Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERd91d.dir00\svchost.exe.mdmp 16325836412032228
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERd91d.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '19#.#39.182.158':9988
- '19#.#39.26.34':9988
- '19#.#39.82.53':9988
- '19#.#39.190.228':9988
- '19#.#39.213.43':9988
- '19#.#39.246.32':9988
- '19#.#39.3.69':9988
- '19#.#39.49.44':9988
- '19#.#39.58.26':9988
- '19#.#39.226.200':9988
- '19#.#39.87.205':9988
- '19#.#39.203.32':9988
- '19#.#39.154.127':9988
- '19#.#39.87.5':9988
- '19#.#39.45.153':9988
- '19#.#39.172.244':9988
- '19#.#39.66.151':9988
- '19#.#39.151.182':9988
- '19#.#39.14.147':9988
- '19#.#39.41.239':9988
- '19#.#39.203.72':9988
- '19#.#39.178.148':9988
- '19#.#39.58.26':445
- '19#.#39.233.64':445
- '19#.#39.126.109':445
- '19#.#39.148.19':445
- '19#.#39.235.179':445
- '19#.#39.157.113':445
- '19#.#39.11.222':445
- '19#.#39.185.194':445
- '19#.#39.214.189':445
- '19#.#39.87.205':445
- '19#.#39.203.147':445
- '19#.#39.36.31':9988
- '19#.#39.212.66':9988
- '19#.#39.14.238':9988
- '19#.#39.27.199':9988
- '19#.#39.244.60':9988
- '19#.#39.22.73':9988
- '19#.#39.3.69':445
- '19#.#39.177.125':445
- '19#.#39.158.7':9988
- '19#.#39.71.120':9988
- '19#.#39.106.216':9988
- '19#.#39.42.46':9988
- '19#.#39.69.251':139
- '19#.#39.14.208':139
- '19#.#39.53.32':139
- '19#.#39.28.193':139
- '19#.#39.149.82':139
- '19#.#39.171.225':139
- '19#.#39.184.223':139
- '19#.#39.34.193':139
- '19#.#39.169.67':139
- '19#.#39.178.224':139
- '19#.#39.225.79':139
- '19#.#39.243.204':139
- '19#.#39.103.26':139
- '19#.#39.230.237':139
- '19#.#39.167.180':445
- '19#.#39.230.176':139
- '19#.#39.26.42':139
- '19#.#39.25.203':139
- '19#.#39.38.185':139
- '19#.#39.5.60':139
- '19#.#39.246.5':139
- '19#.#39.27.93':139
- '19#.#39.177.125':9988
- '19#.#39.148.19':9988
- '19#.#39.126.109':9988
- '19#.#39.88.156':9988
- '19#.#39.235.179':9988
- '19#.#39.203.147':9988
- '19#.#39.11.222':9988
- '19#.#39.11.61':9988
- '19#.#39.185.194':9988
- '19#.#39.214.189':9988
- '19#.#39.157.113':9988
- '19#.#39.233.64':9988
- '19#.#39.61.36':9988
- '19#.#39.167.180':139
- '19#.#39.128.160':139
- '19#.#39.231.65':139
- '19#.#39.54.71':9988
- '19#.#39.158.119':9988
- '19#.#39.163.106':9988
- '19#.#39.183.75':9988
- '19#.#39.249.133':9988
- '19#.#39.158.129':9988
- '19#.#39.45.153':139
- '19#.#39.212.66':139
- '19#.#39.42.46':139
- '19#.#39.36.31':139
- '19#.#39.14.238':139
- '19#.#39.87.5':139
- '19#.#39.172.244':139
- '19#.#39.54.71':139
- '19#.#39.249.133':139
- '19#.#39.203.32':139
- '19#.#39.154.127':139
- '19#.#39.11.222':139
- '19#.#39.58.26':139
- '19#.#39.233.64':139
- '19#.#39.157.113':139
- '19#.#39.87.205':139
- '19#.#39.185.194':139
- '19#.#39.11.61':139
- '19#.#39.61.36':139
- '19#.#39.244.60':139
- '19#.#39.27.199':139
- '19#.#39.49.44':139
- '19#.#39.213.43':139
- '19#.#39.182.158':139
- '19#.#39.26.34':139
- '19#.#39.246.32':139
- '19#.#39.151.182':139
- '19#.#39.71.120':139
- '19#.#39.158.129':139
- '19#.#39.178.148':139
- '19#.#39.158.7':139
- '19#.#39.226.200':139
- '19#.#39.41.239':139
- '19#.#39.183.75':139
- '19#.#39.163.106':139
- '19#.#39.203.72':139
- '19#.#39.66.151':139
- '19#.#39.22.73':139
- '19#.#39.106.216':139
- '19#.#39.190.228':139
- '19#.#39.82.53':139
- '19#.#39.158.119':139
- '19#.#39.14.147':139
- '19#.#39.88.156':139
- '19#.#39.203.147':139
- '19#.#39.249.133':445
- '19#.#39.172.244':445
- '19#.#39.54.71':445
- '19#.#39.87.5':445
- '19#.#39.154.127':445
- '19#.#39.66.151':445
- '19#.#39.183.75':445
- '19#.#39.106.216':445
- '19#.#39.163.106':445
- '19#.#39.203.72':445
- '19#.#39.22.73':445
- '19#.#39.244.60':445
- '19#.#39.11.61':445
- '19#.#39.61.36':445
- '19#.#39.27.199':445
- '19#.#39.49.44':445
- '19#.#39.42.46':445
- '19#.#39.203.32':445
- '19#.#39.212.66':445
- '19#.#39.14.238':445
- '19#.#39.45.153':445
- '19#.#39.36.31':445
- '19#.#39.246.32':445
- '19#.#39.158.129':445
- '19#.#39.71.120':445
- '19#.#39.26.34':445
- '19#.#39.182.158':445
- '19#.#39.3.69':139
- '19#.#39.126.109':139
- '19#.#39.214.189':139
- '19#.#39.235.179':139
- '19#.#39.177.125':139
- '19#.#39.148.19':139
- '19#.#39.151.182':445
- '19#.#39.190.228':445
- '19#.#39.158.7':445
- '19#.#39.14.147':445
- '19#.#39.88.156':445
- '19#.#39.82.53':445
- '19#.#39.226.200':445
- '19#.#39.41.239':445
- '19#.#39.158.119':445
- '19#.#39.213.43':445
- '19#.#39.178.148':445
