Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER141c.dir00\svchost.exe.mdmp 16325836412032340
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WER141c.dir00\svchost.exe.mdmp
Сетевая активность:
Подключается к:
- '22#.#3.6.236':445
- '22#.#3.182.125':445
- '22#.#3.248.233':445
- '22#.#3.113.49':445
- '22#.#3.186.119':445
- '22#.#3.85.119':445
- '22#.#3.17.199':445
- '22#.#3.21.225':445
- '22#.#3.101.198':445
- '22#.#3.219.246':445
- '22#.#3.70.156':445
- '22#.#3.160.208':445
- '22#.#3.199.216':445
- '22#.#3.25.121':445
- '22#.#3.56.220':445
- '22#.#3.2.224':445
- '22#.23.94.5':445
- '22#.23.5.38':445
- '22#.#3.40.38':445
- '22#.#3.85.25':445
- '22#.23.2.40':445
- '22#.#3.254.149':445
- '22#.23.81.4':445
- '22#.#3.161.80':445
- '22#.#3.195.160':445
- '22#.#3.29.16':445
- '22#.23.33.6':445
- '22#.#3.133.224':445
- '22#.23.43.0':445
- '22#.#3.248.233':9988
- '22#.#3.54.233':9988
- '22#.#3.2.224':9988
- '22#.#3.195.160':9988
- '22#.#3.87.143':9988
- '22#.23.94.5':9988
- '22#.#3.32.116':9988
- '22#.#3.182.125':9988
- '22#.#3.93.18':9988
- '22#.#3.133.224':9988
- '22#.#3.161.80':9988
- '22#.#3.56.214':9988
- '22#.#3.130.25':9988
- '22#.#3.29.16':9988
- '22#.#3.87.143':445
- '22#.#3.3.127':445
- '22#.#3.58.143':445
- '22#.#3.76.119':445
- '22#.#3.93.18':445
- '22#.#3.172.219':445
- '22#.#3.184.172':445
- '22#.#3.192.184':445
- '22#.#3.155.7':445
- '22#.#3.220.45':445
- '22#.#3.157.75':445
- '22#.#3.2.190':445
- '22#.#3.45.241':445
- '22#.#3.5.201':445
- '22#.#3.130.25':445
- '22#.#3.161.80':139
- '22#.#3.195.160':139
- '22#.#3.56.220':139
- '22#.23.81.4':139
- '22#.#3.133.224':139
- '22#.23.43.0':139
- '22#.#3.29.16':139
- '22#.#3.6.236':139
- '22#.#3.182.125':139
- '22#.#3.248.233':139
- '22#.#3.113.49':139
- '22#.#3.186.119':139
- '22#.#3.17.199':139
- '22#.#3.85.119':139
- '22#.23.33.6':139
- '22#.#3.13.44':139
- '22#.#3.41.107':139
- '22#.#3.195.79':139
- '22#.#3.32.116':139
- '22#.#3.54.233':139
- '22#.#3.56.214':139
- '22#.#3.97.33':139
- '22#.#3.2.224':139
- '22#.23.94.5':139
- '22#.23.5.38':139
- '22#.#3.40.38':139
- '22#.#3.85.25':139
- '22#.23.2.40':139
- '22#.#3.254.149':139
- '22#.#3.220.45':139
- '22#.#3.157.75':139
- '22#.#3.87.143':139
- '22#.#3.155.7':139
- '22#.#3.5.201':139
- '22#.#3.130.25':139
- '22#.#3.2.190':139
- '22#.#3.13.44':445
- '22#.#3.41.107':445
- '22#.#3.195.79':445
- '22#.#3.97.33':445
- '22#.#3.54.233':445
- '22#.#3.32.116':445
- '22#.#3.56.214':445
- '22#.#3.45.241':139
- '22#.#3.21.225':139
- '22#.#3.101.198':139
- '22#.#3.219.246':139
- '22#.#3.70.156':139
- '22#.#3.160.208':139
- '22#.#3.199.216':139
- '22#.#3.25.121':139
- '22#.#3.3.127':139
- '22#.#3.58.143':139
- '22#.#3.76.119':139
- '22#.#3.93.18':139
- '22#.#3.172.219':139
- '22#.#3.184.172':139
- '22#.#3.192.184':139
