Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER426e.dir00\svchost.exe.mdmp 16325836412032604
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %TEMP%\WER426e.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '81.##.43.229':445
- '81.#4.61.53':445
- '81.##.230.43':445
- '81.##.24.170':445
- '81.##.55.101':445
- '81.##.12.209':445
- '81.#4.53.35':445
- '81.##.123.104':445
- '81.#4.33.37':445
- '81.##.131.191':9988
- '81.##.146.116':445
- '81.##.118.81':9988
- '81.##.202.52':9988
- '81.##.106.227':445
- '81.##.136.29':445
- '81.##.222.91':445
- '81.##.80.105':445
- '81.##.209.82':445
- '81.##.128.52':445
- '81.##.157.205':445
- '81.##.30.224':445
- '81.##.169.235':445
- '81.#4.33.73':445
- '81.##.199.87':445
- '81.#4.253.6':445
- '81.##.241.131':445
- '81.##.170.51':445
- '81.##.234.204':445
- '81.##.172.126':445
- '81.##.154.76':445
- '81.##.73.138':445
- '81.##.228.149':445
- '81.##.160.59':445
- '81.##.18.226':445
- '81.##.204.228':445
- '81.##.146.116':9988
- '81.##.106.227':9988
- '81.##.199.87':9988
- '81.##.43.229':9988
- '81.##.204.228':9988
- '81.##.128.52':9988
- '81.#4.253.6':9988
- '81.#4.61.53':9988
- '81.##.24.170':9988
- '81.##.154.76':9988
- '81.##.228.149':9988
- '81.##.73.138':9988
- '81.##.160.59':9988
- '81.#4.1.151':9988
- '81.#4.54.78':9988
- '81.##.28.106':9988
- '81.##.222.91':9988
- '81.##.136.29':9988
- '81.#4.34.99':9988
- '81.##.209.82':9988
- '81.##.179.94':9988
- '81.##.30.224':9988
- '81.##.12.123':9988
- '81.##.222.109':9988
- '81.#4.24.44':9988
- '81.##.48.191':9988
- '81.##.169.235':9988
- '81.##.227.24':9988
- '81.##.103.29':9988
- '81.##.241.131':9988
- '81.##.157.205':9988
- '81.##.12.209':9988
- '81.##.145.47':9988
- '81.##.170.51':9988
- '81.##.230.43':9988
- '81.##.157.205':139
- '81.#4.253.6':139
- '81.##.169.235':139
- '81.##.128.52':139
- '81.##.103.29':139
- '81.##.199.87':139
- '81.##.241.131':139
- '81.#4.33.73':139
- '81.##.30.224':139
- '81.##.172.126':139
- '81.##.234.204':139
- '81.##.18.226':139
- '81.##.73.138':139
- '81.##.160.59':139
- '81.##.170.51':139
- '81.##.204.228':139
- '81.##.228.149':139
- '81.##.41.121':139
- '81.##.145.47':139
- '81.##.118.81':139
- '81.##.202.52':139
- '81.#4.24.44':139
- '81.##.28.106':139
- '81.#4.34.99':139
- '81.##.222.109':139
- '81.##.13.171':139
- '81.##.12.123':139
- '81.#4.1.151':139
- '81.##.179.94':139
- '81.##.48.191':139
- '81.#4.102.7':139
- '81.#4.4.68':139
- '81.##.131.191':139
- '81.#4.54.78':139
- '81.##.227.24':139
- '81.##.12.123':445
- '81.#4.24.44':445
- '81.##.131.191':445
- '81.##.202.52':445
- '81.##.145.47':445
- '81.##.28.106':445
- '81.##.13.171':445
- '81.##.222.109':445
- '81.#4.4.68':445
- '81.##.48.191':445
- '81.#4.102.7':445
- '81.##.103.29':445
- '81.##.41.121':445
- '81.#4.54.78':445
- '81.##.227.24':445
- '81.#4.1.151':445
- '81.##.179.94':445
- '81.##.118.81':445
- '81.#4.53.35':139
- '81.##.123.104':139
- '81.##.43.229':139
- '81.#4.61.53':139
- '81.##.209.82':139
- '81.##.154.76':139
- '81.##.55.101':139
- '81.##.12.209':139
- '81.##.230.43':139
- '81.##.222.91':139
- '81.##.80.105':139
- '81.#4.34.99':445
- '81.##.146.116':139
- '81.#4.33.37':139
- '81.##.24.170':139
- '81.##.106.227':139
- '81.##.136.29':139
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
