Trojan.DownLoader9.60722

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Startup' = '%APPDATA%\Program Files\vdllhost.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\Program Files\dllhost.exe' /pid=6128
'%APPDATA%\Program Files\dllhost.exe' /pid=6048
'%APPDATA%\Program Files\dllhost.exe' /pid=196
'%APPDATA%\Program Files\dllhost.exe' /pid=5748
'%APPDATA%\Program Files\dllhost.exe' /pid=3320
'%APPDATA%\Program Files\dllhost.exe' /pid=396
'%APPDATA%\Program Files\dllhost.exe' /pid=4936
'%APPDATA%\Program Files\dllhost.exe' /pid=4412
'%APPDATA%\Program Files\dllhost.exe' /pid=4148
'%APPDATA%\Program Files\dllhost.exe' /pid=3180
'%APPDATA%\Program Files\dllhost.exe' /pid=3712
'%APPDATA%\Program Files\dllhost.exe' /pid=2616
'%APPDATA%\Program Files\dllhost.exe' /pid=3380
'%APPDATA%\Program Files\dllhost.exe' /pid=6096
'%APPDATA%\Program Files\dllhost.exe' /pid=5736
'%APPDATA%\Program Files\dllhost.exe' /pid=5348
'%APPDATA%\Program Files\dllhost.exe' /pid=6036
'%APPDATA%\Program Files\dllhost.exe' /pid=4592
'%APPDATA%\Program Files\dllhost.exe' /pid=5416
'%APPDATA%\Program Files\dllhost.exe' /pid=3684
'%APPDATA%\Program Files\dllhost.exe' /pid=2344
'%APPDATA%\Program Files\dllhost.exe' /pid=2536
'%APPDATA%\Program Files\dllhost.exe' /pid=4108
'%APPDATA%\Program Files\dllhost.exe' /pid=4808
'%APPDATA%\Program Files\dllhost.exe' /pid=5428
'%APPDATA%\Program Files\dllhost.exe' /pid=2352
'%APPDATA%\Program Files\dllhost.exe' /pid=4228
'%APPDATA%\Program Files\dllhost.exe' /pid=5396
'%APPDATA%\Program Files\dllhost.exe' /pid=4320
'%APPDATA%\Program Files\dllhost.exe' /pid=5196
'%APPDATA%\Program Files\dllhost.exe' /pid=3300
'%APPDATA%\Program Files\dllhost.exe' /pid=4608
'%APPDATA%\Program Files\dllhost.exe' /pid=5716
'%APPDATA%\Program Files\dllhost.exe' /pid=5596
'%APPDATA%\Program Files\dllhost.exe' /pid=4828
'%APPDATA%\Program Files\dllhost.exe' /pid=5616
'%APPDATA%\Program Files\dllhost.exe' /pid=5516
'%APPDATA%\Program Files\dllhost.exe' /pid=3704
'%APPDATA%\Program Files\dllhost.exe' /pid=3604
'%APPDATA%\Program Files\dllhost.exe' /pid=4424
'%APPDATA%\Program Files\dllhost.exe' /pid=4628
'%APPDATA%\Program Files\dllhost.exe' /pid=3248
'%APPDATA%\Program Files\dllhost.exe' /pid=4220
'%APPDATA%\Program Files\dllhost.exe' /pid=4532
'%APPDATA%\Program Files\dllhost.exe' /pid=3288
'%APPDATA%\Program Files\dllhost.exe' /pid=4128
'%APPDATA%\Program Files\dllhost.exe' -a sha256 -o http://1L###############Z19wvQLLDKZP2tAiR:x@getwork.mining.eligius.st :8337 -T 83 -l yes -t 1
'%APPDATA%\Program Files\dllhost.exe' /pid=5688
'%APPDATA%\Program Files\dllhost.exe' /pid=5316
'%APPDATA%\Program Files\dllhost.exe' /pid=4916
'%APPDATA%\Program Files\dllhost.exe' /pid=5336
'%APPDATA%\Program Files\dllhost.exe' /pid=4512
'%APPDATA%\Program Files\dllhost.exe' /pid=3672
'%APPDATA%\Program Files\dllhost.exe' /pid=3188
'%APPDATA%\Program Files\dllhost.exe' /pid=4604
'%APPDATA%\Program Files\dllhost.exe' /pid=4836
'%APPDATA%\Program Files\dllhost.exe' /pid=3624
'%APPDATA%\Program Files\dllhost.exe' /pid=3200
'%APPDATA%\Program Files\dllhost.exe' /pid=5636
'%APPDATA%\Program Files\dllhost.exe' /pid=4616
'%APPDATA%\Program Files\dllhost.exe' /pid=4452
'%APPDATA%\Program Files\dllhost.exe' /pid=5208
'%APPDATA%\Program Files\dllhost.exe' /pid=5868
'%APPDATA%\Program Files\dllhost.exe' /pid=3964
'%APPDATA%\Program Files\dllhost.exe' /pid=5608
'%APPDATA%\Program Files\dllhost.exe' /pid=5848
'%APPDATA%\Program Files\dllhost.exe' /pid=3852
'%APPDATA%\Program Files\dllhost.exe' /pid=5588
'%APPDATA%\Program Files\dllhost.exe' /pid=5668
'%APPDATA%\Program Files\dllhost.exe' (загружен из сети Интернет)