Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER7240.dir00\svchost.exe.mdmp 16325836412032144
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WER7240.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '21#.#3.194.64':445
- '21#.#3.49.131':445
- '21#.#3.254.155':445
- '21#.43.8.0':445
- '21#.#3.110.202':445
- '21#.#3.103.98':445
- '21#.#3.139.200':445
- '21#.#3.202.170':445
- '21#.#3.246.198':445
- '21#.#3.42.223':9988
- '21#.#3.24.237':9988
- '21#.#3.109.181':9988
- '21#.#3.158.133':9988
- '21#.#3.76.240':9988
- '21#.#3.208.4':445
- '21#.#3.184.254':445
- '21#.#3.132.116':9988
- '21#.#3.145.181':9988
- '21#.#3.31.62':445
- '21#.#3.165.16':445
- '21#.#3.255.210':445
- '21#.#3.80.11':445
- '21#.#3.124.45':445
- '21#.#3.166.231':445
- '21#.#3.21.111':445
- '21#.#3.212.215':445
- '21#.#3.131.246':445
- '21#.#3.52.243':445
- '21#.#3.228.156':445
- '21#.#3.117.143':445
- '21#.#3.110.144':445
- '21#.#3.30.234':445
- '21#.#3.175.178':445
- '21#.#3.158.138':445
- '21#.#3.233.193':445
- '21#.#3.32.54':445
- '21#.#3.139.200':9988
- '21#.#3.117.143':9988
- '21#.#3.246.198':9988
- '21#.#3.103.98':9988
- '21#.#3.110.144':9988
- '21#.#3.80.11':9988
- '21#.#3.175.178':9988
- '21#.#3.52.243':9988
- '21#.#3.228.156':9988
- '21#.#3.254.155':9988
- '21#.43.8.0':9988
- '21#.#3.208.4':9988
- '21#.#3.184.254':9988
- '21#.#3.194.64':9988
- '21#.#3.158.138':9988
- '21#.#3.110.202':9988
- '21#.#3.49.131':9988
- '21#.#3.202.170':9988
- '21#.#3.97.81':9988
- '21#.#3.40.159':9988
- '21#.#3.55.75':9988
- '21#.#3.247.240':9988
- '21#.#3.255.110':9988
- '21#.#3.212.215':9988
- '21#.#3.115.66':9988
- '21#.#3.17.180':9988
- '21#.#3.233.193':9988
- '21#.#3.31.62':9988
- '21#.#3.124.45':9988
- '21#.#3.255.210':9988
- '21#.#3.165.16':9988
- '21#.#3.131.246':9988
- '21#.#3.80.31':9988
- '21#.#3.181.69':9988
- '21#.#3.21.188':9988
- '21#.#3.28.208':9988
- '21#.#3.21.188':445
- '21#.#3.131.246':139
- '21#.#3.166.231':139
- '21#.#3.124.45':139
- '21#.#3.212.215':139
- '21#.#3.21.111':139
- '21#.#3.91.59':139
- '21#.#3.94.228':139
- '21#.#3.21.188':139
- '21#.#3.115.66':139
- '21#.#3.32.54':139
- '21#.#3.175.178':139
- '21#.#3.30.234':139
- '21#.#3.233.193':139
- '21#.#3.158.138':139
- '21#.#3.31.62':139
- '21#.#3.165.16':139
- '21#.#3.255.210':139
- '21#.#3.80.11':139
- '21#.#3.97.81':139
- '21#.#3.8.158':139
- '21#.#3.76.240':139
- '21#.#3.132.116':139
- '21#.#3.47.102':139
- '21#.#3.40.159':139
- '21#.#3.17.180':139
- '21#.#3.145.181':139
- '21#.#3.255.110':139
- '21#.#3.109.181':139
- '21#.#3.181.69':139
- '21#.#3.80.31':139
- '21#.#3.28.208':139
- '21#.#3.158.133':139
- '21#.#3.24.237':139
- '21#.#3.247.240':139
- '21#.#3.42.223':139
- '21#.#3.55.75':139
- '21#.#3.247.240':445
- '21#.#3.76.240':445
- '21#.#3.55.75':445
- '21#.#3.24.237':445
- '21#.#3.132.116':445
- '21#.#3.255.110':445
- '21#.#3.47.102':445
- '21#.#3.40.159':445
- '21#.#3.97.81':445
- '21#.#3.94.228':445
- '21#.#3.80.31':445
- '21#.#3.115.66':445
- '21#.#3.91.59':445
- '21#.#3.28.208':445
- '21#.#3.158.133':445
- '21#.#3.42.223':445
- '21#.#3.109.181':445
- '21#.#3.181.69':445
- '21#.#3.246.198':139
- '21#.#3.103.98':139
- '21#.#3.110.202':139
- '21#.#3.202.170':139
- '21#.#3.139.200':139
- '21#.#3.52.243':139
- '21#.#3.228.156':139
- '21#.#3.117.143':139
- '21#.#3.110.144':139
- '21#.#3.145.181':445
- '21#.#3.208.4':139
- '21#.#3.17.180':445
- '21#.#3.8.158':445
- '21#.#3.184.254':139
- '21#.#3.194.64':139
- '21#.#3.49.131':139
- '21#.#3.254.155':139
- '21#.43.8.0':139
