Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERfb82.dir00\svchost.exe.mdmp 16325836412032892
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %TEMP%\WERfb82.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '83.##.221.55':445
- '83.##.194.251':445
- '83.##.37.242':9988
- '83.##.36.231':445
- '83.##.127.239':445
- '83.##.43.152':445
- '83.##.126.59':445
- '83.##.96.102':445
- '83.##.214.125':445
- '83.##.221.55':9988
- '83.##.47.115':9988
- '83.##.148.191':9988
- '83.##.110.115':9988
- '83.##.100.211':9988
- '83.##.126.59':9988
- '83.#8.4.240':9988
- '83.##.122.132':9988
- '83.##.194.251':9988
- '83.##.46.121':445
- '83.##.124.253':445
- '83.##.192.207':445
- '83.#8.69.55':445
- '83.##.33.243':445
- '83.#8.147.0':445
- '83.#8.18.49':445
- '83.##.149.214':445
- '83.##.79.193':445
- '83.##.26.105':445
- '83.##.161.51':445
- '83.##.234.56':445
- '83.##.152.75':445
- '83.##.47.115':445
- '83.##.102.189':445
- '83.##.140.48':445
- '83.##.241.22':445
- '83.##.47.174':445
- '83.#8.4.208':445
- '83.##.210.162':9988
- '83.##.152.75':9988
- '83.##.11.177':9988
- '83.##.241.22':9988
- '83.##.191.242':9988
- '83.##.133.126':9988
- '83.##.43.152':9988
- '83.##.140.48':9988
- '83.#8.69.55':9988
- '83.#8.147.0':9988
- '83.##.127.239':9988
- '83.##.36.231':9988
- '83.##.214.125':9988
- '83.##.46.121':9988
- '83.##.67.230':9988
- '83.##.234.56':9988
- '83.##.102.189':9988
- '83.##.62.221':9988
- '83.##.60.159':9988
- '83.##.215.62':9988
- '83.##.192.207':9988
- '83.##.16.181':9988
- '83.##.149.214':9988
- '83.##.79.193':9988
- '83.##.221.148':9988
- '83.##.161.51':9988
- '83.##.179.76':9988
- '83.##.21.214':9988
- '83.##.79.233':9988
- '83.##.92.111':9988
- '83.##.193.85':9988
- '83.##.96.102':9988
- '83.##.178.105':9988
- '83.##.124.253':9988
- '83.#8.4.208':9988
- '83.#8.18.49':9988
- '83.##.202.55':9988
- '83.##.47.174':9988
- '83.##.178.105':139
- '83.#8.18.49':139
- '83.##.79.193':139
- '83.##.202.55':139
- '83.##.26.105':139
- '83.##.62.221':139
- '83.##.221.148':139
- '83.##.149.214':139
- '83.##.215.62':139
- '83.##.140.48':139
- '83.##.241.22':139
- '83.#8.4.208':139
- '83.##.47.174':139
- '83.#8.69.55':139
- '83.##.124.253':139
- '83.#8.147.0':139
- '83.##.33.243':139
- '83.##.192.207':139
- '83.##.16.181':139
- '83.##.210.162':139
- '83.##.122.132':139
- '83.##.133.126':139
- '83.##.21.214':139
- '83.##.110.115':139
- '83.##.79.233':139
- '83.##.100.211':139
- '83.##.179.76':139
- '83.##.37.242':139
- '83.##.193.85':139
- '83.##.60.159':139
- '83.##.51.221':139
- '83.##.11.177':139
- '83.##.148.191':139
- '83.##.191.242':139
- '83.##.67.230':139
- '83.##.92.111':139
- '83.#8.4.240':139
- '83.##.102.189':139
- '83.##.92.111':445
- '83.##.191.242':445
- '83.##.60.159':445
- '83.#8.4.240':445
- '83.##.148.191':445
- '83.##.210.162':445
- '83.##.21.214':445
- '83.##.67.230':445
- '83.##.133.126':445
- '83.##.215.62':445
- '83.##.62.221':445
- '83.##.178.105':445
- '83.##.202.55':445
- '83.##.221.148':445
- '83.##.11.177':445
- '83.##.193.85':445
- '83.##.16.181':445
- '83.##.51.221':445
- '83.##.122.132':445
- '83.##.126.59':139
- '83.##.46.121':139
- '83.##.36.231':139
- '83.##.214.125':139
- '83.##.43.152':139
- '83.##.161.51':139
- '83.##.234.56':139
- '83.##.152.75':139
- '83.##.47.115':139
- '83.##.37.242':445
- '83.##.79.233':445
- '83.##.110.115':445
- '83.##.179.76':445
- '83.##.100.211':445
- '83.##.194.251':139
- '83.##.127.239':139
- '83.##.221.55':139
- '83.##.96.102':139
