81':445
- '69.##1.101.81':139
- '69.##1.80.222':139
- '69.##1.169.55':139
- '69.##1.47.167':139
- '69.##1.221.214':139
- '69.##1.157.201':139
- '69.##1.24.101':139
- '69.##1.245.68':139
- '69.##1.48.54':139
- '69.##1.162.123':139
- '69.##1.171.211':139
- '69.##1.147.32':139
- '69.##1.38.56':139
- '69.##1.4.126':139
- '69.##1.33.75':139
- '69.##1.74.110':139
- '69.##1.83.52':139
- '69.##1.11.248':139
- '69.##1.123.166':139
- '69.##1.136.83':139
- '69.##1.76.104':139
- '69.##1.17.109':139
- '69.##1.17.142':139
- '69.##1.83.245':139
- '69.##1.56.109':139
- '69.##1.5.220':139
- '69.##1.47.143':139
- '69.##1.37.137':139
- '69.##1.212.9':139
- '69.##1.235.55':139
- '69.#51.56.7':139
- '69.##1.112.98':139
- '69.##1.44.202':139
- '69.##1.4.243':139
- '69.##1.72.100':139
- '69.##1.148.30':139
- '69.#51.7.8':139
- '69.##1.207.212':139
- '69.##1.207.212':445
- '69.##1.72.100':445
- '69.##1.4.243':445
- '69.#51.7.8':445
- '69.##1.148.30':445
- '69.##1.17.142':445
- '69.##1.136.83':445
- '69.##1.212.9':445
- '69.##1.17.109':445
- '69.#51.56.7':445
- '69.##1.245.68':445
- '69.##1.48.54':445
- '69.##1.80.222':445
- '69.##1.221.214':445
- '69.##1.157.201':445
- '69.##1.44.202':445
- '69.##1.235.55':445
- '69.##1.24.101':445
- '69.##1.112.98':445
- '69.##1.130.29':139
- '69.##1.78.79':139
- '69.##1.166.28':139
- '69.##1.127.254':139
- '69.#51.3.48':139
- '69.##1.66.88':139
- '69.##1.206.196':139
- '69.##1.79.253':139
- '69.##1.202.50':139
- '69.##1.93.165':139
- '69.##1.5.220':445
- '69.##1.83.245':445
- '69.##1.76.104':445
- '69.##1.47.143':445
- '69.##1.37.137':445
- '69.##1.108.241':139
- '69.##1.16.86':139
- '69.##1.56.109':445
- '69.##1.139.198':139
