Trojan.DownLoader29.45811

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\9988] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\9988] 'ImagePath' = '%WINDIR%\hynbye.exe'

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\hynbye.exe
C:\nvidia_update\a.ser
%WINDIR%\syswow64\a.xml
%WINDIR%\syswow64\b.xml
C:\nvidia_update\445.txt
%WINDIR%\temp\smb\3132.bat
C:\nvidia_update\jbs.txt

Удаляет следующие файлы

C:\nvidia_update\445.txt

Сетевая активность

Подключается к

'22#.#29.204.177':8888
'52.#.2.224':8080
'52.#.2.225':8080
'52.#.2.226':8080
'52.#.2.227':8080
'52.#.2.228':8080
'52.#.2.229':8080
'52.#.2.230':8080
'52.#.2.231':8080
'52.#.2.232':8080
'52.#.2.233':8080
'52.#.2.234':8080
'52.#.2.235':8080
'52.#.2.221':8080
'52.#.2.236':8080
'52.#.2.223':8080
'52.#.2.238':8080
'52.#.2.251':8080
'52.#.2.250':8080
'52.#.2.249':8080
'52.#.2.248':8080
'52.#.2.247':8080
'52.#.2.219':8080
'52.#.2.246':8080
'52.#.2.244':8080
'52.#.2.243':8080
'52.#.2.242':8080
'52.#.2.241':8080
'52.#.2.240':8080
'52.#.2.239':8080
'52.#.2.245':8080
'52.#.2.237':8080
'52.#.2.222':8080
'52.#.2.220':8080
'52.#.2.218':8080
'52.#.2.190':8080
'52.#.2.191':8080
'52.#.2.192':8080
'52.#.2.193':8080
'52.#.2.194':8080
'52.#.2.195':8080
'52.#.2.196':8080
'52.#.2.197':8080
'52.#.2.198':8080
'52.#.2.199':8080
'52.#.2.200':8080
'52.#.2.201':8080
'52.#.2.202':8080
'52.#.2.203':8080
'52.#.2.217':8080
'52.#.2.210':8080
'52.#.2.204':8080
'52.#.2.253':8080
'52.#.2.211':8080
'52.#.2.216':8080
'52.#.2.215':8080
'52.#.2.214':8080
'52.#.2.213':8080
'52.#.2.140':8080
'52.#.2.212':8080
'52.#.2.209':8080
'52.#.2.187':8080
'52.#.2.208':8080
'52.#.2.207':8080
'52.#.2.206':8080
'52.#.2.205':8080
'52.#.2.252':8080
'52.#.2.254':8080
'52.#.3.35':8080
'52.#.3.1':8080
'52.#.3.37':8080
'52.#.3.38':8080
'52.#.3.39':8080
'52.#.3.40':8080
'52.#.3.41':8080
'52.#.3.42':8080
'52.#.3.43':8080
'52.#.3.44':8080
'52.#.3.45':8080
'52.#.3.46':8080
'52.#.3.47':8080
'52.#.3.48':8080
'52.#.3.49':8080
'52.#.3.50':8080
'52.#.3.51':8080
'52.#.3.65':8080
'52.#.3.58':8080
'52.#.3.59':8080
'52.#.3.64':8080
'52.#.3.63':8080
'52.#.3.62':8080
'52.#.3.61':8080
'52.#.3.60':8080
'52.#.3.36':8080
'52.#.3.34':8080
'52.#.3.33':8080
'52.#.3.56':8080
'52.#.3.55':8080
'52.#.3.54':8080
'52.#.3.53':8080
'52.#.3.52':8080
'52.#.3.57':8080
'52.#.2.189':8080
'52.#.2.186':8080
'52.#.2.255':8080
'52.#.3.2':8080
'52.#.3.3':8080
'52.#.3.4':8080
'52.#.3.5':8080
'52.#.3.6':8080
'52.#.3.7':8080
'52.#.3.8':8080
'52.#.3.9':8080
'52.#.3.10':8080
'52.#.3.11':8080
'52.#.3.12':8080
'52.#.3.13':8080
'52.#.3.14':8080
'52.#.3.15':8080
'52.#.3.16':8080
'52.#.3.30':8080
'52.#.3.23':8080
'52.#.3.24':8080
'52.#.3.29':8080
'52.#.3.28':8080
'52.#.3.27':8080
'52.#.3.26':8080
'52.#.3.25':8080
'52.#.3.31':8080
'52.#.3.32':8080
'52.#.3.0':8080
'52.#.3.21':8080
'52.#.3.20':8080
'52.#.3.19':8080
'52.#.3.18':8080
'52.#.3.17':8080
'52.#.3.22':8080
'52.#.2.188':8080
'52.#.2.185':8080
'52.#.2.184':8080
'52.#.2.85':8080
'52.#.2.86':8080
'52.#.2.87':8080
'52.#.2.88':8080
'52.#.2.89':8080
'52.#.2.90':8080
'52.#.2.91':8080
'52.#.2.92':8080
'52.#.2.93':8080
'52.#.2.94':8080
'52.#.2.95':8080
'52.#.2.96':8080
'52.#.2.97':8080
'52.#.2.98':8080
'52.#.2.112':8080
'52.#.2.105':8080
'52.#.2.99':8080
'52.#.3.66':8080
'52.#.2.106':8080
'52.#.2.111':8080
'52.#.2.110':8080
'52.#.2.109':8080
'52.#.2.108':8080
'52.#.2.84':8080
'52.#.2.107':8080
'52.#.2.104':8080
'52.#.2.70':8080
'52.#.2.103':8080
'52.#.2.102':8080
'52.#.2.101':8080
'52.#.2.100':8080
'52.#.2.81':8080
'52.#.2.114':8080
'52.#.2.83':8080
'52.#.2.80':8080
'52.#.2.49':8080
'52.#.2.50':8080
'52.#.2.51':8080
'52.#.2.52':8080
'52.#.2.53':8080
'52.#.2.54':8080
'52.#.2.55':8080
'52.#.2.56':8080
'52.#.2.57':8080
'52.#.2.58':8080
'52.#.2.59':8080
'52.#.2.60':8080
'52.#.2.61':8080
'52.#.2.47':8080
'52.#.2.62':8080
'52.#.2.77':8080
'52.#.2.76':8080
'52.#.2.78':8080
'52.#.2.63':8080
'52.#.2.64':8080
'52.#.2.65':8080
'52.#.2.66':8080
'52.#.2.67':8080
'52.#.2.113':8080
'52.#.2.68':8080
'52.#.2.71':8080
'52.#.2.79':8080
'52.#.2.72':8080
'52.#.2.73':8080
'52.#.2.74':8080
'52.#.2.75':8080
'52.#.2.69':8080
'52.#.2.46':8080
'52.#.2.116':8080
'52.#.2.118':8080
'52.#.2.154':8080
'52.#.2.155':8080
'52.#.2.156':8080
'52.#.2.157':8080
'52.#.2.158':8080
'52.#.2.159':8080
'52.#.2.160':8080
'52.#.2.161':8080
'52.#.2.162':8080
'52.#.2.163':8080
'52.#.2.164':8080
'52.#.2.165':8080
'52.#.2.166':8080
'52.#.2.167':8080
'52.#.2.168':8080
'52.#.2.169':8080
'52.#.2.170':8080
'52.#.2.183':8080
'52.#.2.151':8080
'52.#.2.182':8080
'52.#.2.181':8080
'52.#.2.180':8080
'52.#.2.179':8080
'52.#.2.153':8080
'52.#.2.178':8080
'52.#.2.176':8080
'52.#.2.115':8080
'52.#.2.174':8080
'52.#.2.173':8080
'52.#.2.172':8080
'52.#.2.171':8080
'52.#.2.177':8080
'52.#.2.117':8080
'52.#.2.152':8080
'52.#.2.150':8080
'52.#.2.119':8080
'52.#.2.120':8080
'52.#.2.121':8080
'52.#.2.122':8080
'52.#.2.123':8080
'52.#.2.124':8080
'52.#.2.125':8080
'52.#.2.126':8080
'52.#.2.127':8080
'52.#.2.128':8080
'52.#.2.129':8080
'52.#.2.130':8080
'52.#.2.131':8080
'52.#.2.132':8080
'52.#.2.133':8080
'52.#.2.134':8080
'52.#.2.135':8080
'52.#.2.82':8080
'52.#.2.149':8080
'52.#.2.147':8080
'52.#.2.146':8080
'52.#.2.145':8080
'52.#.2.144':8080
'52.#.2.175':8080
'52.#.2.143':8080
'52.#.2.141':8080
'52.#.2.148':8080
'52.#.2.139':8080
'52.#.2.138':8080
'52.#.2.137':8080
'52.#.2.136':8080
'52.#.2.142':8080
'52.#.2.48':8080
'52.#.3.67':8080
'52.#.3.71':8080
'52.#.3.246':8080
'52.#.3.247':8080
'52.#.3.248':8080
'52.#.3.249':8080
'52.#.3.250':8080
'52.#.3.251':8080
'52.#.3.252':8080
'52.#.3.253':8080
'52.#.3.254':8080
'52.#.3.255':8080
'52.#.4.0':8080
'52.#.4.1':8080
'52.#.4.2':8080
'52.#.3.244':8080
'52.#.3.245':8080
'52.#.4.3':8080
'52.#.4.4':8080
'52.#.4.18':8080
'52.#.4.17':8080
'52.#.4.16':8080
'52.#.4.15':8080
'52.#.4.14':8080
'52.#.3.242':8080
'52.#.4.13':8080
'52.#.4.11':8080
'52.#.4.10':8080
'52.#.4.9':8080
'52.#.4.8':8080
'52.#.4.7':8080
'52.#.4.6':8080
'52.#.4.5':8080
'52.#.3.243':8080
'52.#.3.241':8080
'52.#.4.20':8080
'52.#.3.212':8080
'52.#.3.213':8080
'52.#.3.214':8080
'52.#.3.215':8080
'52.#.3.216':8080
'52.#.3.217':8080
'52.#.3.218':8080
'52.#.3.219':8080
'52.#.3.220':8080
'52.#.3.221':8080
'52.#.3.222':8080
'52.#.3.223':8080
'52.#.3.224':8080
'52.#.3.225':8080
'52.#.3.226':8080
'52.#.3.240':8080
'52.#.3.233':8080
'52.#.3.234':8080
'52.#.3.239':8080
'52.#.3.238':8080
'52.#.3.237':8080
'52.#.3.236':8080
'52.#.3.235':8080
'52.#.4.12':8080
'52.#.4.19':8080
'52.#.3.210':8080
'52.#.3.231':8080
'52.#.3.230':8080
'52.#.3.229':8080
'52.#.3.228':8080
'52.#.3.227':8080
'52.#.3.232':8080
'52.#.3.207':8080
'52.#.4.21':8080
'52.#.4.58':8080
'52.#.4.59':8080
'52.#.4.60':8080
'52.#.4.61':8080
'52.#.4.62':8080
'52.#.4.63':8080
'52.#.4.64':8080
'52.#.4.65':8080
'52.#.4.66':8080
'52.#.4.67':8080
'52.#.4.68':8080
'52.#.4.69':8080
'52.#.4.70':8080
'52.#.4.71':8080
'52.#.4.72':8080
'52.#.4.73':8080
'52.#.4.74':8080
'52.#.4.88':8080
'52.#.4.87':8080
'52.#.4.86':8080
'52.#.4.85':8080
'52.#.4.84':8080
'52.#.4.83':8080
'52.#.4.57':8080
'52.#.3.209':8080
'52.#.4.80':8080
'52.#.4.79':8080
'52.#.4.78':8080
'52.#.4.77':8080
'52.#.4.76':8080
'52.#.4.75':8080
'52.#.4.81':8080
'52.#.4.56':8080
'52.#.3.211':8080
'52.#.4.54':8080
'52.#.4.47':8080
'52.#.4.24':8080
'52.#.4.25':8080
'52.#.4.26':8080
'52.#.4.27':8080
'52.#.4.28':8080
'52.#.4.29':8080
'52.#.4.30':8080
'52.#.4.31':8080
'52.#.4.32':8080
'52.#.4.33':8080
'52.#.4.34':8080
'52.#.4.35':8080
'52.#.4.36':8080
'52.#.4.37':8080
'52.#.4.38':8080
'52.#.4.39':8080
'52.#.4.53':8080
'52.#.4.52':8080
'52.#.4.51':8080
'52.#.4.50':8080
'52.#.4.49':8080
'52.#.4.48':8080
'52.#.4.55':8080
'52.#.4.22':8080
'52.#.4.45':8080
'52.#.4.44':8080
'52.#.4.43':8080
'52.#.4.42':8080
'52.#.4.41':8080
'52.#.4.40':8080
'52.#.4.46':8080
'52.#.4.23':8080
'52.#.3.208':8080
'52.#.3.206':8080
'52.#.1.116':8080
'52.#.3.107':8080
'52.#.3.108':8080
'52.#.3.109':8080
'52.#.3.110':8080
'52.#.3.111':8080
'52.#.3.112':8080
'52.#.3.113':8080
'52.#.3.114':8080
'52.#.3.115':8080
'52.#.3.116':8080
'52.#.3.117':8080
'52.#.3.118':8080
'52.#.3.119':8080
'52.#.3.120':8080
'52.#.3.121':8080
'52.#.3.135':8080
'52.#.3.128':8080
'52.#.3.129':8080
'52.#.3.134':8080
'52.#.3.133':8080
'52.#.3.132':8080
'52.#.3.131':8080
'52.#.3.130':8080
'52.#.3.106':8080
'52.#.3.104':8080
'52.#.3.103':8080
'52.#.3.126':8080
'52.#.3.125':8080
'52.#.3.124':8080
'52.#.3.123':8080
'52.#.3.122':8080
'52.#.3.127':8080
'52.#.3.105':8080
'52.#.3.136':8080
'52.#.3.68':8080
'52.#.3.72':8080
'52.#.3.73':8080
'52.#.3.74':8080
'52.#.3.75':8080
'52.#.3.76':8080
'52.#.3.77':8080
'52.#.3.78':8080
'52.#.3.79':8080
'52.#.3.80':8080
'52.#.3.81':8080
'52.#.3.82':8080
'52.#.3.83':8080
'52.#.3.84':8080
'52.#.3.85':8080
'52.#.3.86':8080
'52.#.3.100':8080
'52.#.3.93':8080
'52.#.3.94':8080
'52.#.3.99':8080
'52.#.3.98':8080
'52.#.3.97':8080
'52.#.3.96':8080
'52.#.3.95':8080
'52.#.3.101':8080
'52.#.3.102':8080
'52.#.3.70':8080
'52.#.3.91':8080
'52.#.3.90':8080
'52.#.3.89':8080
'52.#.3.88':8080
'52.#.3.87':8080
'52.#.3.92':8080
'52.#.3.69':8080
'52.#.3.137':8080
'52.#.3.141':8080
'52.#.3.177':8080
'52.#.3.178':8080
'52.#.3.179':8080
'52.#.3.180':8080
'52.#.3.181':8080
'52.#.3.182':8080
'52.#.3.183':8080
'52.#.3.184':8080
'52.#.3.185':8080
'52.#.3.186':8080
'52.#.3.187':8080
'52.#.3.188':8080
'52.#.3.189':8080
'52.#.3.190':8080
'52.#.3.191':8080
'52.#.3.205':8080
'52.#.3.198':8080
'52.#.3.199':8080
'52.#.3.204':8080
'52.#.3.203':8080
'52.#.3.202':8080
'52.#.3.201':8080
'52.#.3.200':8080
'52.#.3.176':8080
'52.#.3.174':8080
'52.#.3.173':8080
'52.#.3.196':8080
'52.#.3.195':8080
'52.#.3.194':8080
'52.#.3.193':8080
'52.#.3.192':8080
'52.#.3.197':8080
'52.#.3.175':8080
'52.#.3.138':8080
'52.#.3.139':8080
'52.#.3.142':8080
'52.#.3.143':8080
'52.#.3.144':8080
'52.#.3.145':8080
'52.#.3.146':8080
'52.#.3.147':8080
'52.#.3.148':8080
'52.#.3.149':8080
'52.#.3.150':8080
'52.#.3.151':8080
'52.#.3.152':8080
'52.#.3.153':8080
'52.#.3.154':8080
'52.#.3.155':8080
'52.#.3.156':8080
'52.#.3.170':8080
'52.#.3.163':8080
'52.#.3.164':8080
'52.#.3.169':8080
'52.#.3.168':8080
'52.#.3.167':8080
'52.#.3.166':8080
'52.#.3.165':8080
'52.#.3.171':8080
'52.#.3.172':8080
'52.#.3.140':8080
'52.#.3.161':8080
'52.#.3.160':8080
'52.#.3.159':8080
'52.#.3.158':8080
'52.#.3.157':8080
'52.#.3.162':8080
'52.#.2.45':8080
'52.#.2.44':8080
'52.#.2.43':8080
'52.#.0.177':8080
'52.#.0.178':8080
'52.#.0.179':8080
'52.#.0.180':8080
'52.#.0.181':8080
'52.#.0.182':8080
'52.#.0.183':8080
'52.#.0.184':8080
'52.#.0.185':8080
'52.#.0.186':8080
'52.#.0.187':8080
'52.#.0.188':8080
'52.#.0.174':8080
'52.#.0.189':8080
'52.#.0.176':8080
'52.#.0.191':8080
'52.#.0.173':8080
'52.#.0.190':8080
'52.#.0.204':8080
'52.#.0.203':8080
'52.#.0.202':8080
'52.#.0.201':8080
'52.#.0.171':8080
'52.#.0.200':8080
'52.#.0.198':8080
'52.#.0.197':8080
'52.#.0.196':8080
'52.#.0.195':8080
'52.#.0.194':8080
'52.#.0.193':8080
'52.#.0.192':8080
'52.#.0.172':8080
'52.#.0.140':8080
'52.#.0.207':8080
'52.#.0.143':8080
'52.#.0.144':8080
'52.#.0.145':8080
'52.#.0.146':8080
'52.#.0.147':8080
'52.#.0.148':8080
'52.#.0.149':8080
'52.#.0.150':8080
'52.#.0.151':8080
'52.#.0.152':8080
'52.#.0.153':8080
'52.#.0.154':8080
'52.#.0.155':8080
'52.#.0.156':8080
'52.#.0.170':8080
'52.#.0.169':8080
'52.#.0.206':8080
'52.#.0.162':8080
'52.#.0.168':8080
'52.#.0.167':8080
'52.#.0.166':8080
'52.#.0.165':8080
'52.#.0.205':8080
'52.#.0.199':8080
'52.#.0.164':8080
'52.#.0.141':8080
'52.#.0.160':8080
'52.#.0.159':8080
'52.#.0.158':8080
'52.#.0.157':8080
'52.#.0.163':8080
'52.#.0.161':8080
'52.#.1.20':8080
'52.#.0.208':8080
'52.#.0.245':8080
'52.#.0.246':8080
'52.#.0.247':8080
'52.#.0.248':8080
'52.#.0.249':8080
'52.#.0.250':8080
'52.#.0.251':8080
'52.#.0.252':8080
'52.#.0.253':8080
'52.#.0.254':8080
'52.#.0.255':8080
'52.#.1.0':8080
'52.#.1.1':8080
'52.#.1.2':8080
'52.#.1.3':8080
'52.#.1.4':8080
'52.#.1.18':8080
'52.#.1.17':8080
'52.#.1.16':8080
'52.#.1.15':8080
'52.#.1.14':8080
'52.#.1.13':8080
'52.#.0.243':8080
'52.#.1.12':8080
'52.#.0.242':8080
'52.#.1.9':8080
'52.#.1.8':8080
'52.#.1.7':8080
'52.#.1.6':8080
'52.#.1.5':8080
'52.#.1.11':8080
'52.#.0.139':8080
'52.#.0.240':8080
'52.#.0.142':8080
'52.#.0.209':8080
'52.#.0.231':8080
'52.#.0.211':8080
'52.#.0.212':8080
'52.#.0.213':8080
'52.#.0.214':8080
'52.#.0.215':8080
'52.#.0.216':8080
'52.#.0.217':8080
'52.#.0.218':8080
'52.#.0.219':8080
'52.#.0.220':8080
'52.#.0.221':8080
'52.#.0.222':8080
'52.#.0.223':8080
'52.#.0.224':8080
'52.#.0.225':8080
'52.#.0.239':8080
'52.#.0.238':8080
'52.#.0.237':8080
'52.#.0.236':8080
'52.#.0.235':8080
'52.#.0.234':8080
'52.#.0.241':8080
'52.#.0.233':8080
'52.#.0.244':8080
'52.#.0.230':8080
'52.#.0.229':8080
'52.#.0.228':8080
'52.#.0.227':8080
'52.#.0.226':8080
'52.#.0.232':8080
'52.#.0.138':8080
'52.#.0.210':8080
'52.#.0.137':8080
'52.#.0.136':8080
'52.#.0.35':8080
'52.#.0.38':8080
'52.#.0.39':8080
'52.#.0.40':8080
'52.#.0.41':8080
'52.#.0.42':8080
'52.#.0.43':8080
'52.#.0.44':8080
'52.#.0.45':8080
'52.#.0.46':8080
'52.#.0.47':8080
'52.#.0.48':8080
'52.#.0.49':8080
'52.#.0.50':8080
'52.#.0.51':8080
'52.#.0.65':8080
'52.#.0.64':8080
'52.#.0.66':8080
'52.#.0.57':8080
'52.#.0.63':8080
'52.#.0.62':8080
'52.#.0.61':8080
'52.#.0.60':8080
'52.#.0.34':8080
'52.#.0.37':8080
'52.#.0.59':8080
'52.#.1.19':8080
'52.#.0.55':8080
'52.#.0.54':8080
'52.#.0.53':8080
'52.#.0.52':8080
'52.#.0.58':8080
'52.#.0.56':8080
'52.#.0.67':8080
'52.#.0.33':8080
'52.#.0.0':8080
'52.#.0.2':8080
'52.#.0.3':8080
'52.#.0.4':8080
'52.#.0.5':8080
'52.#.0.6':8080
'52.#.0.7':8080
'52.#.0.8':8080
'52.#.0.9':8080
'52.#.0.10':8080
'52.#.0.11':8080
'52.#.0.12':8080
'52.#.0.13':8080
'52.#.0.14':8080
'52.#.0.15':8080
'52.#.0.1':8080
'52.#.0.16':8080
'52.#.0.29':8080
'52.#.0.30':8080
'52.#.0.23':8080
'52.#.0.17':8080
'52.#.0.18':8080
'52.#.0.19':8080
'52.#.0.20':8080
'52.#.0.31':8080
'52.#.0.21':8080
'52.#.0.24':8080
'52.#.0.32':8080
'52.#.0.25':8080
'52.#.0.26':8080
'52.#.0.27':8080
'52.#.0.28':8080
'52.#.0.22':8080
'52.#.1.10':8080
'52.#.0.69':8080
'52.#.0.71':8080
'52.#.0.107':8080
'52.#.0.108':8080
'52.#.0.109':8080
'52.#.0.110':8080
'52.#.0.111':8080
'52.#.0.112':8080
'52.#.0.113':8080
'52.#.0.114':8080
'52.#.0.115':8080
'52.#.0.116':8080
'52.#.0.117':8080
'52.#.0.118':8080
'52.#.0.119':8080
'52.#.0.120':8080
'52.#.0.121':8080
'52.#.0.135':8080
'52.#.0.128':8080
'52.#.0.129':8080
'52.#.0.134':8080
'52.#.0.133':8080
'52.#.0.132':8080
'52.#.0.131':8080
'52.#.0.130':8080
'52.#.0.106':8080
'52.#.0.104':8080
'52.#.0.103':8080
'52.#.0.126':8080
'52.#.0.125':8080
'52.#.0.124':8080
'52.#.0.123':8080
'52.#.0.122':8080
'52.#.0.127':8080
'52.#.0.105':8080
'52.#.0.68':8080
'52.#.0.36':8080
'52.#.0.72':8080
'52.#.0.73':8080
'52.#.0.74':8080
'52.#.0.75':8080
'52.#.0.76':8080
'52.#.0.77':8080
'52.#.0.78':8080
'52.#.0.79':8080
'52.#.0.80':8080
'52.#.0.81':8080
'52.#.0.82':8080
'52.#.0.83':8080
'52.#.0.84':8080
'52.#.0.85':8080
'52.#.0.86':8080
'52.#.0.100':8080
'52.#.0.93':8080
'52.#.0.94':8080
'52.#.0.99':8080
'52.#.0.98':8080
'52.#.0.97':8080
'52.#.0.96':8080
'52.#.0.95':8080
'52.#.0.101':8080
'52.#.0.102':8080
'52.#.0.70':8080
'52.#.0.91':8080
'52.#.0.90':8080
'52.#.0.89':8080
'52.#.0.88':8080
'52.#.0.87':8080
'52.#.0.92':8080
'52.#.0.175':8080
'52.#.1.21':8080
'52.#.1.198':8080
'52.#.1.200':8080
'52.#.1.201':8080
'52.#.1.202':8080
'52.#.1.203':8080
'52.#.1.204':8080
'52.#.1.205':8080
'52.#.1.206':8080
'52.#.1.207':8080
'52.#.1.208':8080
'52.#.1.209':8080
'52.#.1.210':8080
'52.#.1.211':8080
'52.#.1.212':8080
'52.#.1.213':8080
'52.#.1.214':8080
'52.#.1.228':8080
'52.#.1.221':8080
'52.#.1.222':8080
'52.#.1.227':8080
'52.#.1.226':8080
'52.#.1.225':8080
'52.#.1.224':8080
'52.#.1.223':8080
'52.#.1.199':8080
'52.#.1.197':8080
'52.#.1.196':8080
'52.#.1.219':8080
'52.#.1.218':8080
'52.#.1.217':8080
'52.#.1.216':8080
'52.#.1.215':8080
'52.#.1.220':8080
'52.#.1.22':8080
'52.#.1.229':8080
'52.#.1.162':8080
'52.#.1.165':8080
'52.#.1.166':8080
'52.#.1.167':8080
'52.#.1.168':8080
'52.#.1.169':8080
'52.#.1.170':8080
'52.#.1.171':8080
'52.#.1.172':8080
'52.#.1.173':8080
'52.#.1.174':8080
'52.#.1.175':8080
'52.#.1.176':8080
'52.#.1.177':8080
'52.#.1.178':8080
'52.#.1.179':8080
'52.#.1.193':8080
'52.#.1.186':8080
'52.#.1.187':8080
'52.#.1.192':8080
'52.#.1.191':8080
'52.#.1.190':8080
'52.#.1.189':8080
'52.#.1.188':8080
'52.#.1.194':8080
'52.#.1.195':8080
'52.#.1.163':8080
'52.#.1.184':8080
'52.#.1.183':8080
'52.#.1.182':8080
'52.#.1.181':8080
'52.#.1.180':8080
'52.#.1.185':8080
'52.#.1.164':8080
'52.#.1.230':8080
'52.#.1.234':8080
'52.#.2.14':8080
'52.#.2.15':8080
'52.#.2.16':8080
'52.#.2.17':8080
'52.#.2.18':8080
'52.#.2.19':8080
'52.#.2.20':8080
'52.#.2.21':8080
'52.#.2.22':8080
'52.#.2.23':8080
'52.#.2.24':8080
'52.#.2.25':8080
'52.#.2.26':8080
'52.#.2.27':8080
'52.#.2.28':8080
'52.#.2.42':8080
'52.#.2.35':8080
'52.#.2.36':8080
'52.#.2.41':8080
'52.#.2.40':8080
'52.#.2.39':8080
'52.#.2.38':8080
'52.#.2.37':8080
'52.#.2.13':8080
'52.#.2.11':8080
'52.#.2.10':8080
'52.#.2.33':8080
'52.#.2.32':8080
'52.#.2.31':8080
'52.#.2.30':8080
'52.#.2.29':8080
'52.#.2.34':8080
'52.#.2.12':8080
'52.#.1.231':8080
'52.#.1.232':8080
'52.#.1.235':8080
'52.#.1.236':8080
'52.#.1.237':8080
'52.#.1.238':8080
'52.#.1.239':8080
'52.#.1.240':8080
'52.#.1.241':8080
'52.#.1.242':8080
'52.#.1.243':8080
'52.#.1.244':8080
'52.#.1.245':8080
'52.#.1.246':8080
'52.#.1.247':8080
'52.#.1.248':8080
'52.#.1.249':8080
'52.#.2.7':8080
'52.#.2.0':8080
'52.#.2.1':8080
'52.#.2.6':8080
'52.#.2.5':8080
'52.#.2.4':8080
'52.#.2.3':8080
'52.#.2.2':8080
'52.#.2.8':8080
'52.#.2.9':8080
'52.#.1.233':8080
'52.#.1.254':8080
'52.#.1.253':8080
'52.#.1.252':8080
'52.#.1.251':8080
'52.#.1.250':8080
'52.#.1.255':8080
'52.#.4.82':8080
'52.#.4.89':8080
'52.#.1.159':8080
'52.#.1.60':8080
'52.#.1.61':8080
'52.#.1.62':8080
'52.#.1.63':8080
'52.#.1.64':8080
'52.#.1.65':8080
'52.#.1.66':8080
'52.#.1.67':8080
'52.#.1.68':8080
'52.#.1.69':8080
'52.#.1.70':8080
'52.#.1.71':8080
'52.#.1.72':8080
'52.#.1.73':8080
'52.#.1.74':8080
'52.#.1.88':8080
'52.#.1.81':8080
'52.#.1.82':8080
'52.#.1.87':8080
'52.#.1.86':8080
'52.#.1.85':8080
'52.#.1.84':8080
'52.#.1.83':8080
'52.#.1.59':8080
'52.#.1.57':8080
'52.#.1.46':8080
'52.#.1.79':8080
'52.#.1.78':8080
'52.#.1.77':8080
'52.#.1.76':8080
'52.#.1.75':8080
'52.#.1.80':8080
'52.#.1.160':8080
'52.#.1.89':8080
'52.#.1.54':8080
'52.#.1.24':8080
'52.#.1.25':8080
'52.#.1.26':8080
'52.#.1.27':8080
'52.#.1.28':8080
'52.#.1.29':8080
'52.#.1.30':8080
'52.#.1.31':8080
'52.#.1.32':8080
'52.#.1.33':8080
'52.#.1.34':8080
'52.#.1.35':8080
'52.#.1.36':8080
'52.#.1.37':8080
'52.#.1.23':8080
'52.#.1.38':8080
'52.#.1.53':8080
'52.#.1.39':8080
'52.#.1.40':8080
'52.#.1.41':8080
'52.#.1.42':8080
'52.#.1.43':8080
'52.#.1.44':8080
'52.#.1.56':8080
'52.#.1.45':8080
'52.#.1.55':8080
'52.#.1.48':8080
'52.#.1.49':8080
'52.#.1.50':8080
'52.#.1.51':8080
'52.#.1.52':8080
'52.#.1.47':8080
'52.#.1.161':8080
'52.#.1.90':8080
'52.#.1.93':8080
'52.#.1.129':8080
'52.#.1.130':8080
'52.#.1.131':8080
'52.#.1.132':8080
'52.#.1.133':8080
'52.#.1.134':8080
'52.#.1.135':8080
'52.#.1.136':8080
'52.#.1.137':8080
'52.#.1.138':8080
'52.#.1.139':8080
'52.#.1.140':8080
'52.#.1.141':8080
'52.#.1.142':8080
'52.#.1.143':8080
'52.#.1.144':8080
'52.#.1.145':8080
'52.#.1.127':8080
'52.#.1.158':8080
'52.#.1.157':8080
'52.#.1.156':8080
'52.#.1.155':8080
'52.#.1.154':8080
'52.#.1.128':8080
'52.#.1.153':8080
'52.#.1.91':8080
'52.#.1.150':8080
'52.#.1.149':8080
'52.#.1.148':8080
'52.#.1.147':8080
'52.#.1.146':8080
'52.#.1.152':8080
'52.#.1.92':8080
'52.#.1.151':8080
'52.#.1.58':8080
'52.#.1.94':8080
'52.#.1.95':8080
'52.#.1.96':8080
'52.#.1.97':8080
'52.#.1.98':8080
'52.#.1.99':8080
'52.#.1.100':8080
'52.#.1.101':8080
'52.#.1.102':8080
'52.#.1.103':8080
'52.#.1.104':8080
'52.#.1.105':8080
'52.#.1.106':8080
'52.#.1.107':8080
'52.#.1.108':8080
'52.#.1.109':8080
'52.#.1.110':8080
'52.#.1.125':8080
'52.#.1.123':8080
'52.#.1.122':8080
'52.#.1.121':8080
'52.#.1.120':8080
'52.#.1.119':8080
'52.#.1.126':8080
'52.#.1.118':8080
'52.#.1.124':8080
'52.#.1.115':8080
'52.#.1.114':8080
'52.#.1.113':8080
'52.#.1.112':8080
'52.#.1.111':8080
'52.#.1.117':8080
'52.#.4.90':8080

TCP

Запросы HTTP GET

http://22#.###.204.177:8888/samba.exe

Другое

Ищет следующие окна

ClassName: '$$$UI0Background' WindowName: ''

Создает и запускает на исполнение

'%WINDIR%\hynbye.exe'

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c del /F /S /Q %WINDIR%\Temp\smb
'<SYSTEM32>\ui0detect.exe'
'%WINDIR%\syswow64\cmd.exe' /c md %WINDIR%\Temp\smb
'%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Temp\smb\3132.bat

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней