Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER7cb4.dir00\svchost.exe.mdmp 16325836412029936
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER7cb4.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '21#.#4.82.85':445
- '21#.#4.65.152':445
- '21#.#4.36.11':445
- '21#.#4.42.210':445
- '21#.#4.56.236':445
- '21#.#4.63.132':445
- '21#.#4.8.150':445
- '21#.#4.96.70':445
- '21#.#4.35.80':445
- '21#.#4.29.39':9988
- '21#.#4.25.106':9988
- '21#.#4.41.195':9988
- '21#.#4.107.116':9988
- '21#.#4.98.153':9988
- '21#.#4.89.12':9988
- '21#.#4.32.76':9988
- '21#.#4.68.26':9988
- '21#.#4.52.251':9988
- '21#.#4.101.82':445
- '21#.#4.155.64':445
- '21#.#4.151.19':445
- '21#.#4.233.199':445
- '21#.#4.106.84':445
- '21#.#4.127.175':445
- '21#.#4.163.143':445
- '21#.#4.204.92':445
- '21#.#4.57.51':445
- '21#.#4.98.153':445
- '21#.#4.233.170':445
- '21#.#4.170.78':445
- '21#.#4.56.95':445
- '21#.#4.41.128':445
- '21#.#4.82.63':445
- '21#.#4.223.122':445
- '21#.#4.69.234':445
- '21#.#4.77.162':445
- '21#.#4.249.46':445
- '21#.#4.82.63':9988
- '21#.#4.8.150':9988
- '21#.#4.35.80':9988
- '21#.#4.170.78':9988
- '21#.#4.170.217':9988
- '21#.#4.249.46':9988
- '21#.#4.77.162':9988
- '21#.#4.233.170':9988
- '21#.#4.163.143':9988
- '21#.#4.82.85':9988
- '21#.#4.36.11':9988
- '21#.#4.155.64':9988
- '21#.#4.42.210':9988
- '21#.#4.56.236':9988
- '21#.#4.65.152':9988
- '21#.#4.96.70':9988
- '21#.#4.101.82':9988
- '21#.#4.41.128':9988
- '21#.#4.69.234':9988
- '21#.#4.204.92':9988
- '21#.#4.185.158':9988
- '21#.#4.190.94':9988
- '21#.#4.62.225':9988
- '21#.#4.179.28':9988
- '21#.#4.34.108':9988
- '21#.#4.117.44':9988
- '21#.#4.139.252':9988
- '21#.#4.27.185':9988
- '21#.#4.151.19':9988
- '21#.#4.106.84':9988
- '21#.#4.233.199':9988
- '21#.#4.223.122':9988
- '21#.#4.57.51':9988
- '21#.#4.61.34':9988
- '21#.#4.188.199':9988
- '21#.#4.127.175':9988
- '21#.#4.245.40':9988
- '21#.#4.98.153':139
- '21#.#4.163.143':139
- '21#.#4.127.175':139
- '21#.#4.57.51':139
- '21#.#4.204.92':139
- '21#.#4.25.103':139
- '21#.#4.139.252':139
- '21#.#4.61.34':139
- '21#.#4.245.40':139
- '21#.#4.249.46':139
- '21#.#4.223.122':139
- '21#.#4.82.63':139
- '21#.#4.77.162':139
- '21#.#4.69.234':139
- '21#.#4.151.19':139
- '21#.#4.155.64':139
- '21#.#4.233.199':139
- '21#.#4.106.84':139
- '21#.#4.179.28':139
- '21#.#4.43.27':139
- '21#.#4.25.106':139
- '21#.#4.170.217':139
- '21#.#4.117.44':139
- '21#.#4.68.26':139
- '21#.#4.34.108':139
- '21#.#4.41.195':139
- '21#.#4.89.12':139
- '21#.#4.107.116':139
- '21#.#4.190.94':139
- '21#.#4.62.225':139
- '21#.#4.27.185':139
- '21#.#4.185.158':139
- '21#.#4.157.211':139
- '21#.#4.188.199':139
- '21#.#4.52.251':139
- '21#.#4.32.76':139
- '21#.#4.29.39':139
- '21#.#4.29.39':445
- '21#.#4.188.199':445
- '21#.#4.157.211':445
- '21#.#4.32.76':445
- '21#.#4.52.251':445
- '21#.#4.43.27':445
- '21#.#4.107.116':445
- '21#.#4.170.217':445
- '21#.#4.117.44':445
- '21#.#4.25.103':445
- '21#.#4.139.252':445
- '21#.#4.61.34':445
- '21#.#4.245.40':445
- '21#.#4.179.28':445
- '21#.#4.190.94':445
- '21#.#4.62.225':445
- '21#.#4.27.185':445
- '21#.#4.185.158':445
- '21#.#4.25.106':445
- '21#.#4.63.132':139
- '21#.#4.8.150':139
- '21#.#4.96.70':139
- '21#.#4.35.80':139
- '21#.#4.101.82':139
- '21#.#4.233.170':139
- '21#.#4.170.78':139
- '21#.#4.56.95':139
- '21#.#4.41.128':139
- '21#.#4.41.195':445
- '21#.#4.68.26':445
- '21#.#4.34.108':445
- '21#.#4.89.12':445
- '21#.#4.36.11':139
- '21#.#4.65.152':139
- '21#.#4.56.236':139
- '21#.#4.42.210':139
- '21#.#4.82.85':139
