Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WER04e4.dir00\svchost.exe.mdmp 16325836412029944
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER04e4.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '21#.#4.249.195':9988
- '21#.#4.230.224':445
- '21#.#4.77.51':9988
- '21#.#4.244.153':9988
- '21#.#4.53.231':445
- '21#.#4.10.50':445
- '21#.#4.115.164':445
- '21#.#4.224.138':445
- '21#.#4.52.230':445
- '21#.#4.155.7':9988
- '21#.#4.104.166':9988
- '21#.#4.37.248':9988
- '21#.#4.129.181':9988
- '21#.#4.17.247':9988
- '21#.#4.246.249':9988
- '21#.#4.130.238':9988
- '21#.#4.51.123':9988
- '21#.#4.84.18':9988
- '21#.#4.252.169':9988
- '21#.#4.130.238':445
- '21#.#4.55.188':445
- '21#.#4.184.205':445
- '21#.#4.175.160':445
- '21#.#4.155.7':445
- '21#.#4.51.123':445
- '21#.#4.77.51':445
- '21#.#4.7.246':445
- '21#.#4.246.24':445
- '21#.#4.230.127':445
- '21#.#4.49.44':445
- '21#.#4.7.193':445
- '21#.#4.206.177':445
- '21#.#4.10.15':445
- '21#.#4.164.164':445
- '21#.#4.239.93':445
- '21#.#4.128.105':445
- '21#.#4.164.239':445
- '21#.#4.158.69':445
- '21#.#4.230.224':9988
- '21#.#4.224.138':9988
- '21#.#4.196.138':9988
- '21#.#4.53.231':9988
- '21#.#4.7.193':9988
- '21#.#4.52.230':9988
- '21#.#4.230.127':9988
- '21#.#4.49.44':9988
- '21#.#4.10.15':9988
- '21#.#4.227.89':9988
- '21#.#4.246.24':9988
- '21#.#4.129.171':9988
- '21#.#4.55.188':9988
- '21#.#4.222.71':9988
- '21#.#4.126.9':9988
- '21#.#4.142.210':9988
- '21#.#4.76.207':9988
- '21#.#4.225.17':9988
- '21#.#4.89.142':9988
- '21#.#4.151.223':9988
- '21#.#4.218.3':9988
- '21#.#4.234.66':9988
- '21#.#4.7.246':9988
- '21#.#4.79.129':9988
- '21#.#4.153.70':9988
- '21#.#4.71.78':9988
- '21#.#4.44.59':9988
- '21#.#4.78.89':9988
- '21#.#4.164.239':9988
- '21#.#4.115.164':9988
- '21#.#4.175.160':9988
- '21#.#4.128.105':9988
- '21#.#4.206.177':9988
- '21#.#4.239.93':9988
- '21#.#4.164.164':9988
- '21#.#4.158.69':9988
- '21#.#4.184.205':9988
- '21#.#4.10.50':9988
- '21#.#4.79.129':445
- '21#.#4.77.51':139
- '21#.#4.51.123':139
- '21#.#4.252.169':139
- '21#.#4.79.129':139
- '21#.#4.151.223':139
- '21#.#4.44.59':139
- '21#.#4.218.3':139
- '21#.#4.222.71':139
- '21#.#4.225.17':139
- '21#.#4.246.24':139
- '21#.#4.184.205':139
- '21#.#4.230.127':139
- '21#.#4.158.69':139
- '21#.#4.128.105':139
- '21#.#4.175.160':139
- '21#.#4.155.7':139
- '21#.#4.7.246':139
- '21#.#4.130.238':139
- '21#.#4.55.188':139
- '21#.#4.37.248':139
- '21#.#4.227.89':139
- '21#.#4.104.166':139
- '21#.#4.76.207':139
- '21#.#4.84.18':139
- '21#.#4.246.249':139
- '21#.#4.249.195':139
- '21#.#4.17.247':139
- '21#.#4.196.138':139
- '21#.#4.129.181':139
- '21#.#4.126.9':139
- '21#.#4.244.153':139
- '21#.#4.129.171':139
- '21#.#4.234.66':139
- '21#.#4.153.70':139
- '21#.#4.89.142':139
- '21#.#4.142.210':139
- '21#.#4.71.78':139
- '21#.#4.78.89':139
- '21#.#4.89.142':445
- '21#.#4.78.89':445
- '21#.#4.153.70':445
- '21#.#4.71.78':445
- '21#.#4.142.210':445
- '21#.#4.76.207':445
- '21#.#4.104.166':445
- '21#.#4.129.181':445
- '21#.#4.37.248':445
- '21#.#4.244.153':445
- '21#.#4.222.71':445
- '21#.#4.225.17':445
- '21#.#4.252.169':445
- '21#.#4.151.223':445
- '21#.#4.44.59':445
- '21#.#4.129.171':445
- '21#.#4.234.66':445
- '21#.#4.218.3':445
- '21#.#4.126.9':445
- '21#.#4.49.44':139
- '21#.#4.10.50':139
- '21#.#4.10.15':139
- '21#.#4.206.177':139
- '21#.#4.7.193':139
- '21#.#4.164.239':139
- '21#.#4.239.93':139
- '21#.#4.115.164':139
- '21#.#4.164.164':139
- '21#.#4.52.230':139
- '21#.#4.246.249':445
- '21#.#4.249.195':445
- '21#.#4.227.89':445
- '21#.#4.84.18':445
- '21#.#4.196.138':445
- '21#.#4.230.224':139
- '21#.#4.224.138':139
- '21#.#4.17.247':445
- '21#.#4.53.231':139
