Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\drwtsn32.exe
Сетевая активность:
Подключается к:
- '20#.#03.141.141':9988
- '20#.#03.91.239':9988
- '20#.#03.50.157':9988
- '20#.#03.94.226':139
- '20#.#03.1.118':139
- '20#.#03.169.205':9988
- '20#.#03.137.46':9988
- '20#.#03.91.44':9988
- '20#.#03.44.88':9988
- '20#.#03.104.121':9988
- '20#.#03.115.189':139
- '20#.#03.121.143':139
- '20#.#03.143.8':139
- '20#.#03.214.207':139
- '20#.#03.56.235':139
- '20#.#03.35.218':139
- '20#.#03.193.92':139
- '20#.#03.126.73':139
- '20#.#03.124.217':139
- '20#.#03.31.101':139
- '20#.#03.45.208':9988
- '20#.#03.46.89':445
- '20#.#03.181.56':445
- '20#.#03.189.51':445
- '20#.#03.57.205':445
- '20#.#03.137.46':445
- '20#.#03.42.64':445
- '20#.#03.89.208':445
- '20#.#03.239.109':445
- '20#.#03.104.121':445
- '20#.#03.207.249':445
- '20#.#03.13.166':445
- '20#.#03.35.215':445
- '20#.#03.157.34':445
- '20#.#03.50.157':445
- '20#.#03.96.195':445
- '20#.#03.91.239':445
- '20#.#03.8.40':445
- '20#.#03.213.113':445
- '20#.#03.250.115':445
- '20#.#03.249.239':445
- '20#.#03.148.198':139
- '20#.#03.8.22':139
- '20#.#03.56.103':139
- '20#.#03.138.10':139
- '20#.#03.113.12':139
- '20#.#03.166.65':139
- '20#.#03.123.13':139
- '20#.#03.180.79':139
- '20#.#03.110.158':139
- '20#.#03.31.189':139
- '20#.#03.26.125':139
- '20#.#03.181.66':139
- '20#.#03.41.43':139
- '20#.#03.1.118':445
- '20#.#03.193.92':445
- '20#.#03.94.226':445
- '20#.#03.29.178':139
- '20#.#03.137.52':139
- '20#.#03.43.16':139
- '20#.#03.178.122':139
- '20#.#03.16.30':139
- '20#.#03.26.30':139
- '20#.#03.229.186':139
- '20#.#03.108.110':139
- '20#.#03.42.118':139
- '20#.#03.97.200':139
- '20#.#03.151.236':139
- '20#.#03.199.253':139
- '20#.#03.197.251':139
- '20#.#03.41.68':139
- '20#.#03.162.147':139
- '20#.#03.157.79':139
- '20#.#03.105.169':139
- '20#.#03.12.9':139
- '20#.#03.38.41':139
- '20#.#03.234.50':139
- '20#.#03.67.183':139
- '20#.#03.223.169':139
- '20#.#03.183.26':139
- '20#.#03.243.122':139
- '20#.#03.160.146':139
- '20#.203.2.0':139
- '20#.#03.169.205':445
- '20#.#03.92.70':139
- '20#.#03.187.74':139
- '20#.#03.244.226':139
- '20#.#03.85.65':139
- '20#.#03.102.244':139
- '20#.#03.30.195':139
- '20#.#03.18.134':139
- '20#.#03.11.176':139
- '20#.#03.123.235':139
- '20#.#03.235.11':139
- '20#.#03.239.109':139
- '20#.#03.249.239':139
- '20#.#03.207.249':139
- '20#.#03.89.208':139
- '20#.#03.137.46':139
- '20#.#03.57.205':139
- '20#.#03.42.64':139
- '20#.#03.8.40':139
- '20#.#03.181.56':139
- '20#.#03.213.113':139
- '20#.#03.133.58':139
- '20#.#03.225.193':139
- '20#.#03.42.235':139
- '20#.#03.113.65':139
- '20#.#03.91.44':139
- '20#.#03.20.112':139
- '20#.#03.4.133':139
- '20#.#03.44.88':139
- '20#.#03.51.173':139
- '20#.#03.135.122':139
- '20#.#03.91.22':139
- '20#.#03.150.70':139
- '20#.#03.83.16':139
- '20#.#03.184.155':139
- '20#.#03.45.208':139
- '20#.#03.134.4':139
- '20#.#03.64.91':139
- '20#.#03.73.125':139
- '20#.#03.141.141':139
- '20#.#03.70.232':139
- '20#.#03.254.149':139
- '20#.#03.104.121':139
- '20#.#03.133.58':445
- '20#.#03.184.155':445
- '20#.#03.134.4':445
- '20#.#03.30.195':445
- '20#.#03.45.208':445
- '20#.#03.254.149':445
- '20#.#03.150.70':445
- '20#.#03.4.133':445
- '20#.#03.70.232':445
- '20#.#03.73.125':445
- '20#.#03.92.70':445
- '20#.#03.187.74':445
- '20#.#03.244.226':445
- '20#.#03.85.65':445
- '20#.#03.102.244':445
- '20#.#03.18.134':445
- '20#.#03.44.88':445
- '20#.#03.11.176':445
- '20#.#03.123.235':445
- '20#.#03.235.11':445
- '20#.#03.83.16':445
- '20#.#03.157.34':139
- '20#.#03.250.115':139
- '20#.#03.96.195':139
- '20#.#03.13.166':139
- '20#.#03.50.157':139
- '20#.#03.46.89':139
- '20#.#03.189.51':139
- '20#.#03.91.239':139
- '20#.#03.35.215':139
- '20#.#03.169.205':139
- '20#.#03.51.173':445
- '20#.#03.225.193':445
- '20#.#03.91.44':445
- '20#.#03.64.91':445
- '20#.#03.141.141':445
- '20#.#03.42.235':445
- '20#.#03.91.22':445
- '20#.#03.20.112':445
- '20#.#03.135.122':445
- '20#.#03.113.65':445
