Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\dumprep.exe' 1132 -dm 7 7 %TEMP%\WER3324.dir00\svchost.exe.mdmp 16325836412032436
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER3324.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '82.##6.227.213':445
- '82.##6.249.60':445
- '82.##6.190.192':445
- '82.##6.122.46':445
- '82.##6.34.69':445
- '82.##6.201.50':445
- '82.##6.232.200':445
- '82.##6.159.56':445
- '82.##6.21.216':445
- '82.##6.109.151':445
- '82.##6.28.238':445
- '82.##6.164.209':445
- '82.##6.92.15':445
- '82.##6.14.203':445
- '82.##6.167.226':445
- '82.##6.241.58':445
- '82.##6.6.217':445
- '82.##6.201.147':445
- '82.##6.62.71':445
- '82.##6.57.47':445
- '82.##6.132.51':445
- '82.##6.49.228':445
- '82.##6.213.216':445
- '82.##6.10.107':445
- '82.##6.161.213':445
- '82.##6.108.40':445
- '82.##6.61.143':445
- '82.##6.169.246':445
- '82.##6.95.156':445
- '82.##6.126.89':445
- '82.##6.24.61':445
- '82.##6.21.20':445
- '82.##6.59.126':445
- '82.##6.108.40':9988
- '82.##6.132.51':9988
- '82.##6.34.69':9988
- '82.##6.10.107':9988
- '82.##6.201.147':9988
- '82.##6.49.228':9988
- '82.##6.24.61':9988
- '82.##6.126.89':9988
- '82.##6.241.58':9988
- '82.##6.92.15':9988
- '82.##6.122.46':9988
- '82.##6.232.200':9988
- '82.##6.59.126':9988
- '82.##6.109.151':9988
- '82.##6.159.56':9988
- '82.##6.227.213':9988
- '82.##6.213.216':9988
- '82.##6.161.213':9988
- '82.##6.21.20':9988
- '82.##6.160.154':9988
- '82.##6.6.217':9988
- '82.##6.238.109':445
- '82.##6.223.104':445
- '82.##6.80.104':9988
- '82.##6.169.246':9988
- '82.##6.19.129':9988
- '82.#86.60.0':9988
- '82.##6.61.137':9988
- '82.#86.79.6':9988
- '82.##6.21.216':9988
- '82.##6.54.60':9988
- '82.##6.17.53':9988
- '82.##6.223.104':9988
- '82.#86.79.6':445
- '82.##6.132.51':139
- '82.##6.201.147':139
- '82.##6.24.61':139
- '82.##6.57.47':139
- '82.##6.49.228':139
- '82.##6.161.213':139
- '82.##6.10.107':139
- '82.##6.62.71':139
- '82.##6.95.156':139
- '82.##6.108.40':139
- '82.##6.6.217':139
- '82.##6.169.246':139
- '82.##6.59.126':139
- '82.##6.126.89':139
- '82.##6.61.143':139
- '82.##6.21.20':139
- '82.##6.213.216':139
- '82.##6.17.53':139
- '82.##6.54.60':139
- '82.##6.19.214':139
- '82.#86.60.0':139
- '82.##6.209.143':139
- '82.##6.160.154':139
- '82.##6.111.231':139
- '82.##6.116.135':139
- '82.##6.61.137':139
- '82.##6.19.129':139
- '82.#86.79.6':139
- '82.##6.80.104':139
- '82.##6.91.251':139
- '82.##6.28.120':139
- '82.##6.128.211':139
- '82.##6.99.55':139
- '82.#86.60.0':445
- '82.##6.111.231':445
- '82.##6.17.53':445
- '82.##6.54.60':445
- '82.##6.160.154':445
- '82.##6.164.209':139
- '82.##6.209.143':445
- '82.##6.116.135':445
- '82.##6.99.55':445
- '82.##6.19.129':445
- '82.##6.80.104':445
- '82.##6.61.137':445
- '82.##6.19.214':445
- '82.##6.28.120':445
- '82.##6.128.211':445
- '82.##6.91.251':445
- '82.##6.109.151':139
- '82.##6.249.60':139
- '82.##6.232.200':139
- '82.##6.238.109':139
- '82.##6.167.226':139
- '82.##6.159.56':139
- '82.##6.34.69':139
- '82.##6.201.50':139
- '82.##6.227.213':139
- '82.##6.14.203':139
- '82.##6.92.15':139
- '82.##6.21.216':139
- '82.##6.241.58':139
- '82.##6.190.192':139
- '82.##6.223.104':139
- '82.##6.28.238':139
- '82.##6.122.46':139
