Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERdbc0.dir00\svchost.exe.mdmp 16325836412027852
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERdbc0.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '65.##5.64.198':445
- '65.##5.31.73':445
- '65.##5.89.64':445
- '65.##5.220.187':445
- '65.##5.209.194':445
- '65.##5.194.138':445
- '65.##5.180.66':445
- '65.##5.62.154':445
- '65.##5.177.97':445
- '65.##5.70.166':445
- '65.##5.165.233':445
- '65.##5.48.13':445
- '65.##5.9.238':445
- '65.##5.139.134':445
- '65.##5.197.216':445
- '65.##5.15.43':445
- '65.##5.32.122':445
- '65.##5.157.167':445
- '65.##5.139.1':445
- '65.##5.166.20':445
- '65.##5.62.179':445
- '65.#05.2.74':445
- '65.##5.1.250':445
- '65.##5.209.24':445
- '65.##5.172.235':445
- '65.##5.195.147':445
- '65.##5.62.49':445
- '65.##5.240.17':445
- '65.##5.28.253':445
- '65.##5.195.147':9988
- '65.##5.139.1':9988
- '65.##5.180.66':9988
- '65.##5.240.17':9988
- '65.##5.4.158':445
- '65.##5.130.12':445
- '65.##5.166.20':9988
- '65.##5.227.16':9988
- '65.##5.28.253':9988
- '65.##5.124.11':9988
- '65.##5.128.207':9988
- '65.##5.31.73':9988
- '65.#05.25.8':9988
- '65.##5.89.64':9988
- '65.##5.11.60':445
- '65.##5.124.11':445
- '65.##5.29.40':445
- '65.##5.59.127':445
- '65.##5.85.230':445
- '65.##5.187.184':445
- '65.##5.200.114':445
- '65.##5.103.120':445
- '65.##5.151.118':445
- '65.##5.18.220':445
- '65.##5.230.103':445
- '65.##5.69.249':445
- '65.##5.227.16':445
- '65.##5.120.39':445
- '65.##5.1.250':139
- '65.##5.209.24':139
- '65.##5.209.194':139
- '65.#05.2.74':139
- '65.##5.195.147':139
- '65.##5.240.17':139
- '65.##5.172.235':139
- '65.##5.89.64':139
- '65.##5.31.73':139
- '65.##5.139.134':139
- '65.##5.64.198':139
- '65.##5.194.138':139
- '65.##5.220.187':139
- '65.##5.180.66':139
- '65.##5.166.20':139
- '65.##5.46.119':139
- '65.##5.139.1':139
- '65.##5.110.243':139
- '65.##5.141.120':139
- '65.##5.209.61':139
- '65.#05.25.8':139
- '65.##5.62.49':139
- '65.##5.15.43':139
- '65.##5.32.122':139
- '65.##5.197.216':139
- '65.##5.128.207':139
- '65.##5.157.167':139
- '65.##5.62.179':139
- '65.##5.48.13':139
- '65.##5.151.118':139
- '65.##5.18.220':139
- '65.##5.4.158':139
- '65.##5.230.103':139
- '65.##5.227.16':139
- '65.##5.120.39':139
- '65.##5.103.120':139
- '65.##5.110.243':445
- '65.##5.128.207':445
- '65.##5.46.119':445
- '65.#05.25.8':445
- '65.##5.130.12':139
- '65.##5.141.120':445
- '65.##5.209.61':445
- '65.##5.70.166':139
- '65.##5.28.253':139
- '65.##5.85.230':139
- '65.##5.165.233':139
- '65.##5.9.238':139
- '65.##5.62.154':139
- '65.##5.177.97':139
- '65.##5.124.11':139
- '65.##5.29.40':139
- '65.##5.69.249':139
- '65.##5.11.60':139
- '65.##5.187.184':139
- '65.##5.200.114':139
- '65.##5.59.127':139
