Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER781d.dir00\svchost.exe.mdmp 16325836412031748
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WER781d.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '62.#73.9.58':445
- '62.##3.245.86':445
- '62.##3.63.135':9988
- '62.##3.49.164':445
- '62.##3.128.114':445
- '62.##3.157.19':445
- '62.##3.67.201':445
- '62.##3.213.68':445
- '62.#73.1.44':445
- '62.##3.68.76':9988
- '62.##3.127.113':9988
- '62.##3.81.40':9988
- '62.##3.44.220':9988
- '62.##3.167.164':9988
- '62.##3.50.80':9988
- '62.##3.195.21':9988
- '62.##3.89.177':9988
- '62.##3.151.153':9988
- '62.##3.113.16':445
- '62.##3.87.225':445
- '62.##3.43.68':445
- '62.##3.10.205':445
- '62.##3.167.107':445
- '62.##3.57.31':445
- '62.##3.44.220':445
- '62.##3.220.183':445
- '62.##3.31.22':445
- '62.##3.127.113':445
- '62.##3.137.18':445
- '62.##3.32.71':445
- '62.##3.146.174':445
- '62.##3.174.136':445
- '62.##3.35.82':445
- '62.##3.128.178':445
- '62.##3.50.112':445
- '62.##3.154.240':445
- '62.##3.195.21':445
- '62.##3.88.168':9988
- '62.##3.245.86':9988
- '62.##3.35.82':9988
- '62.##3.113.16':9988
- '62.#73.1.44':9988
- '62.##3.67.201':9988
- '62.##3.153.12':9988
- '62.##3.167.107':9988
- '62.##3.220.183':9988
- '62.##3.47.231':9988
- '62.##3.105.152':9988
- '62.#73.9.58':9988
- '62.##3.128.114':9988
- '62.##3.146.174':9988
- '62.##3.128.178':9988
- '62.##3.154.240':9988
- '62.##3.49.164':9988
- '62.##3.213.68':9988
- '62.##3.57.31':9988
- '62.##3.201.100':9988
- '62.##3.164.183':9988
- '62.##3.51.182':9988
- '62.##3.43.68':9988
- '62.##3.50.112':9988
- '62.##3.30.38':9988
- '62.##3.37.182':9988
- '62.##3.151.127':9988
- '62.##3.10.205':9988
- '62.##3.67.249':9988
- '62.##3.87.225':9988
- '62.##3.35.25':9988
- '62.##3.224.114':9988
- '62.##3.157.19':9988
- '62.##3.32.71':9988
- '62.##3.174.136':9988
- '62.##3.71.155':9988
- '62.##3.137.18':9988
- '62.##3.31.22':9988
- '62.##3.44.220':139
- '62.##3.220.183':139
- '62.##3.31.22':139
- '62.##3.127.113':139
- '62.##3.51.182':139
- '62.##3.89.177':139
- '62.##3.151.153':139
- '62.##3.71.155':139
- '62.##3.63.135':139
- '62.##3.128.178':139
- '62.##3.50.112':139
- '62.##3.154.240':139
- '62.##3.195.21':139
- '62.##3.10.205':139
- '62.##3.43.68':139
- '62.##3.57.31':139
- '62.##3.167.107':139
- '62.##3.87.225':139
- '62.##3.153.12':139
- '62.##3.105.152':139
- '62.##3.65.35':139
- '62.##3.201.100':139
- '62.##3.50.80':139
- '62.##3.224.114':139
- '62.##3.30.38':139
- '62.##3.213.239':139
- '62.##3.68.76':139
- '62.##3.143.32':139
- '62.##3.37.182':139
- '62.##3.47.231':139
- '62.##3.35.25':139
- '62.##3.151.127':139
- '62.##3.81.40':139
- '62.##3.167.164':139
- '62.##3.164.183':139
- '62.##3.67.249':139
- '62.##3.88.168':139
- '62.##3.35.82':139
- '62.##3.151.127':445
- '62.##3.71.155':445
- '62.##3.37.182':445
- '62.##3.89.177':445
- '62.##3.63.135':445
- '62.##3.50.80':445
- '62.##3.68.76':445
- '62.##3.164.183':445
- '62.##3.201.100':445
- '62.##3.167.164':445
- '62.##3.88.168':445
- '62.##3.153.12':445
- '62.##3.51.182':445
- '62.##3.67.249':445
- '62.##3.151.153':445
- '62.##3.35.25':445
- '62.##3.47.231':445
- '62.##3.81.40':445
- '62.##3.143.32':445
- '62.##3.157.19':139
- '62.##3.67.201':139
- '62.##3.213.68':139
- '62.#73.1.44':139
- '62.##3.113.16':139
- '62.##3.137.18':139
- '62.##3.32.71':139
- '62.##3.146.174':139
- '62.##3.174.136':139
- '62.##3.105.152':445
- '62.##3.65.35':445
- '62.##3.213.239':445
- '62.##3.30.38':445
- '62.##3.224.114':445
- '62.##3.245.86':139
- '62.##3.128.114':139
- '62.##3.49.164':139
- '62.#73.9.58':139
