Trojan.Starman.6396

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER1945.dir00\svchost.exe.mdmp 16325836412031988

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER1945.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'82.#.144.252':445
'82.#.171.145':445
'82.#.212.106':445
'82.#.218.211':445
'82.#.15.74':445
'82.#.167.230':445
'82.#.49.19':445
'82.#.73.86':445
'82.#.23.18':445
'82.#.204.94':445
'82.#.252.141':445
'82.#.91.65':445
'82.#.52.234':445
'82.#.140.238':139
'82.#.157.106':139
'82.#.127.174':139
'82.#.101.156':139
'82.#.47.191':139
'82.#.166.188':139
'82.#.226.46':139
'82.#.213.217':445
'82.#.247.42':445
'82.#.173.231':445
'82.#.57.41':139
'82.#.210.137':139
'82.#.73.16':139
'82.#.157.106':445
'82.#.127.174':445
'82.#.226.46':445
'82.#.47.191':445
'82.#.166.188':445
'82.#.140.238':445
'82.#.57.41':445
'82.#.73.8':139
'82.#.243.72':139
'82.#.174.41':139
'82.#.210.137':445
'82.#.73.16':445
'82.#.7.165':139
'82.#.255.77':445
'82.#.206.95':445
'82.#.108.46':445
'82.#.237.153':445
'82.#.122.183':445
'82.#.77.114':445
'82.#.250.209':445
'82.#.206.186':445
'82.#.17.204':445
'82.#.101.156':445
'82.#.144.182':445
'82.#.189.10':445
'82.#.6.126':445
'82.#.188.81':445
'82.#.243.89':445
'82.#.153.252':445
'82.#.17.207':445
'82.#.28.122':445
'82.#.82.13':445
'82.#.53.192':445
'82.#.145.45':445
'82.#.213.217':139
'82.#.247.42':139
'82.#.118.53':445
'82.#.63.118':445
'82.#.48.64':445
'82.#.28.122':139
'82.#.82.13':139
'82.#.188.81':139
'82.#.33.71':445
'82.#.114.178':445
'82.#.17.207':139
'82.#.243.89':139
'82.#.63.118':139
'82.#.48.64':139
'82.#.145.45':139
'82.#.153.252':139
'82.#.53.192':139
'82.#.118.53':139
'82.#.77.114':139
'82.#.255.77':139
'82.#.206.95':139
'82.#.204.94':139
'82.#.237.153':139
'82.#.122.183':139
'82.#.108.46':139
'82.#.6.126':139
'82.#.206.186':139
'82.#.17.204':139
'82.#.250.209':139
'82.#.144.182':139
'82.#.189.10':139
'82.#.167.230':139
'82.#.144.252':139
'82.#.171.145':139
'82.#.173.231':139
'82.#.218.211':139
'82.#.15.74':139
'82.#.212.106':139
'82.#.52.234':139
'82.#.73.86':139
'82.#.23.18':139
'82.#.49.19':139
'82.#.252.141':139
'82.#.91.65':139
'82.#.44.191':139
'82.#.170.85':445
'82.#.73.39':445
'82.#.121.97':445
'82.#.83.136':445
'82.#.250.20':445
'82.#.47.114':445
'82.#.101.24':445
'82.#.86.168':445
'82.#.218.79':445
'82.#.20.26':445
'82.#.67.95':445
'82.#.68.144':445
'82.#.215.67':445
'82.#.73.151':445
'82.#.251.242':445
'82.#.245.208':445
'82.#.225.237':139
'82.#.125.103':139
'82.#.112.230':139
'82.#.36.224':445
'82.#.127.70':445
'82.#.12.64':445
'82.#.136.162':445
'82.#.180.53':445
'82.#.207.190':445
'82.#.33.21':445
'82.#.28.34':139
'82.#.161.45':139
'82.#.39.157':139
'82.#.125.103':445
'82.#.112.230':445
'82.#.34.147':139
'82.#.94.22':139
'82.#.76.161':139
'82.#.63.181':139
'82.#.64.21':139
'82.#.56.4':139
'82.#.81.177':139
'82.#.39.32':139
'82.#.8.112':445
'82.#.18.246':445
'82.#.200.2':445
'82.#.115.235':445
'82.#.132.96':445
'82.#.5.145':445
'82.#.93.248':445
'82.#.87.56':445
'82.#.121.63':445
'82.#.225.237':445
'82.#.254.63':445
'82.#.12.17':445
'82.#.100.208':445
'82.#.40.181':445
'82.#.73.151':139
'82.#.251.242':139
'82.#.33.134':445
'82.#.56.15':445
'82.#.131.243':445
'82.#.245.208':139
'82.#.33.21':139
'82.#.127.70':139
'82.#.12.64':139
'82.#.36.224':139
'82.#.180.53':139
'82.#.207.190':139
'82.#.56.15':139
'82.#.131.243':139
'82.#.40.181':139
'82.#.13.38':139
'82.#.133.165':139
'82.#.33.134':139
'82.#.7.165':445
'82.#.44.191':445
'82.#.13.38':445
'82.#.133.165':445
'82.#.73.8':445
'82.#.243.72':445
'82.#.174.41':445
'82.#.5.145':139
'82.#.8.112':139
'82.#.18.246':139
'82.#.20.26':139
'82.#.115.235':139
'82.#.132.96':139
'82.#.200.2':139
'82.#.100.208':139
'82.#.87.56':139
'82.#.121.63':139
'82.#.93.248':139
'82.#.254.63':139
'82.#.12.17':139
'82.#.47.114':139
'82.#.170.85':139
'82.#.73.39':139
'82.#.136.162':139
'82.#.83.136':139
'82.#.250.20':139
'82.#.121.97':139
'82.#.215.67':139
'82.#.86.168':139
'82.#.218.79':139
'82.#.101.24':139
'82.#.67.95':139
'82.#.68.144':139
'82.#.215.39':445
'82.#.7.235':445
'82.#.194.7':445
'82.#.216.104':445
'82.#.182.219':445
'82.#.108.122':445
'82.#.98.69':445
'82.#.33.78':445
'82.#.252.203':445
'82.#.140.75':445
'82.#.75.252':445
'82.#.31.34':445
'82.#.4.166':445
'82.#.0.126':445
'82.#.53.38':445
'82.#.145.163':445
'82.#.248.101':445
'82.#.164.33':445
'82.#.216.164':445
'82.#.101.200':445
'82.#.166.247':445
'82.#.11.32':445
'82.#.21.119':445
'82.#.120.15':445
'82.#.47.35':445
'82.#.63.249':445
'82.#.159.116':445
'82.#.77.36':445
'82.#.187.246':445
'82.#.181.149':445
'82.#.124.124':445
'82.#.22.138':445
'82.#.26.224':445
'82.#.82.191':445
'82.#.182.245':445
'82.#.53.38':9988
'82.#.47.35':9988
'82.#.87.131':445
'82.#.29.241':445
'82.#.91.71':445
'82.#.99.132':445
'82.#.29.42':445
'82.#.40.29':445
'82.#.138.139':445
'82.#.29.139':445
'82.#.157.123':445
'82.#.23.40':445
'82.#.249.78':445
'82.#.181.250':445
'82.#.77.141':445
'82.#.58.243':445
'82.#.62.203':445
'82.#.217.177':445
'82.#.98.69':139
'82.#.7.235':139
'82.#.194.7':139
'82.#.120.15':139
'82.#.182.219':139
'82.#.108.122':139
'82.#.216.104':139
'82.#.0.126':139
'82.#.252.203':139
'82.#.75.252':139
'82.#.33.78':139
'82.#.31.34':139
'82.#.4.166':139
'82.#.145.163':139
'82.#.53.38':139
'82.#.101.200':139
'82.#.164.33':139
'82.#.34.185':139
'82.#.216.164':139
'82.#.248.101':139
'82.#.159.116':139
'82.#.11.32':139
'82.#.21.119':139
'82.#.166.247':139
'82.#.47.35':139
'82.#.63.249':139
'82.#.26.224':139
'82.#.77.36':139
'82.#.187.246':139
'82.#.77.141':139
'82.#.124.124':139
'82.#.22.138':139
'82.#.181.149':139
'82.#.91.71':139
'82.#.182.245':139
'82.#.34.185':445
'82.#.82.191':139
'82.#.87.131':139
'82.#.29.241':139
'82.#.157.123':139
'82.#.99.132':139
'82.#.29.42':139
'82.#.140.75':139
'82.#.138.139':139
'82.#.29.139':139
'82.#.40.29':139
'82.#.217.177':139
'82.#.181.250':139
'82.#.249.78':139
'82.#.23.40':139
'82.#.58.243':139
'82.#.62.203':139
'82.#.63.249':9988
'82.#.114.178':139
'82.#.175.239':445
'82.#.239.41':445
'82.#.17.77':139
'82.#.215.39':139
'82.#.33.71':139
'82.#.109.238':445
'82.#.226.207':445
'82.#.84.65':445
'82.#.115.222':445
'82.#.213.32':445
'82.#.80.164':445
'82.#.207.163':445
'82.#.16.242':139
'82.#.57.32':139
'82.#.121.161':139
'82.#.39.126':139
'82.#.83.86':139
'82.#.242.143':139
'82.#.34.61':139
'82.#.203.97':139
'82.#.202.202':139
'82.#.76.203':139
'82.#.1.179':139
'82.#.18.129':139
'82.#.97.230':139
'82.#.57.32':445
'82.#.121.161':445
'82.#.34.61':445
'82.#.83.86':445
'82.#.242.143':445
'82.#.16.242':445
'82.#.1.179':445
'82.#.202.202':445
'82.#.76.203':445
'82.#.17.77':445
'82.#.18.129':445
'82.#.97.230':445
'82.#.203.97':445
'82.#.117.26':445
'82.#.133.190':445
'82.#.57.127':445
'82.#.145.115':445
'82.#.175.91':445
'82.#.176.169':445
'82.#.114.38':445
'82.#.218.251':445
'82.#.61.25':445
'82.#.39.126':445
'82.#.105.9':445
'82.#.207.164':445
'82.#.2.134':445
'82.#.113.195':139
'82.#.49.127':139
'82.#.99.88':139
'82.#.102.15':139
'82.#.141.159':139
'82.#.212.141':139
'82.#.15.16':139
'82.#.10.25':445
'82.#.102.15':445
'82.#.141.159':445
'82.#.164.183':445
'82.#.58.140':445
'82.#.15.86':445
'82.#.98.69':9988
'82.#.7.235':9988
'82.#.31.34':9988
'82.#.159.116':9988
'82.#.11.32':9988
'82.#.182.219':9988
'82.#.29.139':9988
'82.#.58.140':139
'82.#.15.86':139
'82.#.10.25':139
'82.#.157.123':9988
'82.#.99.132':9988
'82.#.164.183':139
'82.#.176.169':139
'82.#.117.26':139
'82.#.133.190':139
'82.#.115.222':139
'82.#.145.115':139
'82.#.175.91':139
'82.#.57.127':139
'82.#.2.134':139
'82.#.218.251':139
'82.#.61.25':139
'82.#.114.38':139
'82.#.105.9':139
'82.#.207.164':139
'82.#.99.88':445
'82.#.15.16':445
'82.#.175.239':139
'82.#.212.141':445
'82.#.113.195':445
'82.#.49.127':445
'82.#.239.41':139
'82.#.207.163':139
'82.#.226.207':139
'82.#.84.65':139
'82.#.109.238':139
'82.#.213.32':139
'82.#.80.164':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней