Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1132 -dm 7 7 %TEMP%\WER22e3.dir00\svchost.exe.hdmp 16325836412027516
- '<SYSTEM32>\dumprep.exe' 1132 -dm 7 7 %TEMP%\WER22e3.dir00\svchost.exe.mdmp 16325836412028992
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WER22e3.dir00\svchost.exe.hdmp
- %TEMP%\WER22e3.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
Сетевая активность:
Подключается к:
- '21#.73.34.6':445
- '21#.#3.253.131':445
- '21#.#3.215.23':445
- '21#.#3.155.248':445
- '21#.#3.187.21':445
- '21#.#3.132.213':445
- '21#.#3.175.137':445
- '21#.#3.165.109':445
- '21#.#3.241.89':445
- '21#.#3.58.149':445
- '21#.73.7.94':445
- '21#.#3.71.184':445
- '21#.#3.49.71':445
- '21#.#3.255.56':445
- '21#.#3.188.112':445
- '21#.#3.181.107':445
- '21#.#3.172.162':445
- '21#.#3.54.45':445
- '21#.#3.109.86':445
- '21#.#3.7.194':445
- '21#.#3.46.237':445
- '21#.#3.107.158':445
- '21#.#3.203.141':445
- '21#.#3.144.20':445
- '21#.#3.41.151':445
- '21#.#3.236.177':445
- '21#.#3.230.158':445
- '21#.#3.98.13':445
- '21#.73.33.9':445
- '21#.#3.140.87':445
- '21#.#3.244.150':445
- '21#.#3.216.165':445
- '21#.#3.136.214':445
- '21#.#3.153.185':445
- '21#.#3.187.21':9988
- '21#.#3.49.71':9988
- '21#.#3.191.131':445
- '21#.#3.177.238':445
- '21#.#3.220.204':445
- '21#.#3.138.91':445
- '21#.#3.96.118':445
- '21#.#3.34.55':445
- '21#.#3.238.180':445
- '21#.#3.159.6':445
- '21#.#3.252.229':445
- '21#.#3.48.61':445
- '21#.#3.32.54':445
- '21#.#3.145.180':445
- '21#.#3.1.209':445
- '21#.#3.134.49':445
- '21#.#3.249.100':445
- '21#.#3.157.241':445
- '21#.#3.132.213':139
- '21#.73.34.6':139
- '21#.#3.253.131':139
- '21#.#3.203.141':139
- '21#.#3.187.21':139
- '21#.#3.155.248':139
- '21#.#3.215.23':139
- '21#.#3.241.89':139
- '21#.#3.71.184':139
- '21#.#3.49.71':139
- '21#.#3.175.137':139
- '21#.73.7.94':139
- '21#.#3.165.109':139
- '21#.#3.109.86':139
- '21#.#3.255.56':139
- '21#.#3.188.112':139
- '21#.#3.172.162':139
- '21#.#3.179.206':139
- '21#.#3.54.45':139
- '21#.#3.181.107':139
- '21#.#3.144.20':139
- '21#.#3.107.158':139
- '21#.#3.46.237':139
- '21#.#3.236.177':139
- '21#.#3.7.194':139
- '21#.#3.41.151':139
- '21#.#3.98.13':139
- '21#.#3.230.158':139
- '21#.#3.216.165':139
- '21#.#3.1.209':139
- '21#.#3.244.150':139
- '21#.#3.140.87':139
- '21#.#3.220.204':139
- '21#.#3.136.214':139
- '21#.#3.153.185':139
- '21#.#3.179.206':445
- '21#.73.33.9':139
- '21#.#3.191.131':139
- '21#.#3.177.238':139
- '21#.#3.238.180':139
- '21#.#3.138.91':139
- '21#.#3.34.55':139
- '21#.#3.159.6':139
- '21#.#3.58.149':139
- '21#.#3.252.229':139
- '21#.#3.96.118':139
- '21#.#3.145.180':139
- '21#.#3.157.241':139
- '21#.#3.32.54':139
- '21#.#3.48.61':139
- '21#.#3.134.49':139
- '21#.#3.249.100':139
