Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERf030.dir00\svchost.exe.mdmp 16325836412032264
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WERf030.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
Сетевая активность:
Подключается к:
- '22#.#18.70.68':445
- '22#.#18.45.85':445
- '22#.#18.229.160':445
- '22#.#18.126.70':445
- '22#.#18.11.236':445
- '22#.#18.144.2':445
- '22#.#18.59.17':445
- '22#.#18.33.106':445
- '22#.#18.197.225':445
- '22#.#18.132.197':445
- '22#.#18.182.254':445
- '22#.#18.90.45':445
- '22#.#18.55.230':445
- '22#.#18.200.103':445
- '22#.#18.186.226':445
- '22#.#18.135.154':445
- '22#.#18.136.64':445
- '22#.#18.9.134':445
- '22#.#18.18.170':445
- '22#.#18.84.18':445
- '22#.#18.193.83':445
- '22#.#18.73.18':445
- '22#.#18.28.221':445
- '22#.#18.129.177':445
- '22#.#18.172.121':445
- '22#.#18.160.24':445
- '22#.#18.23.220':445
- '22#.#18.45.5':445
- '22#.#18.154.132':445
- '22#.#18.11.236':9988
- '22#.#18.59.17':9988
- '22#.#18.14.86':9988
- '22#.#18.175.181':9988
- '22#.#18.166.139':445
- '22#.#18.208.245':445
- '22#.#18.186.226':9988
- '22#.#18.122.155':9988
- '22#.#18.73.18':9988
- '22#.#18.45.5':9988
- '22#.#18.136.64':9988
- '22#.#18.9.134':9988
- '22#.#18.154.132':9988
- '22#.#18.135.154':9988
- '22#.#18.14.86':445
- '22#.#18.203.13':445
- '22#.#18.58.105':445
- '22#.#18.59.250':445
- '22#.#18.82.154':445
- '22#.#18.141.186':445
- '22#.#18.57.190':445
- '22#.#18.231.250':445
- '22#.#18.144.39':445
- '22#.#18.139.216':445
- '22#.#18.60.197':445
- '22#.#18.101.224':445
- '22#.#18.175.181':445
- '22#.#18.141.116':445
- '22#.#18.73.18':139
- '22#.#18.11.236':139
- '22#.#18.129.177':139
- '22#.#18.28.221':139
- '22#.#18.160.24':139
- '22#.#18.45.5':139
- '22#.#18.172.121':139
- '22#.#18.45.85':139
- '22#.#18.229.160':139
- '22#.#18.55.230':139
- '22#.#18.126.70':139
- '22#.#18.144.2':139
- '22#.#18.59.17':139
- '22#.#18.70.68':139
- '22#.#18.142.123':139
- '22#.#18.110.195':139
- '22#.#18.18.170':139
- '22#.#18.122.155':139
- '22#.#18.54.15':139
- '22#.#18.221.249':139
- '22#.#18.231.6':139
- '22#.#18.135.154':139
- '22#.#18.136.64':139
- '22#.#18.23.220':139
- '22#.#18.186.226':139
- '22#.#18.84.18':139
- '22#.#18.193.83':139
- '22#.#18.9.134':139
- '22#.#18.90.45':139
- '22#.#18.144.39':139
- '22#.#18.139.216':139
- '22#.#18.166.139':139
- '22#.#18.231.250':139
- '22#.#18.175.181':139
- '22#.#18.141.116':139
- '22#.#18.60.197':139
- '22#.#18.231.6':445
- '22#.#18.142.123':445
- '22#.#18.110.195':445
- '22#.#18.54.15':445
- '22#.#18.208.245':139
- '22#.#18.122.155':445
- '22#.#18.221.249':445
- '22#.#18.132.197':139
- '22#.#18.154.132':139
- '22#.#18.82.154':139
- '22#.#18.197.225':139
- '22#.#18.200.103':139
- '22#.#18.182.254':139
- '22#.#18.33.106':139
- '22#.#18.203.13':139
- '22#.#18.58.105':139
- '22#.#18.101.224':139
- '22#.#18.14.86':139
- '22#.#18.141.186':139
- '22#.#18.57.190':139
- '22#.#18.59.250':139
