Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER1d73.dir00\svchost.exe.mdmp 16325836412032244
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %TEMP%\WER1d73.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '61.##9.150.43':9988
- '61.##9.202.58':445
- '61.##9.187.26':9988
- '61.##9.225.61':9988
- '61.##9.79.11':445
- '61.##9.59.148':445
- '61.##9.234.21':445
- '61.##9.32.152':445
- '61.##9.234.90':445
- '61.##9.182.132':9988
- '61.##9.228.106':9988
- '61.##9.72.158':9988
- '61.##9.71.198':9988
- '61.##9.241.70':9988
- '61.##9.129.138':9988
- '61.##9.179.196':9988
- '61.##9.129.72':9988
- '61.##9.148.220':9988
- '61.##9.105.222':9988
- '61.##9.94.249':445
- '61.##9.75.74':445
- '61.##9.241.70':445
- '61.##9.225.61':445
- '61.##9.148.220':445
- '61.##9.129.82':445
- '61.##9.103.34':445
- '61.##9.150.43':445
- '61.##9.179.196':445
- '61.##9.20.95':445
- '61.##9.97.146':445
- '61.##9.70.63':445
- '61.##9.81.193':445
- '61.##9.14.178':445
- '61.##9.98.186':445
- '61.##9.74.100':445
- '61.##9.129.72':445
- '61.##9.162.120':445
- '61.##9.103.41':445
- '61.##9.202.58':9988
- '61.##9.98.186':9988
- '61.##9.85.74':9988
- '61.##9.235.231':9988
- '61.##9.162.120':9988
- '61.##9.138.107':9988
- '61.##9.103.34':9988
- '61.##9.59.148':9988
- '61.##9.75.74':9988
- '61.##9.103.41':9988
- '61.##9.14.178':9988
- '61.##9.81.193':9988
- '61.##9.234.21':9988
- '61.##9.32.152':9988
- '61.##9.97.146':9988
- '61.##9.20.95':9988
- '61.##9.129.82':9988
- '61.##9.234.90':9988
- '61.##9.94.249':9988
- '61.##9.221.212':9988
- '61.##9.179.79':9988
- '61.#09.5.82':9988
- '61.##9.249.112':9988
- '61.##9.83.178':9988
- '61.##9.48.14':9988
- '61.##9.79.11':9988
- '61.##9.165.162':9988
- '61.##9.121.253':9988
- '61.##9.182.198':9988
- '61.##9.74.100':9988
- '61.##9.156.41':9988
- '61.#09.83.5':9988
- '61.##9.123.6':9988
- '61.##9.70.63':9988
- '61.##9.153.4':9988
- '61.##9.164.113':9988
- '61.##9.71.75':9988
- '61.##9.97.123':9988
- '61.##9.138.107':445
- '61.##9.235.231':139
- '61.##9.129.138':139
- '61.##9.103.34':139
- '61.##9.20.95':139
- '61.##9.138.107':139
- '61.##9.187.26':139
- '61.##9.83.178':139
- '61.#09.5.82':139
- '61.##9.228.106':139
- '61.##9.129.82':139
- '61.##9.94.249':139
- '61.##9.148.220':139
- '61.##9.103.41':139
- '61.##9.74.100':139
- '61.##9.150.43':139
- '61.##9.129.72':139
- '61.##9.241.70':139
- '61.##9.225.61':139
- '61.##9.179.196':139
- '61.##9.71.198':139
- '61.##9.121.253':139
- '61.##9.164.113':139
- '61.##9.165.162':139
- '61.##9.182.198':139
- '61.##9.72.158':139
- '61.##9.48.14':139
- '61.#09.83.5':139
- '61.##9.105.222':139
- '61.##9.123.6':139
- '61.##9.85.74':139
- '61.##9.182.132':139
- '61.##9.153.4':139
- '61.##9.156.41':139
- '61.##9.97.123':139
- '61.##9.221.212':139
- '61.##9.249.112':139
- '61.##9.71.75':139
- '61.##9.179.79':139
- '61.##9.182.132':445
- '61.##9.165.162':445
- '61.##9.179.79':445
- '61.##9.97.123':445
- '61.##9.71.198':445
- '61.##9.221.212':445
- '61.##9.164.113':445
- '61.##9.153.4':445
- '61.##9.249.112':445
- '61.##9.156.41':445
- '61.#09.5.82':445
- '61.##9.228.106':445
- '61.##9.129.138':445
- '61.##9.235.231':445
- '61.##9.187.26':445
- '61.##9.83.178':445
- '61.##9.123.6':445
- '61.##9.85.74':445
- '61.##9.71.75':445
- '61.##9.70.63':139
- '61.##9.81.193':139
- '61.##9.14.178':139
- '61.##9.234.21':139
- '61.##9.97.146':139
- '61.##9.162.120':139
- '61.##9.75.74':139
- '61.##9.202.58':139
- '61.##9.98.186':139
- '61.##9.79.11':139
- '61.#09.83.5':445
- '61.##9.105.222':445
- '61.##9.182.198':445
- '61.##9.48.14':445
- '61.##9.121.253':445
- '61.##9.59.148':139
- '61.##9.234.90':139
- '61.##9.72.158':445
- '61.##9.32.152':139
