Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERf041.dir00\svchost.exe.mdmp 16325836412032372
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WERf041.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '59.##0.51.213':445
- '59.##0.68.130':445
- '59.##0.161.232':9988
- '59.##0.188.235':9988
- '59.##0.150.211':445
- '59.#30.1.78':445
- '59.##0.29.208':445
- '59.##0.26.10':445
- '59.##0.10.63':445
- '59.##0.178.224':9988
- '59.##0.3.190':9988
- '59.##0.112.38':9988
- '59.##0.38.35':9988
- '59.##0.146.148':9988
- '59.##0.183.141':9988
- '59.##0.42.176':9988
- '59.##0.191.244':9988
- '59.##0.143.228':9988
- '59.##0.86.45':445
- '59.##0.167.86':445
- '59.##0.115.193':445
- '59.##0.68.21':445
- '59.##0.32.18':445
- '59.##0.163.141':445
- '59.##0.103.115':445
- '59.##0.173.31':445
- '59.##0.3.190':445
- '59.##0.23.244':445
- '59.##0.117.86':445
- '59.##0.159.153':445
- '59.##0.167.166':445
- '59.##0.150.117':445
- '59.##0.209.190':445
- '59.##0.37.23':445
- '59.##0.21.88':445
- '59.##0.46.250':445
- '59.##0.52.14':445
- '59.##0.2.140':9988
- '59.##0.51.213':9988
- '59.##0.150.211':9988
- '59.##0.68.130':9988
- '59.##0.117.86':9988
- '59.##0.209.190':9988
- '59.##0.150.117':9988
- '59.##0.29.208':9988
- '59.##0.167.166':9988
- '59.##0.26.10':9988
- '59.##0.30.210':9988
- '59.##0.39.38':9988
- '59.##0.23.244':9988
- '59.##0.170.221':9988
- '59.##0.41.162':9988
- '59.#30.1.78':9988
- '59.##0.37.23':9988
- '59.##0.10.63':9988
- '59.##0.173.31':9988
- '59.##0.159.153':9988
- '59.##0.88.25':9988
- '59.##0.153.189':9988
- '59.##0.183.26':9988
- '59.##0.115.193':9988
- '59.##0.146.234':9988
- '59.##0.127.35':9988
- '59.##0.211.19':9988
- '59.##0.228.190':9988
- '59.##0.166.51':9988
- '59.##0.46.250':9988
- '59.##0.163.141':9988
- '59.##0.86.45':9988
- '59.##0.21.88':9988
- '59.##0.68.21':9988
- '59.##0.52.14':9988
- '59.##0.103.115':9988
- '59.##0.188.153':9988
- '59.##0.167.86':9988
- '59.##0.183.26':445
- '59.##0.173.31':139
- '59.##0.183.26':139
- '59.##0.103.115':139
- '59.##0.23.244':139
- '59.##0.188.153':139
- '59.##0.88.25':139
- '59.##0.113.243':139
- '59.##0.153.189':139
- '59.##0.178.224':139
- '59.##0.21.88':139
- '59.##0.68.21':139
- '59.##0.52.14':139
- '59.##0.37.23':139
- '59.##0.32.18':139
- '59.##0.163.141':139
- '59.##0.3.190':139
- '59.##0.167.86':139
- '59.##0.115.193':139
- '59.##0.146.234':139
- '59.##0.30.210':139
- '59.##0.41.162':139
- '59.##0.38.35':139
- '59.##0.183.141':139
- '59.##0.127.35':139
- '59.##0.191.244':139
- '59.##0.161.232':139
- '59.##0.146.148':139
- '59.##0.2.140':139
- '59.##0.166.51':139
- '59.##0.211.19':139
- '59.##0.170.221':139
- '59.##0.188.235':139
- '59.##0.143.228':139
- '59.##0.112.38':139
- '59.##0.39.38':139
- '59.##0.228.190':139
- '59.##0.42.176':139
- '59.##0.46.250':139
- '59.##0.228.190':445
- '59.##0.42.176':445
- '59.##0.211.19':445
- '59.##0.143.228':445
- '59.##0.112.38':445
- '59.##0.183.141':445
- '59.##0.30.210':445
- '59.##0.39.38':445
- '59.##0.38.35':445
- '59.##0.178.224':445
- '59.##0.88.25':445
- '59.##0.188.153':445
- '59.##0.153.189':445
- '59.##0.113.243':445
- '59.##0.188.235':445
- '59.##0.166.51':445
- '59.##0.146.234':445
- '59.##0.170.221':445
- '59.##0.146.148':445
- '59.#30.1.78':139
- '59.##0.86.45':139
- '59.##0.10.63':139
- '59.##0.29.208':139
- '59.##0.167.166':139
- '59.##0.159.153':139
- '59.##0.209.190':139
- '59.##0.150.117':139
- '59.##0.117.86':139
- '59.##0.41.162':445
- '59.##0.2.140':445
- '59.##0.191.244':445
- '59.##0.127.35':445
- '59.##0.161.232':445
- '59.##0.150.211':139
- '59.##0.26.10':139
- '59.##0.51.213':139
- '59.##0.68.130':139
