Trojan.DownLoader10.4169

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WER269e.dir00\svchost.exe.mdmp 16325836412032332

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%TEMP%\WER269e.dir00\svchost.exe.mdmp
<SYSTEM32>\urdvxc.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'19#.#00.158.211':445
'19#.#00.74.253':445
'19#.#00.249.114':445
'19#.#00.251.49':445
'19#.#00.200.22':445
'19#.#00.241.127':445
'19#.#00.69.47':445
'19#.#00.1.238':445
'19#.#00.40.171':445
'19#.#00.130.75':445
'19#.#00.3.187':445
'19#.#00.86.196':445
'19#.#00.129.135':445
'19#.#00.141.171':445
'19#.#00.51.165':445
'19#.#00.66.47':445
'19#.#00.46.140':445
'19#.#00.0.72':445
'19#.#00.145.248':445
'19#.#00.178.140':445
'19#.#00.119.92':445
'19#.#00.232.96':445
'19#.#00.219.195':445
'19#.#00.34.246':445
'19#.#00.185.245':445
'19#.#00.182.214':445
'19#.#00.17.213':445
'19#.#00.138.243':445
'19#.#00.61.188':445
'19#.#00.98.25':445
'19#.#00.235.138':445
'19#.#00.16.126':445
'19#.#00.150.240':445
'19#.#00.13.155':445
'19#.#00.147.163':445
'19#.#00.46.93':445
'19#.#00.96.148':445
'19#.#00.196.166':445
'19#.#00.105.76':445
'19#.#00.32.250':445
'19#.#00.104.33':445
'19#.#00.46.93':139
'19#.#00.86.24':139
'19#.#00.32.250':139
'19#.#00.249.114':139
'19#.#00.147.163':139
'19#.#00.182.214':139
'19#.#00.196.166':139
'19#.#00.16.126':139
'19#.#00.13.155':139
'19#.#00.150.240':139
'19#.#00.119.92':139
'19#.#00.200.22':139
'19#.#00.46.140':139
'19#.#00.1.238':139
'19#.#00.0.72':139
'19#.#00.251.49':139
'19#.#00.40.171':139
'19#.#00.74.253':139
'19#.#00.66.47':139
'19#.#00.158.211':139
'19#.#00.58.42':139
'19#.#00.61.188':139
'19#.#00.235.138':139
'19#.#00.247.85':139
'19#.#00.98.25':139
'19#.#00.138.243':139
'19#.#00.31.244':445
'19#.#00.78.177':445
'19#.#00.94.110':445
'19#.#00.107.32':445
'19#.#00.18.147':445
'19#.#00.232.96':139
'19#.#00.77.18':139
'19#.#00.96.148':139
'19#.#00.105.76':139
'19#.#00.34.246':139
'19#.#00.219.195':139
'19#.#00.82.116':139
'19#.#00.17.213':139
'19#.#00.104.33':139
'19#.#00.185.245':139
'19#.#00.131.208':139
'19#.#00.81.133':139
'19#.#00.23.147':139
'19#.#00.47.138':139
'19#.#00.97.163':139
'19#.#00.139.200':139
'19#.#00.212.217':445
'19#.#00.18.36':139
'19#.#00.50.240':139
'19#.#00.116.176':139
'19#.#00.25.76':139
'19#.#00.114.53':139
'19#.#00.38.145':139
'19#.#00.135.98':139
'19#.#00.66.104':139
'19#.#00.70.127':445
'19#.#00.249.26':139
'19#.#00.200.203':139
'19#.#00.17.109':139
'19#.#00.61.183':139
'19#.#00.41.110':139
'19#.#00.50.72':139
'19#.#00.158.208':139
'19#.#00.196.192':139
'19#.#00.45.88':139
'19#.#00.199.127':139
'19#.#00.227.171':445
'19#.#00.12.152':445
'19#.#00.86.73':445
'19#.#00.231.31':139
'19#.#00.224.229':445
'19#.#00.103.64':139
'19#.#00.235.125':139
'19#.#00.240.197':139
'19#.#00.215.83':139
'19#.#00.253.55':139
'19#.#00.169.15':139
'19#.#00.84.165':139
'19#.#00.119.105':139
'19#.#00.75.149':445
'19#.#00.147.95':139
'19#.#00.87.243':139
'19#.#00.244.111':139
'19#.#00.24.157':139
'19#.#00.177.135':139
'19#.#00.35.251':139
'19#.#00.101.30':139
'19#.#00.37.78':139
'19#.#00.2.31':139
'19#.#00.245.55':139
'19#.#00.111.233':139
'19#.#00.247.85':445
'19#.#00.82.116':445
'19#.#00.58.42':445
'19#.#00.86.24':445
'19#.#00.77.18':445
'19#.#00.92.117':139
'19#.#00.227.171':139
'19#.#00.224.229':139
'19#.#00.12.152':139
'19#.#00.86.73':139
'19#.#00.67.191':139
'19#.#00.160.61':139
'19#.#00.27.238':139
'19#.#00.218.158':139
'19#.#00.113.60':139
'19#.#00.17.250':139
'19#.#00.232.212':139
'19#.#00.159.100':139
'19#.#00.172.70':139
'19#.#00.93.137':139
'19#.#00.2.10':139
'19#.#00.25.58':139
'19#.#00.92.117':445
'19#.#00.177.135':445
'19#.#00.35.251':445
'19#.#00.114.67':139
'19#.#00.249.212':139
'19#.#00.170.222':139
'19#.#00.134.125':139
'19#.#00.216.109':139
'19#.#00.86.182':139
'19#.#00.145.248':139
'19#.#00.34.172':445
'19#.#00.47.63':445
'19#.#00.143.168':445
'19#.#00.194.75':445
'19#.#00.87.2':445
'19#.#00.140.113':445
'19#.#00.85.7':445
'19#.#00.195.28':445
'19#.#00.224.166':445
'19#.#00.202.134':445
'19#.#00.155.193':139
'19#.#00.50.156':139
'19#.#00.82.93':139
'19#.#00.8.216':139
'19#.#00.82.17':139
'19#.#00.114.235':139
'19#.#00.62.196':139
'19#.#00.80.243':139
'19#.#00.2.51':139
'19#.#00.206.106':139
'19#.#00.22.224':445
'19#.#00.89.95':445
'19#.#00.206.88':445
'19#.#00.77.216':445
'19#.#00.74.19':445
'19#.#00.151.115':445
'19#.#00.56.28':445
'19#.#00.174.187':445
'19#.#00.171.1':445
'19#.#00.69.40':445
'19#.#00.139.99':445
'19#.#00.172.183':445
'19#.#00.179.204':445
'19#.#00.2.180':445
'19#.#00.172.130':445
'19#.#00.16.121':445
'19#.#00.48.101':445
'19#.#00.18.130':445
'19#.#00.115.78':445
'19#.#00.11.85':445
'19#.#00.18.245':445
'19#.#00.47.63':139
'19#.#00.195.28':139
'19#.#00.140.113':139
'19#.#00.143.168':139
'19#.#00.172.183':139
'19#.#00.11.85':139
'19#.#00.18.245':139
'19#.#00.85.7':139
'19#.#00.179.204':139
'19#.#00.16.121':139
'19#.#00.172.130':139
'19#.#00.202.134':139
'19#.#00.224.166':139
'19#.#00.115.78':139
'19#.#00.22.224':139
'19#.#00.87.2':139
'19#.#00.34.172':139
'19#.#00.2.180':139
'19#.#00.253.243':139
'19#.#00.194.75':139
'19#.#00.48.101':139
'19#.#00.75.134':139
'19#.#00.99.56':139
'19#.#00.61.250':139
'19#.#00.174.187':139
'19#.#00.15.101':139
'19#.#00.171.50':139
'19#.#00.161.184':139
'19#.#00.223.236':139
'19#.#00.49.13':139
'19#.#00.130.126':139
'19#.#00.77.216':139
'19#.#00.89.95':139
'19#.#00.151.115':139
'19#.#00.18.130':139
'19#.#00.74.19':139
'19#.#00.171.1':139
'19#.#00.56.28':139
'19#.#00.139.99':139
'19#.#00.206.88':139
'19#.#00.69.40':139
'19#.#00.18.245':9988
'19#.#00.151.115':9988
'19#.#00.139.99':9988
'19#.#00.22.224':9988
'19#.#00.85.7':9988
'19#.#00.77.216':9988
'19#.#00.2.51':9988
'19#.#00.206.88':9988
'19#.#00.18.130':9988
'19#.#00.195.28':9988
'19#.#00.140.113':9988
'19#.#00.15.101':9988
'19#.#00.171.50':9988
'19#.#00.89.95':9988
'19#.#00.99.56':9988
'19#.#00.34.172':9988
'19#.#00.80.243':9988
'19#.#00.47.63':9988
'19#.#00.49.13':9988
'19#.#00.171.1':9988
'19#.#00.2.180':9988
'19#.#00.31.244':139
'19#.#00.86.196':139
'19#.#00.141.171':139
'19#.#00.18.147':139
'19#.#00.78.177':139
'19#.#00.69.47':139
'19#.#00.241.127':139
'19#.#00.130.75':139
'19#.#00.3.187':139
'19#.#00.178.140':139
'19#.#00.174.187':9988
'19#.#00.16.121':9988
'19#.#00.223.236':9988
'19#.#00.50.156':9988
'19#.#00.161.184':9988
'19#.#00.51.165':139
'19#.#00.129.135':139
'19#.#00.94.110':139
'19#.#00.82.17':9988
'19#.#00.107.32':139
'19#.#00.2.51':445
'19#.#00.80.243':445
'19#.#00.8.216':445
'19#.#00.62.196':445
'19#.#00.82.93':445
'19#.#00.114.235':445
'19#.#00.155.193':445
'19#.#00.82.17':445
'19#.#00.206.106':445
'19#.#00.253.243':445
'19#.#00.99.56':445
'19#.#00.49.13':445
'19#.#00.75.134':445
'19#.#00.15.101':445
'19#.#00.61.250':445
'19#.#00.161.184':445
'19#.#00.50.156':445
'19#.#00.171.50':445
'19#.#00.130.126':445
'19#.#00.223.236':445
'19#.#00.82.93':9988
'19#.#00.56.28':9988
'19#.#00.253.243':9988
'19#.#00.62.196':9988
'19#.#00.130.126':9988
'19#.#00.11.85':9988
'19#.#00.74.19':9988
'19#.#00.179.204':9988
'19#.#00.115.78':9988
'19#.#00.75.134':9988
'19#.#00.155.193':9988
'19#.#00.202.134':9988
'19#.#00.194.75':9988
'19#.#00.224.166':9988
'19#.#00.69.40':9988
'19#.#00.8.216':9988
'19#.#00.61.250':9988
'19#.#00.172.183':9988
'19#.#00.48.101':9988
'19#.#00.87.2':9988
'19#.#00.143.168':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней