Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERc417.dir00\svchost.exe.mdmp 16325836412032068
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WERc417.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '21#.#6.176.9':445
- '21#.#6.19.73':445
- '21#.#6.46.47':9988
- '21#.#6.60.69':445
- '21#.26.96.2':445
- '21#.#6.13.123':445
- '21#.#6.15.87':445
- '21#.#6.96.117':445
- '21#.26.0.56':445
- '21#.#6.94.168':9988
- '21#.26.85.0':9988
- '21#.#6.201.224':9988
- '21#.#6.35.29':9988
- '21#.#6.77.145':9988
- '21#.#6.2.192':9988
- '21#.#6.206.41':9988
- '21#.#6.149.214':9988
- '21#.#6.96.117':9988
- '21#.#6.123.62':445
- '21#.#6.207.111':445
- '21#.#6.92.122':445
- '21#.#6.157.111':445
- '21#.#6.111.227':445
- '21#.#6.61.54':445
- '21#.#6.47.205':445
- '21#.#6.106.39':445
- '21#.#6.2.192':445
- '21#.#6.186.214':445
- '21#.#6.96.189':445
- '21#.#6.44.222':445
- '21#.#6.38.134':445
- '21#.#6.60.173':445
- '21#.#6.23.126':445
- '21#.#6.135.136':445
- '21#.#6.77.38':445
- '21#.#6.157.119':445
- '21#.#6.228.105':445
- '21#.#6.1.244':9988
- '21#.#6.228.105':9988
- '21#.#6.186.214':9988
- '21#.#6.60.69':9988
- '21#.#6.23.126':9988
- '21#.#6.135.136':9988
- '21#.#6.157.119':9988
- '21#.#6.111.227':9988
- '21#.#6.60.173':9988
- '21#.#6.207.111':9988
- '21#.#6.38.134':9988
- '21#.#6.15.87':9988
- '21#.#6.96.189':9988
- '21#.#6.176.9':9988
- '21#.26.96.2':9988
- '21#.26.0.56':9988
- '21#.#6.77.38':9988
- '21#.#6.19.73':9988
- '21#.#6.13.123':9988
- '21#.#6.92.122':9988
- '21#.#6.199.44':9988
- '21#.#6.116.164':9988
- '21#.#6.120.185':9988
- '21#.#6.246.199':9988
- '21#.#6.17.209':9988
- '21#.#6.70.50':9988
- '21#.#6.24.142':9988
- '21#.#6.53.228':9988
- '21#.#6.252.165':9988
- '21#.#6.157.111':9988
- '21#.#6.61.54':9988
- '21#.#6.123.62':9988
- '21#.#6.106.39':9988
- '21#.#6.165.163':9988
- '21#.#6.251.34':9988
- '21#.#6.47.205':9988
- '21#.#6.217.90':9988
- '21#.#6.69.140':9988
- '21#.#6.47.205':139
- '21#.#6.106.39':139
- '21#.#6.2.192':139
- '21#.#6.186.214':139
- '21#.#6.251.34':139
- '21#.#6.120.185':139
- '21#.#6.165.163':139
- '21#.#6.246.199':139
- '21#.#6.17.209':139
- '21#.#6.135.136':139
- '21#.#6.77.38':139
- '21#.#6.157.119':139
- '21#.#6.228.105':139
- '21#.#6.157.111':139
- '21#.#6.92.122':139
- '21#.#6.61.54':139
- '21#.#6.111.227':139
- '21#.#6.207.111':139
- '21#.#6.69.140':139
- '21#.#6.70.50':139
- '21#.#6.94.168':139
- '21#.#6.206.41':139
- '21#.#6.149.214':139
- '21#.#6.1.244':139
- '21#.26.85.0':139
- '21#.#6.53.228':139
- '21#.#6.46.47':139
- '21#.#6.17.226':139
- '21#.#6.201.224':139
- '21#.#6.252.165':139
- '21#.#6.24.142':139
- '21#.#6.116.164':139
- '21#.#6.199.44':139
- '21#.#6.35.29':139
- '21#.#6.77.145':139
- '21#.#6.96.103':139
- '21#.#6.217.90':139
- '21#.#6.23.126':139
- '21#.#6.96.103':445
- '21#.#6.217.90':445
- '21#.#6.252.165':445
- '21#.#6.199.44':445
- '21#.#6.35.29':445
- '21#.#6.77.145':445
- '21#.#6.94.168':445
- '21#.#6.1.244':445
- '21#.#6.149.214':445
- '21#.#6.17.209':445
- '21#.#6.120.185':445
- '21#.#6.251.34':445
- '21#.#6.246.199':445
- '21#.#6.165.163':445
- '21#.#6.116.164':445
- '21#.#6.201.224':445
- '21#.#6.69.140':445
- '21#.#6.24.142':445
- '21#.#6.17.226':445
- '21#.#6.15.87':139
- '21#.#6.13.123':139
- '21#.#6.96.117':139
- '21#.26.0.56':139
- '21#.#6.123.62':139
- '21#.#6.96.189':139
- '21#.#6.44.222':139
- '21#.#6.38.134':139
- '21#.#6.60.173':139
- '21#.26.85.0':445
- '21#.#6.70.50':445
- '21#.#6.46.47':445
- '21#.#6.206.41':445
- '21#.#6.53.228':445
- '21#.#6.19.73':139
- '21#.26.96.2':139
- '21#.#6.60.69':139
- '21#.#6.176.9':139
