Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERb889.dir00\svchost.exe.mdmp 16325836412032540
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\drwtsn32.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WERb889.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
Сетевая активность:
Подключается к:
- '21#.#88.59.85':445
- '21#.#88.165.156':445
- '21#.#88.139.25':445
- '21#.#88.13.43':445
- '21#.#88.219.145':445
- '21#.#88.223.229':445
- '21#.#88.131.31':445
- '21#.#88.43.158':445
- '21#.#88.149.18':445
- '21#.#88.1.240':9988
- '21#.#88.161.192':9988
- '21#.#88.166.128':9988
- '21#.#88.17.149':9988
- '21#.#88.196.220':9988
- '21#.#88.224.235':445
- '21#.#88.12.101':445
- '21#.#88.181.118':9988
- '21#.#88.212.41':445
- '21#.#88.147.230':445
- '21#.#88.104.47':445
- '21#.#88.192.103':445
- '21#.#88.17.149':445
- '21#.#88.65.209':445
- '21#.#88.35.129':445
- '21#.#88.3.174':445
- '21#.#88.196.220':445
- '21#.#88.128.62':445
- '21#.#88.61.150':445
- '21#.#88.29.77':445
- '21#.#88.222.46':445
- '21#.#88.239.70':445
- '21#.#88.166.128':445
- '21#.#88.11.130':445
- '21#.#88.144.213':445
- '21#.#88.28.41':445
- '21#.#88.148.78':445
- '21#.#88.104.47':9988
- '21#.#88.128.62':9988
- '21#.#88.149.18':9988
- '21#.#88.144.213':9988
- '21#.#88.170.103':9988
- '21#.#88.222.46':9988
- '21#.#88.148.78':9988
- '21#.#88.139.25':9988
- '21#.#88.187.58':9988
- '21#.#88.192.103':9988
- '21#.#88.12.101':9988
- '21#.#88.165.156':9988
- '21#.#88.65.209':9988
- '21#.#88.11.130':9988
- '21#.#88.29.77':9988
- '21#.#88.28.41':9988
- '21#.#88.223.229':9988
- '21#.#88.147.230':9988
- '21#.#88.203.202':9988
- '21#.#88.32.26':9988
- '21#.#88.4.119':9988
- '21#.#88.20.190':9988
- '21#.#88.205.216':9988
- '21#.#88.103.220':9988
- '21#.#88.113.235':9988
- '21#.#88.64.225':9988
- '21#.#88.215.60':9988
- '21#.#88.59.85':9988
- '21#.#88.164.60':9988
- '21#.#88.61.150':9988
- '21#.#88.35.129':9988
- '21#.#88.106.6':9988
- '21#.#88.43.158':9988
- '21#.#88.13.43':9988
- '21#.#88.3.174':9988
- '21#.#88.60.60':9988
- '21#.#88.106.6':139
- '21#.#88.3.174':139
- '21#.#88.223.229':139
- '21#.#88.104.47':139
- '21#.#88.128.62':139
- '21#.#88.35.129':139
- '21#.#88.181.118':139
- '21#.#88.103.220':139
- '21#.#88.196.220':139
- '21#.#88.239.70':139
- '21#.#88.166.128':139
- '21#.#88.192.103':139
- '21#.#88.147.230':139
- '21#.#88.11.130':139
- '21#.#88.148.78':139
- '21#.#88.28.41':139
- '21#.#88.43.158':139
- '21#.#88.149.18':139
- '21#.#88.64.225':139
- '21#.#88.215.60':139
- '21#.#88.102.251':139
- '21#.#88.205.216':139
- '21#.#88.32.26':139
- '21#.#88.161.192':139
- '21#.#88.203.202':139
- '21#.#88.1.240':139
- '21#.#88.20.190':139
- '21#.#88.187.58':139
- '21#.#88.201.140':139
- '21#.#88.170.103':139
- '21#.#88.53.19':139
- '21#.#88.164.60':139
- '21#.#88.113.235':139
- '21#.#88.60.60':139
- '21#.#88.4.119':139
- '21#.#88.193.79':139
- '21#.#88.64.225':445
- '21#.#88.102.251':445
- '21#.#88.60.60':445
- '21#.#88.215.60':445
- '21#.#88.201.140':445
- '21#.#88.32.26':445
- '21#.#88.1.240':445
- '21#.#88.4.119':445
- '21#.#88.164.60':445
- '21#.#88.181.118':445
- '21#.#88.170.103':445
- '21#.#88.103.220':445
- '21#.#88.106.6':445
- '21#.#88.53.19':445
- '21#.#88.193.79':445
- '21#.#88.113.235':445
- '21#.#88.187.58':445
- '21#.#88.205.216':445
- '21#.#88.165.156':139
- '21#.#88.65.209':139
- '21#.#88.17.149':139
- '21#.#88.61.150':139
- '21#.#88.219.145':139
- '21#.#88.131.31':139
- '21#.#88.29.77':139
- '21#.#88.59.85':139
- '21#.#88.144.213':139
- '21#.#88.161.192':445
- '21#.#88.224.235':139
- '21#.#88.20.190':445
- '21#.#88.203.202':445
- '21#.#88.212.41':139
- '21#.#88.13.43':139
- '21#.#88.222.46':139
- '21#.#88.12.101':139
- '21#.#88.139.25':139
