Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WER0687.dir00\svchost.exe.mdmp 16325836412028804
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %TEMP%\WER0687.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
Сетевая активность:
Подключается к:
- '88.#.169.125':445
- '88.#.72.40':445
- '88.#.212.150':445
- '88.#.38.164':445
- '88.#.143.51':445
- '88.#.149.180':445
- '88.#.74.29':445
- '88.#.69.23':445
- '88.#.102.174':445
- '88.#.180.76':445
- '88.#.16.111':445
- '88.#.62.155':445
- '88.#.36.123':445
- '88.#.39.104':445
- '88.#.51.205':445
- '88.#.229.18':445
- '88.#.188.75':445
- '88.#.21.97':445
- '88.#.36.141':445
- '88.#.89.37':445
- '88.#.60.244':445
- '88.#.31.110':445
- '88.#.164.16':445
- '88.#.143.83':445
- '88.#.229.193':445
- '88.#.10.137':445
- '88.#.71.19':445
- '88.#.141.174':445
- '88.#.0.166':445
- '88.#.62.194':9988
- '88.#.51.205':9988
- '88.#.88.202':9988
- '88.#.75.88':9988
- '88.#.192.101':9988
- '88.#.62.155':9988
- '88.#.173.227':9988
- '88.#.0.166':9988
- '88.#.247.207':9988
- '88.#.36.123':9988
- '88.#.60.244':9988
- '88.#.89.37':9988
- '88.#.36.141':9988
- '88.#.90.248':9988
- '88.#.62.247':9988
- '88.#.20.105':445
- '88.#.158.79':445
- '88.#.22.247':445
- '88.#.75.88':445
- '88.#.247.207':445
- '88.#.142.71':445
- '88.#.82.226':445
- '88.#.226.130':445
- '88.#.29.49':445
- '88.#.163.229':445
- '88.#.137.194':445
- '88.#.55.125':445
- '88.#.243.187':445
- '88.#.156.73':445
- '88.#.143.83':139
- '88.#.229.193':139
- '88.#.51.205':139
- '88.#.164.16':139
- '88.#.141.174':139
- '88.#.0.166':139
- '88.#.10.137':139
- '88.#.143.51':139
- '88.#.72.40':139
- '88.#.212.150':139
- '88.#.149.180':139
- '88.#.74.29':139
- '88.#.38.164':139
- '88.#.169.125':139
- '88.#.71.19':139
- '88.#.88.202':139
- '88.#.27.106':139
- '88.#.90.248':139
- '88.#.173.227':139
- '88.#.62.247':139
- '88.#.62.194':139
- '88.#.192.101':139
- '88.#.229.18':139
- '88.#.188.75':139
- '88.#.21.97':139
- '88.#.36.141':139
- '88.#.89.37':139
- '88.#.60.244':139
- '88.#.31.110':139
- '88.#.177.12':139
- '88.#.156.73':139
- '88.#.226.130':139
- '88.#.163.229':139
- '88.#.29.49':139
- '88.#.22.247':139
- '88.#.137.194':139
- '88.#.88.202':445
- '88.#.90.248':445
- '88.#.27.106':445
- '88.#.192.101':445
- '88.#.62.247':445
- '88.#.62.194':445
- '88.#.173.227':445
- '88.#.75.88':139
- '88.#.55.125':139
- '88.#.243.187':139
- '88.#.39.104':139
- '88.#.20.105':139
- '88.#.36.123':139
- '88.#.62.155':139
- '88.#.82.226':139
- '88.#.247.207':139
- '88.#.142.71':139
- '88.#.158.79':139
- '88.#.102.174':139
- '88.#.69.23':139
- '88.#.16.111':139
- '88.#.180.76':139
