Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER32c6.dir00\svchost.exe.mdmp 16325836412032500
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WER32c6.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
Сетевая активность:
Подключается к:
- '89.##6.173.84':445
- '89.#06.3.80':445
- '89.##6.147.158':445
- '89.##6.119.228':445
- '89.##6.24.53':445
- '89.##6.53.26':445
- '89.##6.222.24':445
- '89.##6.116.104':445
- '89.##6.161.36':445
- '89.##6.86.108':445
- '89.##6.55.223':445
- '89.##6.201.76':445
- '89.##6.67.244':445
- '89.##6.79.122':445
- '89.##6.225.132':445
- '89.##6.115.45':445
- '89.##6.119.1':445
- '89.##6.132.39':445
- '89.##6.30.202':445
- '89.##6.119.146':445
- '89.##6.14.46':445
- '89.##6.135.88':445
- '89.##6.229.138':445
- '89.##6.40.135':445
- '89.##6.23.84':445
- '89.##6.77.35':445
- '89.##6.53.211':445
- '89.##6.28.87':445
- '89.#06.9.65':445
- '89.##6.14.135':9988
- '89.##6.14.46':9988
- '89.##6.77.35':9988
- '89.##6.76.155':9988
- '89.##6.157.28':445
- '89.##6.40.135':9988
- '89.##6.139.250':9988
- '89.##6.135.88':9988
- '89.#06.9.65':9988
- '89.##6.66.201':9988
- '89.##6.30.202':9988
- '89.##6.70.232':9988
- '89.##6.67.244':9988
- '89.##6.222.24':9988
- '89.##6.48.169':445
- '89.##6.224.48':445
- '89.##6.136.46':445
- '89.##6.169.41':445
- '89.##6.40.100':445
- '89.##6.163.165':445
- '89.##6.41.163':445
- '89.##6.200.76':445
- '89.##6.51.166':445
- '89.##6.76.155':445
- '89.##6.241.168':445
- '89.##6.161.167':445
- '89.##6.234.240':445
- '89.##6.70.232':445
- '89.##6.139.250':445
- '89.##6.23.84':139
- '89.##6.229.138':139
- '89.##6.40.135':139
- '89.##6.135.88':139
- '89.##6.77.35':139
- '89.##6.53.211':139
- '89.##6.28.87':139
- '89.##6.173.84':139
- '89.#06.3.80':139
- '89.##6.147.158':139
- '89.##6.119.228':139
- '89.##6.53.26':139
- '89.##6.24.53':139
- '89.##6.222.24':139
- '89.##6.54.18':139
- '89.##6.14.135':139
- '89.##6.139.250':139
- '89.##6.52.193':139
- '89.##6.102.221':139
- '89.##6.214.71':139
- '89.##6.66.201':139
- '89.##6.225.132':139
- '89.##6.115.45':139
- '89.##6.119.1':139
- '89.##6.132.39':139
- '89.##6.30.202':139
- '89.##6.119.146':139
- '89.##6.14.46':139
- '89.##6.201.76':139
- '89.##6.200.76':139
- '89.##6.51.166':139
- '89.##6.76.155':139
- '89.##6.241.168':139
- '89.##6.161.167':139
- '89.##6.234.240':139
- '89.##6.70.232':139
- '89.##6.102.221':445
- '89.##6.54.18':445
- '89.##6.14.135':445
- '89.##6.214.71':445
- '89.##6.157.28':139
- '89.##6.52.193':445
- '89.##6.66.201':445
- '89.##6.161.36':139
- '89.##6.86.108':139
- '89.#06.9.65':139
- '89.##6.116.104':139
- '89.##6.67.244':139
- '89.##6.79.122':139
- '89.##6.55.223':139
- '89.##6.48.169':139
- '89.##6.224.48':139
- '89.##6.136.46':139
- '89.##6.169.41':139
- '89.##6.40.100':139
- '89.##6.163.165':139
- '89.##6.41.163':139
