Trojan.DownLoader9.48845

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WER491e.dir00\svchost.exe.mdmp 16325836412029672

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER491e.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'20#.#0.1.144':139
'20#.#0.190.125':139
'20#.#0.49.224':139
'20#.#0.183.123':139
'20#.#0.20.101':139
'20#.#0.236.127':139
'20#.#0.41.160':139
'20#.#0.176.169':139
'20#.#0.93.72':139
'20#.#0.94.105':139
'20#.#0.184.178':139
'20#.#0.49.123':139
'20#.#0.155.72':139
'20#.#0.54.206':139
'20#.#0.78.193':139
'20#.#0.98.18':139
'20#.#0.128.223':139
'20#.#0.193.174':139
'20#.#0.180.95':139
'20#.#0.12.68':139
'20#.#0.190.139':139
'20#.#0.240.8':139
'20#.#0.177.91':139
'20#.#0.49.49':139
'20#.#0.156.201':139
'20#.#0.153.159':139
'20#.#0.234.78':139
'20#.#0.76.139':139
'20#.#0.85.21':139
'20#.#0.34.89':139
'20#.#0.193.241':139
'20#.#0.242.83':139
'20#.#0.240.8':445
'20#.#0.49.158':445
'20#.#0.180.95':445
'20#.#0.128.223':445
'20#.#0.98.18':445
'20#.#0.67.149':445
'20#.#0.76.139':445
'20#.#0.94.105':445
'20#.#0.155.72':445
'20#.#0.11.86':445
'20#.#0.234.78':445
'20#.#0.156.201':445
'20#.#0.93.72':445
'20#.#0.193.241':445
'20#.#0.41.160':445
'20#.#0.190.125':445
'20#.#0.241.208':445
'20#.#0.41.84':445
'20#.#0.40.74':445
'20#.#0.20.101':445
'20#.#0.241.184':139
'20#.#0.109.125':445
'20#.#0.53.139':445
'20#.#0.122.24':139
'20#.#0.78.193':445
'20#.#0.210.102':445
'20#.#0.85.21':445
'20#.#0.49.224':445
'20#.#0.153.159':445
'20#.#0.199.219':445
'20#.#0.136.72':445
'20#.#0.34.89':445
'20#.#0.228.60':445
'20#.#0.204.53':445
'20#.#0.152.208':445
'20#.#0.61.107':445
'20#.#0.55.37':445
'20#.#0.93.21':445
'20#.#0.4.252':445
'20#.#0.63.249':445
'20#.#0.230.17':445
'20#.#0.222.189':445
'20#.#0.71.116':445
'20#.#0.63.28':445
'20#.#0.251.48':445
'20#.#0.21.227':445
'20#.#0.48.120':445
'20#.#0.97.34':445
'20#.#0.123.54':445
'20#.#0.136.199':445
'20#.#0.30.85':445
'20#.#0.184.30':445
'20#.#0.178.27':445
'20#.#0.243.101':445
'20#.#0.14.67':445
'20#.#0.15.61':445
'20#.#0.78.61':445
'20#.#0.72.151':445
'20#.#0.190.228':445
'20#.#0.161.36':445
'20#.#0.159.112':445
'20#.#0.36.231':445
'20#.#0.112.78':445
'20#.#0.61.30':445
'20#.#0.49.158':139
'20#.#0.40.74':139
'20#.#0.210.102':139
'20#.#0.67.149':139
'20#.#0.199.219':139
'20#.#0.136.72':139
'20#.#0.41.84':139
'20#.#0.53.139':139
'20#.#0.107.228':139
'20#.#0.14.116':139
'20#.#0.11.86':139
'20#.#0.44.105':139
'20#.#0.241.208':139
'20#.#0.149.98':139
'20#.#0.105.12':139
'20#.#0.90.162':139
'20#.#0.28.146':445
'20#.#0.172.238':445
'20#.#0.146.158':445
'20#.#0.170.97':445
'20#.#0.162.227':445
'20#.#0.34.66':445
'20#.#0.45.125':445
'20#.#0.168.162':445
'20#.#0.95.217':445
'20#.#0.239.35':445
'20#.#0.109.125':139
'20#.#0.20.106':445
'20#.#0.169.5':445
'20#.#0.85.81':445
'20#.#0.17.184':445
'20#.#0.200.213':445
'20#.#0.105.97':445
'20#.#0.91.252':445
'20#.#0.242.197':445
'20#.#0.164.149':445
'20#.#0.18.176':445
'20#.#0.194.169':445
'20#.#0.201.44':445
'20#.#0.154.140':445
'20#.#0.246.145':445
'20#.#0.236.131':445
'20#.#0.250.29':445
'20#.#0.55.169':445
'20#.#0.147.132':445
'20#.#0.220.16':445
'20#.60.1.21':445
'20#.#0.27.44':445
'20#.#0.38.68':139
'20#.#0.203.109':139
'20#.#0.93.153':139
'20#.#0.230.143':139
'20#.#0.9.118':139
'20#.#0.240.15':139
'20#.#0.98.113':139
'20#.#0.40.240':139
'20#.#0.58.137':445
'20#.#0.88.177':445
'20#.#0.250.229':445
'20#.#0.96.54':445
'20#.#0.145.96':139
'20#.#0.216.93':139
'20#.#0.54.110':445
'20#.60.6.64':139
'20#.#0.230.143':445
'20#.#0.50.242':445
'20#.#0.93.153':445
'20#.#0.38.68':445
'20#.#0.203.109':445
'20#.#0.83.157':445
'20#.#0.87.79':445
'20#.#0.42.90':445
'20#.#0.49.28':139
'20#.#0.135.0':139
'20#.#0.218.49':139
'20#.60.6.64':445
'20#.#0.145.96':445
'20#.#0.216.93':445
'20#.#0.38.223':139
'20#.60.41.1':139
'20#.#0.79.130':445
'20#.#0.99.13':445
'20#.#0.207.87':445
'20#.#0.91.120':445
'20#.#0.20.62':445
'20#.#0.189.218':445
'20#.#0.197.108':445
'20#.#0.150.20':445
'20#.#0.117.99':445
'20#.#0.240.15':445
'20#.#0.9.118':445
'20#.#0.171.72':445
'20#.#0.40.240':445
'20#.60.6.67':445
'20#.#0.98.113':445
'20#.#0.43.41':445
'20#.#0.118.229':139
'20#.#0.122.24':445
'20#.#0.14.27':139
'20#.#0.108.67':139
'20#.#0.176.169':445
'20#.#0.183.123':445
'20#.#0.241.184':445
'20#.#0.54.206':445
'20#.#0.58.137':139
'20#.#0.54.110':139
'20#.#0.250.229':139
'20#.#0.96.54':139
'20#.#0.108.67':445
'20#.#0.118.229':445
'20#.#0.88.177':139
'20#.#0.14.27':445
'20#.#0.193.174':445
'20#.#0.236.127':445
'20#.#0.1.144':445
'20#.#0.184.178':445
'20#.#0.107.228':445
'20#.#0.190.139':445
'20#.#0.90.162':445
'20#.#0.149.98':445
'20#.#0.177.91':445
'20#.#0.49.123':445
'20#.#0.242.83':445
'20#.#0.105.12':445
'20#.#0.14.116':445
'20#.#0.44.105':445
'20#.#0.12.68':445
'20#.#0.49.49':445
'20#.#0.79.130':139
'20#.#0.99.13':139
'20#.#0.207.87':139
'20#.#0.87.79':139
'20#.#0.20.62':139
'20#.#0.189.218':139
'20#.#0.197.108':139
'20#.#0.150.20':139
'20#.#0.50.242':139
'20#.#0.171.72':139
'20#.#0.83.157':139
'20#.60.6.67':139
'20#.#0.43.41':139
'20#.#0.91.120':139
'20#.#0.42.90':139
'20#.#0.117.99':139
'20#.#0.105.97':139
'20#.#0.91.252':139
'20#.#0.242.197':139
'20#.#0.164.149':139
'20#.#0.18.176':139
'20#.#0.194.169':139
'20#.#0.201.44':139
'20#.#0.154.140':139
'20#.#0.246.145':139
'20#.#0.236.131':139
'20#.#0.250.29':139
'20#.#0.55.169':139
'20#.#0.27.44':139
'20#.#0.220.16':139
'20#.60.1.21':139
'20#.#0.147.132':139
'20#.#0.107.142':445
'20#.#0.167.43':445
'20#.#0.150.80':445
'20#.#0.4.200':445
'20#.#0.89.50':445
'20#.#0.148.253':445
'20#.#0.176.27':445
'20#.#0.188.19':445
'20#.#0.203.208':445
'20#.#0.132.123':445
'20#.#0.150.220':445
'20#.#0.62.130':445
'20#.#0.161.228':445
'20#.#0.158.149':445
'20#.#0.139.159':445
'20#.#0.31.222':445
'20#.#0.123.141':445
'20#.#0.93.104':445
'20#.#0.124.96':445
'20#.#0.44.214':445
'20#.#0.235.0':445
'20#.#0.0.232':445
'20#.60.38.3':445
'20#.#0.72.179':445
'20#.#0.2.170':445
'20#.#0.170.22':445
'20#.#0.211.70':445
'20#.#0.214.1':445
'20#.#0.241.139':445
'20#.#0.110.124':445
'20#.#0.57.86':445
'20#.#0.32.163':445
'20#.#0.11.210':9988
'20#.#0.235.0':9988
'20#.#0.32.163':9988
'20#.#0.132.236':9988
'20#.#0.188.19':9988
'20#.#0.150.80':9988
'20#.#0.39.19':9988
'20#.#0.93.104':9988
'20#.#0.183.27':9988
'20#.#0.72.179':9988
'20#.#0.123.141':9988
'20#.#0.154.121':9988
'20#.#0.147.143':9988
'20#.#0.2.170':9988
'20#.#0.110.124':9988
'20#.#0.150.220':9988
'20#.#0.154.121':445
'20#.#0.224.112':445
'20#.#0.31.222':9988
'20#.#0.132.123':9988
'20#.#0.147.143':445
'20#.#0.75.158':445
'20#.#0.220.120':445
'20#.#0.73.130':445
'20#.#0.177.44':9988
'20#.#0.241.139':9988
'20#.#0.44.214':9988
'20#.#0.124.96':9988
'20#.#0.0.232':9988
'20#.#0.247.3':9988
'20#.#0.75.249':9988
'20#.#0.73.77':9988
'20#.#0.110.124':139
'20#.#0.124.96':139
'20#.#0.32.163':139
'20#.#0.241.139':139
'20#.#0.93.104':139
'20#.60.38.3':139
'20#.#0.44.214':139
'20#.#0.123.141':139
'20#.#0.148.253':139
'20#.#0.211.70':139
'20#.#0.188.19':139
'20#.#0.89.50':139
'20#.#0.170.22':139
'20#.#0.57.86':139
'20#.#0.214.1':139
'20#.#0.2.170':139
'20#.#0.73.77':139
'20#.#0.39.19':139
'20#.#0.224.207':139
'20#.#0.119.253':139
'20#.#0.132.236':139
'20#.60.7.61':139
'20#.#0.183.27':139
'20#.#0.205.251':139
'20#.#0.0.232':139
'20#.#0.214.12':139
'20#.#0.72.179':139
'20#.#0.235.0':139
'20#.#0.177.44':139
'20#.#0.75.249':139
'20#.#0.247.3':139
'20#.#0.11.210':139
'20#.#0.132.236':445
'20#.60.7.61':445
'20#.#0.73.77':445
'20#.#0.39.19':445
'20#.#0.73.130':139
'20#.#0.147.143':139
'20#.#0.183.27':445
'20#.#0.154.121':139
'20#.#0.11.210':445
'20#.#0.177.44':445
'20#.#0.214.12':445
'20#.#0.247.3':445
'20#.#0.119.253':445
'20#.#0.205.251':445
'20#.#0.75.249':445
'20#.#0.224.207':445
'20#.#0.158.149':139
'20#.#0.150.80':139
'20#.#0.161.228':139
'20#.#0.31.222':139
'20#.#0.107.142':139
'20#.#0.176.27':139
'20#.#0.4.200':139
'20#.#0.167.43':139
'20#.#0.150.220':139
'20#.#0.220.120':139
'20#.#0.224.112':139
'20#.#0.75.158':139
'20#.#0.132.123':139
'20#.#0.139.159':139
'20#.#0.62.130':139
'20#.#0.203.208':139
'20#.#0.36.231':139
'20#.#0.184.30':139
'20#.#0.123.54':139
'20#.#0.55.37':139
'20#.#0.136.199':139
'20#.#0.15.61':139
'20#.#0.72.151':139
'20#.#0.30.85':139
'20#.#0.93.21':139
'20#.#0.159.112':139
'20#.#0.63.249':139
'20#.#0.190.228':139
'20#.#0.61.30':139
'20#.#0.161.36':139
'20#.#0.112.78':139
'20#.#0.78.61':139
'20#.#0.213.141':445
'20#.#0.245.226':445
'20#.#0.249.172':445
'20#.#0.173.105':445
'20#.#0.178.98':445
'20#.#0.224.137':445
'20#.#0.47.104':445
'20#.60.80.2':445
'20#.#0.178.27':139
'20#.#0.77.73':139
'20#.#0.14.67':139
'20#.#0.67.11':139
'20#.#0.243.101':139
'20#.60.16.3':445
'20#.#0.59.48':139
'20#.#0.95.190':139
'20#.#0.85.81':139
'20#.#0.146.158':139
'20#.#0.17.184':139
'20#.#0.169.5':139
'20#.#0.34.66':139
'20#.#0.48.120':139
'20#.#0.170.97':139
'20#.#0.97.34':139
'20#.#0.59.48':445
'20#.#0.77.73':445
'20#.#0.67.11':445
'20#.#0.95.190':445
'20#.#0.239.35':139
'20#.#0.200.213':139
'20#.#0.20.106':139
'20#.#0.95.217':139
'20#.#0.168.162':139
'20#.#0.162.227':139
'20#.#0.230.17':139
'20#.#0.45.125':139
'20#.#0.204.53':139
'20#.#0.4.252':139
'20#.#0.228.60':139
'20#.#0.61.107':139
'20#.#0.152.208':139
'20#.#0.21.227':139
'20#.#0.71.116':139
'20#.#0.222.189':139
'20#.#0.28.146':139
'20#.#0.172.238':139
'20#.#0.251.48':139
'20#.#0.63.28':139
'20#.#0.139.159':9988
'20#.#0.205.251':9988
'20#.#0.119.253':9988
'20#.#0.224.207':9988
'20#.#0.161.228':9988
'20#.#0.220.120':9988
'20#.#0.214.12':9988
'20#.#0.62.130':9988
'20#.#0.107.183':139
'20#.#0.4.217':139
'20#.#0.161.156':139
'20#.#0.110.236':139
'20#.#0.167.223':139
'20#.60.38.3':9988
'20#.#0.198.239':139
'20#.#0.239.128':139
'20#.#0.148.253':9988
'20#.#0.4.200':9988
'20#.#0.167.43':9988
'20#.#0.89.50':9988
'20#.#0.224.112':9988
'20#.#0.73.130':9988
'20#.#0.158.149':9988
'20#.#0.203.208':9988
'20#.#0.214.1':9988
'20#.#0.107.142':9988
'20#.#0.170.22':9988
'20#.#0.75.158':9988
'20#.60.7.61':9988
'20#.#0.211.70':9988
'20#.#0.176.27':9988
'20#.#0.57.86':9988
'20#.#0.107.183':445
'20#.#0.4.217':445
'20#.#0.161.156':445
'20#.#0.110.236':445
'20#.#0.167.223':445
'20#.60.16.3':139
'20#.#0.198.239':445
'20#.#0.239.128':445
'20#.#0.86.196':445
'20#.#0.168.16':445
'20#.#0.45.108':445
'20#.#0.79.79':445
'20#.#0.123.7':445
'20#.#0.7.178':445
'20#.#0.213.192':445
'20#.#0.22.163':445
'20#.#0.86.196':139
'20#.#0.168.16':139
'20#.#0.45.108':139
'20#.#0.79.79':139
'20#.#0.123.7':139
'20#.#0.7.178':139
'20#.#0.213.192':139
'20#.#0.22.163':139
'20#.#0.213.141':139
'20#.#0.245.226':139
'20#.#0.249.172':139
'20#.#0.173.105':139
'20#.#0.178.98':139
'20#.#0.224.137':139
'20#.#0.47.104':139
'20#.60.80.2':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней