Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER3bae.dir00\svchost.exe.mdmp 16325836412032252
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WER3bae.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '20#.#73.195.81':445
- '20#.#73.81.185':445
- '20#.#73.111.170':445
- '20#.#73.4.222':445
- '20#.#73.185.35':445
- '20#.#73.70.178':445
- '20#.#73.80.94':445
- '20#.#73.62.117':445
- '20#.#73.98.120':445
- '20#.#73.54.220':9988
- '20#.#73.252.252':9988
- '20#.#73.36.93':9988
- '20#.#73.12.112':9988
- '20#.#73.215.184':9988
- '20#.#73.13.18':445
- '20#.#73.148.96':445
- '20#.#73.165.210':9988
- '20#.#73.48.143':445
- '20#.#73.31.7':445
- '20#.#73.18.35':445
- '20#.#73.206.19':445
- '20#.#73.208.240':445
- '20#.#73.96.229':445
- '20#.#73.36.237':445
- '20#.#73.171.96':445
- '20#.#73.147.215':445
- '20#.#73.53.240':445
- '20#.#73.24.95':445
- '20#.#73.126.72':445
- '20#.#73.28.2':445
- '20#.#73.8.21':445
- '20#.#73.52.167':445
- '20#.#73.85.52':445
- '20#.#73.57.208':445
- '20#.#73.3.77':445
- '20#.#73.140.253':445
- '20#.#73.85.52':9988
- '20#.#73.148.96':9988
- '20#.#73.185.35':9988
- '20#.#73.111.170':9988
- '20#.#73.81.185':9988
- '20#.#73.13.18':9988
- '20#.#73.62.117':9988
- '20#.#73.48.143':9988
- '20#.#73.70.178':9988
- '20#.#73.195.81':9988
- '20#.#73.28.2':9988
- '20#.#73.21.200':445
- '20#.#73.21.200':139
- '20#.#73.8.21':9988
- '20#.#73.52.167':9988
- '20#.#73.126.72':9988
- '20#.#73.3.77':9988
- '20#.#73.98.120':9988
- '20#.#73.147.215':9988
- '20#.#73.161.40':9988
- '20#.#73.57.208':9988
- '20#.#73.96.229':9988
- '20#.#73.67.237':9988
- '20#.#73.34.240':9988
- '20#.#73.53.38':9988
- '20#.#73.147.107':9988
- '20#.#73.10.253':9988
- '20#.#73.171.96':9988
- '20#.#73.36.237':9988
- '20#.#73.4.222':9988
- '20#.#73.31.7':9988
- '20#.#73.176.83':9988
- '20#.#73.120.229':9988
- '20#.#73.27.206':9988
- '20#.#73.116.171':9988
- '20#.#73.205.209':9988
- '20#.#73.147.215':139
- '20#.#73.53.240':139
- '20#.#73.18.35':139
- '20#.#73.96.229':139
- '20#.#73.36.237':139
- '20#.#73.67.237':139
- '20#.#73.176.83':139
- '20#.#73.171.96':139
- '20#.#73.161.40':139
- '20#.#73.3.77':139
- '20#.#73.140.253':139
- '20#.#73.126.72':139
- '20#.#73.52.167':139
- '20#.#73.85.52':139
- '20#.#73.208.240':139
- '20#.#73.31.7':139
- '20#.#73.57.208':139
- '20#.#73.206.19':139
- '20#.#73.27.206':139
- '20#.#73.36.93':139
- '20#.#73.53.38':139
- '20#.#73.199.27':139
- '20#.#73.12.112':139
- '20#.#73.165.210':139
- '20#.#73.215.184':139
- '20#.#73.54.220':139
- '20#.#73.252.252':139
- '20#.#73.10.253':139
- '20#.#73.34.240':139
- '20#.#73.116.171':139
- '20#.#73.147.107':139
- '20#.#73.47.219':139
- '20#.#73.205.209':139
- '20#.#73.59.130':139
- '20#.#73.170.180':139
- '20#.#73.120.229':139
- '20#.#73.59.130':445
- '20#.#73.53.38':445
- '20#.#73.120.229':445
- '20#.#73.205.209':445
- '20#.#73.199.27':445
- '20#.#73.12.112':445
- '20#.#73.54.220':445
- '20#.#73.27.206':445
- '20#.#73.36.93':445
- '20#.#73.176.83':445
- '20#.#73.116.171':445
- '20#.#73.161.40':445
- '20#.#73.67.237':445
- '20#.#73.147.107':445
- '20#.#73.47.219':445
- '20#.#73.170.180':445
- '20#.#73.10.253':445
- '20#.#73.34.240':445
- '20#.#73.62.117':139
- '20#.#73.98.120':139
- '20#.#73.81.185':139
- '20#.#73.185.35':139
- '20#.#73.70.178':139
- '20#.#73.8.21':139
- '20#.#73.24.95':139
- '20#.#73.80.94':139
- '20#.#73.28.2':139
- '20#.#73.165.210':445
- '20#.#73.48.143':139
- '20#.#73.252.252':445
- '20#.#73.215.184':445
- '20#.#73.13.18':139
- '20#.#73.4.222':139
- '20#.#73.195.81':139
- '20#.#73.148.96':139
- '20#.#73.111.170':139
