Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WERee93.dir00\svchost.exe.mdmp 16325836412029588
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WERee93.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
Сетевая активность:
Подключается к:
- '13#.#73.219.100':445
- '13#.#73.59.105':445
- '13#.#73.168.86':445
- '13#.#73.151.98':445
- '13#.#73.150.51':445
- '13#.#73.98.108':445
- '13#.#73.212.180':445
- '13#.#73.215.155':445
- '13#.#73.56.58':445
- '13#.#73.42.195':9988
- '13#.#73.50.130':445
- '13#.#73.7.50':9988
- '13#.#73.47.6':9988
- '13#.#73.47.55':445
- '13#.#73.115.220':445
- '13#.#73.12.116':445
- '13#.#73.241.47':445
- '13#.#73.30.186':445
- '13#.#73.222.248':445
- '13#.#73.1.122':445
- '13#.#73.34.249':445
- '13#.#73.174.177':445
- '13#.#73.87.3':445
- '13#.#73.191.187':445
- '13#.#73.120.114':445
- '13#.#73.34.121':445
- '13#.#73.25.119':445
- '13#.#73.17.36':445
- '13#.#73.222.151':445
- '13#.#73.13.211':445
- '13#.#73.124.11':445
- '13#.#73.4.244':445
- '13#.#73.83.75':445
- '13#.#73.49.131':445
- '13#.#73.237.220':445
- '13#.#73.150.51':9988
- '13#.#73.49.131':9988
- '13#.#73.124.11':9988
- '13#.#73.83.75':9988
- '13#.#73.50.130':9988
- '13#.#73.120.114':9988
- '13#.#73.30.186':9988
- '13#.#73.219.100':9988
- '13#.#73.17.36':9988
- '13#.#73.111.79':9988
- '13#.#73.191.187':9988
- '13#.#73.94.50':9988
- '13#.#73.115.194':9988
- '13#.#73.34.249':9988
- '13#.#73.56.58':9988
- '13#.#73.25.119':9988
- '13#.#73.4.244':9988
- '13#.#73.168.86':9988
- '13#.#73.34.121':9988
- '13#.#73.66.225':9988
- '13#.#73.222.248':9988
- '13#.#73.59.105':9988
- '13#.#73.39.108':9988
- '13#.#73.185.251':9988
- '13#.#73.9.37':9988
- '13#.#73.7.122':9988
- '13#.#73.47.55':9988
- '13#.#73.155.63':9988
- '13#.#73.77.37':9988
- '13#.#73.13.211':9988
- '13#.#73.47.51':9988
- '13#.#73.151.98':9988
- '13#.#73.241.47':9988
- '13#.#73.161.226':9988
- '13#.#73.220.119':9988
- '13#.#73.174.177':139
- '13#.#73.87.3':139
- '13#.#73.222.248':139
- '13#.#73.34.249':139
- '13#.#73.30.186':139
- '13#.#73.34.121':139
- '13#.#73.9.37':139
- '13#.#73.51.33':139
- '13#.#73.151.98':139
- '13#.#73.17.36':139
- '13#.#73.120.114':139
- '13#.#73.56.58':139
- '13#.#73.49.131':139
- '13#.#73.168.86':139
- '13#.#73.237.220':139
- '13#.#73.83.75':139
- '13#.#73.1.122':139
- '13#.#73.111.79':139
- '13#.#73.161.226':139
- '13#.#73.39.108':139
- '13#.#73.155.63':139
- '13#.#73.47.6':139
- '13#.#73.42.195':139
- '13#.#73.185.251':139
- '13#.#73.7.122':139
- '13#.#73.7.50':139
- '13#.#73.248.171':139
- '13#.#73.115.194':139
- '13#.#73.66.225':139
- '13#.#73.94.50':139
- '13#.#73.191.187':139
- '13#.#73.47.51':139
- '13#.#73.195.131':139
- '13#.#73.220.119':139
- '13#.#73.77.37':139
- '13#.#73.155.63':445
- '13#.#73.161.226':445
- '13#.#73.248.171':445
- '13#.#73.47.51':445
- '13#.#73.185.251':445
- '13#.#73.42.195':445
- '13#.#73.47.6':445
- '13#.#73.7.50':445
- '13#.#73.77.37':445
- '13#.#73.9.37':445
- '13#.#73.115.194':445
- '13#.#73.51.33':445
- '13#.#73.66.225':445
- '13#.#73.111.79':445
- '13#.#73.220.119':445
- '13#.#73.94.50':445
- '13#.#73.195.131':445
- '13#.#73.39.108':445
- '13#.#73.13.211':139
- '13#.#73.212.180':139
- '13#.#73.215.155':139
- '13#.#73.98.108':139
- '13#.#73.25.119':139
- '13#.#73.4.244':139
- '13#.#73.124.11':139
- '13#.#73.222.151':139
- '13#.#73.219.100':139
- '13#.#73.241.47':139
- '13#.#73.47.55':139
- '13#.#73.7.122':445
- '13#.#73.12.116':139
- '13#.#73.115.220':139
- '13#.#73.150.51':139
- '13#.#73.59.105':139
- '13#.#73.50.130':139
