Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WER0dbc.dir00\svchost.exe.mdmp 16325836412032032
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WER0dbc.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
Сетевая активность:
Подключается к:
- '21#.#05.192.251':445
- '21#.#05.152.127':445
- '21#.#05.155.91':9988
- '21#.#05.36.56':9988
- '21#.#05.58.220':445
- '21#.#05.68.211':445
- '21#.#05.136.55':445
- '21#.#05.158.35':445
- '21#.#05.30.254':445
- '21#.#05.136.126':9988
- '21#.#05.100.16':9988
- '21#.#05.73.181':9988
- '21#.#05.0.43':9988
- '21#.#05.225.61':9988
- '21#.#05.222.0':9988
- '21#.#05.16.39':9988
- '21#.#05.85.124':9988
- '21#.#05.129.84':9988
- '21#.#05.180.8':445
- '21#.#05.82.17':445
- '21#.#05.137.30':445
- '21#.#05.33.11':445
- '21#.#05.11.44':445
- '21#.#05.184.87':445
- '21#.#05.87.149':445
- '21#.#05.117.55':445
- '21#.#05.225.106':445
- '21#.#05.225.61':445
- '21#.#05.72.95':445
- '21#.#05.73.181':445
- '21#.#05.26.179':445
- '21#.#05.68.157':445
- '21#.#05.136.126':445
- '21#.#05.165.136':445
- '21#.#05.36.246':445
- '21#.#05.88.229':445
- '21#.#05.137.20':445
- '21#.#05.180.8':9988
- '21#.#05.213.6':9988
- '21#.#05.26.179':9988
- '21#.#05.68.157':9988
- '21#.#05.22.32':9988
- '21#.#05.136.55':9988
- '21#.#05.213.25':9988
- '21#.#05.232.48':9988
- '21#.#05.79.136':9988
- '21#.#05.228.141':9988
- '21#.#05.184.87':9988
- '21#.#05.68.211':9988
- '21#.#05.11.44':9988
- '21#.#05.72.95':9988
- '21#.#05.145.104':9988
- '21#.#05.137.30':9988
- '21#.#05.192.251':9988
- '21#.#05.30.254':9988
- '21#.#05.7.180':9988
- '21#.#05.137.20':9988
- '21#.#05.79.48':9988
- '21#.#05.173.187':9988
- '21#.#05.82.129':9988
- '21#.#05.117.55':9988
- '21#.#05.100.194':9988
- '21#.#05.113.151':9988
- '21#.#05.30.8':9988
- '21#.#05.82.17':9988
- '21#.#05.105.64':9988
- '21#.#05.36.246':9988
- '21#.#05.33.11':9988
- '21#.#05.42.222':9988
- '21#.#05.225.106':9988
- '21#.#05.88.229':9988
- '21#.#05.158.35':9988
- '21#.#05.244.168':9988
- '21#.#05.58.220':9988
- '21#.#05.152.127':9988
- '21#.#05.173.187':445
- '21#.#05.79.48':139
- '21#.#05.30.8':139
- '21#.#05.225.61':139
- '21#.#05.87.149':139
- '21#.#05.117.55':139
- '21#.#05.22.32':139
- '21#.#05.100.194':139
- '21#.#05.100.16':139
- '21#.#05.173.187':139
- '21#.#05.136.126':139
- '21#.#05.33.11':139
- '21#.#05.137.20':139
- '21#.#05.88.229':139
- '21#.#05.11.44':139
- '21#.#05.225.106':139
- '21#.#05.184.87':139
- '21#.#05.82.17':139
- '21#.#05.137.30':139
- '21#.#05.129.84':139
- '21#.#05.16.39':139
- '21#.#05.42.222':139
- '21#.#05.232.48':139
- '21#.#05.113.151':139
- '21#.#05.82.129':139
- '21#.#05.222.0':139
- '21#.#05.36.56':139
- '21#.#05.105.64':139
- '21#.#05.213.25':139
- '21#.#05.79.136':139
- '21#.#05.7.180':139
- '21#.#05.145.104':139
- '21#.#05.0.43':139
- '21#.#05.228.141':139
- '21#.#05.213.6':139
- '21#.#05.155.91':139
- '21#.#05.244.168':139
- '21#.#05.85.124':139
- '21#.#05.165.136':139
- '21#.#05.228.141':445
- '21#.#05.155.91':445
- '21#.#05.232.48':445
- '21#.#05.145.104':445
- '21#.#05.213.6':445
- '21#.#05.244.168':445
- '21#.#05.113.151':445
- '21#.#05.7.180':445
- '21#.#05.16.39':445
- '21#.#05.30.8':445
- '21#.#05.22.32':445
- '21#.#05.79.48':445
- '21#.#05.100.16':445
- '21#.#05.100.194':445
- '21#.#05.79.136':445
- '21#.#05.85.124':445
- '21#.#05.129.84':445
- '21#.#05.0.43':445
- '21#.#05.42.222':445
- '21#.#05.26.179':139
- '21#.#05.180.8':139
- '21#.#05.30.254':139
- '21#.#05.68.211':139
- '21#.#05.136.55':139
- '21#.#05.72.95':139
- '21#.#05.36.246':139
- '21#.#05.73.181':139
- '21#.#05.68.157':139
- '21#.#05.222.0':445
- '21#.#05.213.25':445
- '21#.#05.82.129':445
- '21#.#05.105.64':445
- '21#.#05.36.56':445
- '21#.#05.58.220':139
- '21#.#05.158.35':139
- '21#.#05.152.127':139
- '21#.#05.192.251':139
