Trojan.DownLoader10.160

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER1a93.dir00\svchost.exe.mdmp 16325836412032992

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%TEMP%\WER1a93.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
<SYSTEM32>\urdvxc.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'61.##3.139.21':139
'61.##3.137.149':139
'61.##3.218.46':139
'61.##3.184.38':139
'61.##3.113.9':139
'61.##3.205.186':139
'61.##3.13.25':139
'61.#23.33.1':139
'61.##3.67.86':139
'61.##3.20.18':139
'61.##3.21.14':139
'61.##3.43.129':139
'61.##3.109.83':139
'61.##3.219.161':139
'61.##3.124.21':139
'61.##3.227.172':139
'61.##3.47.115':139
'61.##3.37.110':139
'61.##3.37.77':139
'61.##3.65.181':139
'61.##3.21.127':139
'61.##3.171.200':139
'61.#23.90.5':139
'61.##3.170.120':139
'61.##3.88.119':139
'61.##3.161.86':139
'61.##3.109.144':139
'61.##3.10.32':139
'61.##3.181.82':139
'61.##3.63.101':139
'61.##3.86.234':139
'61.##3.21.32':139
'61.##3.106.238':139
'61.##3.78.62':139
'61.##3.12.90':139
'61.##3.242.69':445
'61.##3.124.21':445
'61.##3.10.32':445
'61.##3.184.38':445
'61.##3.137.149':445
'61.##3.43.129':445
'61.##3.221.164':445
'61.##3.219.161':445
'61.##3.47.115':445
'61.##3.170.120':445
'61.##3.109.144':445
'61.##3.218.46':445
'61.##3.21.14':445
'61.##3.67.86':445
'61.##3.63.101':445
'61.##3.211.14':445
'61.##3.78.62':445
'61.##3.141.210':445
'61.##3.71.91':445
'61.##3.198.155':445
'61.##3.67.160':445
'61.##3.165.116':445
'61.#23.18.0':445
'61.##3.134.126':445
'61.##3.71.22':445
'61.##3.60.91':445
'61.##3.169.13':445
'61.##3.89.245':445
'61.##3.167.185':445
'61.##3.180.22':445
'61.##3.23.205':445
'61.##3.226.58':445
'61.##3.122.111':445
'61.##3.15.138':445
'61.##3.35.247':445
'61.##3.100.56':445
'61.##3.182.56':139
'61.##3.164.227':139
'61.##3.55.194':139
'61.##3.178.51':139
'61.##3.51.37':139
'61.##3.158.153':139
'61.##3.89.245':139
'61.##3.221.164':139
'61.##3.48.229':139
'61.##3.197.177':139
'61.##3.71.91':139
'61.##3.53.152':139
'61.##3.33.79':139
'61.##3.167.185':139
'61.##3.81.206':139
'61.##3.29.198':139
'61.##3.173.146':139
'61.##3.122.111':139
'61.##3.164.209':139
'61.##3.75.159':445
'61.##3.209.75':139
'61.#23.18.0':139
'61.##3.71.22':139
'61.##3.51.71':139
'61.##3.3.168':445
'61.##3.75.237':139
'61.##3.47.56':139
'61.##3.165.116':139
'61.##3.162.197':139
'61.##3.59.145':445
'61.##3.15.138':139
'61.##3.172.89':139
'61.#23.14.6':139
'61.#23.35.3':139
'61.##3.35.247':139
'61.##3.164.130':139
'61.##3.152.143':139
'61.##3.29.198':445
'61.##3.51.37':445
'61.##3.53.152':445
'61.##3.197.177':445
'61.##3.164.130':445
'61.##3.164.209':445
'61.##3.48.229':445
'61.##3.164.227':445
'61.##3.81.206':445
'61.##3.0.226':139
'61.##3.152.143':445
'61.##3.141.210':139
'61.##3.211.14':139
'61.##3.173.146':445
'61.##3.33.79':445
'61.##3.193.156':139
'61.##3.55.194':445
'61.##3.162.197':445
'61.##3.168.132':445
'61.##3.180.22':139
'61.##3.209.75':445
'61.##3.131.161':445
'61.##3.23.205':139
'61.##3.109.152':139
'61.##3.226.58':139
'61.##3.100.56':139
'61.##3.181.154':445
'61.#23.14.6':445
'61.##3.178.51':445
'61.##3.172.89':445
'61.##3.158.153':445
'61.##3.75.237':445
'61.##3.51.71':445
'61.#23.35.3':445
'61.##3.224.142':445
'61.##3.13.25':445
'61.##3.103.214':445
'61.##3.25.18':445
'61.##3.155.133':445
'61.##3.194.86':445
'61.##3.140.228':445
'61.##3.48.188':445
'61.##3.64.133':445
'61.##3.187.215':445
'61.##3.218.200':445
'61.##3.61.149':445
'61.##3.123.106':445
'61.##3.209.118':445
'61.##3.194.171':445
'61.##3.74.128':445
'61.##3.214.51':445
'61.##3.27.195':445
'61.##3.158.215':445
'61.##3.123.91':445
'61.#23.33.1':445
'61.##3.227.172':445
'61.##3.193.156':445
'61.##3.21.32':445
'61.##3.171.200':445
'61.##3.12.90':445
'61.##3.161.86':445
'61.##3.65.181':445
'61.##3.86.234':445
'61.##3.120.203':445
'61.##3.25.190':445
'61.##3.175.29':445
'61.##3.29.89':445
'61.##3.37.160':445
'61.##3.20.18':445
'61.##3.132.31':445
'61.##3.166.148':445
'61.##3.195.188':445
'61.##3.90.248':445
'61.#23.55.9':445
'61.##3.23.61':445
'61.##3.44.36':445
'61.##3.139.112':445
'61.##3.115.2':445
'61.##3.231.68':445
'61.##3.165.71':445
'61.##3.157.6':445
'61.##3.222.105':445
'61.##3.227.173':445
'61.##3.156.222':139
'61.##3.118.146':445
'61.##3.163.90':445
'61.##3.25.53':445
'61.##3.149.222':445
'61.##3.58.209':445
'61.##3.114.132':445
'61.##3.90.181':445
'61.##3.110.94':445
'61.##3.101.5':445
'61.##3.70.61':445
'61.##3.140.202':445
'61.##3.193.44':445
'61.##3.158.240':445
'61.##3.216.64':445
'61.##3.58.185':445
'61.##3.80.23':445
'61.##3.2.214':445
'61.##3.221.244':445
'61.##3.43.41':445
'61.##3.139.122':445
'61.##3.126.2':445
'61.##3.18.197':445
'61.##3.229.35':445
'61.##3.106.238':445
'61.##3.140.228':139
'61.##3.2.214':139
'61.##3.43.41':139
'61.##3.227.173':139
'61.##3.158.215':139
'61.##3.74.128':139
'61.##3.194.171':139
'61.##3.18.197':139
'61.##3.141.240':139
'61.##3.178.225':139
'61.##3.80.23':139
'61.##3.23.61':139
'61.##3.149.222':139
'61.##3.48.188':139
'61.##3.115.2':139
'61.##3.61.149':139
'61.##3.221.244':139
'61.##3.64.133':139
'61.##3.194.86':139
'61.##3.58.209':139
'61.##3.229.35':139
'61.##3.25.18':139
'61.##3.205.186':445
'61.##3.113.9':445
'61.##3.187.215':139
'61.##3.88.119':445
'61.##3.197.84':139
'61.##3.37.160':139
'61.##3.29.89':139
'61.##3.27.195':139
'61.##3.214.51':139
'61.##3.218.200':139
'61.##3.155.133':139
'61.##3.123.106':139
'61.##3.175.29':139
'61.##3.103.214':139
'61.##3.120.203':139
'61.##3.101.5':139
'61.##3.157.6':139
'61.##3.126.2':139
'61.##3.70.61':139
'61.##3.90.181':139
'61.##3.132.31':139
'61.##3.58.185':139
'61.##3.25.53':139
'61.#23.90.5':445
'61.##3.44.36':139
'61.##3.21.127':445
'61.##3.37.77':445
'61.##3.110.94':139
'61.##3.163.90':139
'61.##3.222.105':139
'61.##3.139.122':139
'61.##3.231.68':139
'61.##3.199.14':139
'61.##3.165.71':139
'61.##3.195.188':139
'61.##3.209.118':139
'61.##3.123.91':139
'61.##3.114.132':139
'61.##3.80.24':139
'61.##3.193.44':139
'61.##3.216.64':139
'61.##3.118.146':139
'61.##3.166.148':139
'61.##3.158.240':139
'61.#23.55.9':139
'61.##3.139.112':139
'61.##3.140.202':139
'61.##3.25.190':139
'61.##3.90.248':139
'61.##3.59.101':445
'61.##3.70.98':445
'61.##3.48.138':445
'61.##3.226.110':445
'61.##3.107.12':445
'61.##3.101.178':445
'61.##3.105.8':445
'61.##3.113.11':445
'61.#23.1.4':445
'61.##3.43.63':9988
'61.##3.167.199':9988
'61.##3.148.153':9988
'61.##3.101.147':9988
'61.#23.2.77':445
'61.##3.55.219':445
'61.##3.99.36':9988
'61.##3.204.231':445
'61.##3.104.166':445
'61.##3.26.90':445
'61.##3.104.124':445
'61.##3.195.139':445
'61.##3.167.199':445
'61.##3.198.26':445
'61.#23.9.2':445
'61.##3.69.144':445
'61.##3.234.236':445
'61.##3.30.222':445
'61.##3.43.63':445
'61.##3.148.153':445
'61.##3.228.151':445
'61.##3.126.104':445
'61.##3.87.168':445
'61.#23.99.8':445
'61.##3.154.248':445
'61.##3.200.66':445
'61.##3.77.126':9988
'61.##3.179.20':9988
'61.##3.104.115':9988
'61.##3.69.144':9988
'61.##3.20.237':9988
'61.#23.1.4':9988
'61.#23.9.2':9988
'61.##3.30.222':9988
'61.##3.163.195':9988
'61.##3.126.104':9988
'61.##3.48.138':9988
'61.##3.26.90':9988
'61.#23.2.77':9988
'61.##3.234.236':9988
'61.##3.86.57':9988
'61.##3.55.219':9988
'61.##3.240.231':9988
'61.##3.87.168':9988
'61.#23.99.8':9988
'61.##3.104.166':9988
'61.##3.200.66':9988
'61.##3.101.178':9988
'61.##3.154.248':9988
'61.##3.59.101':9988
'61.##3.228.151':9988
'61.##3.104.124':9988
'61.##3.89.31':9988
'61.##3.198.26':9988
'61.##3.23.96':9988
'61.##3.187.162':9988
'61.##3.168.214':9988
'61.##3.105.8':9988
'61.##3.129.47':9988
'61.##3.212.200':9988
'61.##3.107.12':9988
'61.##3.147.69':9988
'61.##3.86.57':445
'61.#23.99.8':139
'61.##3.69.144':139
'61.##3.179.20':139
'61.#23.9.2':139
'61.##3.26.90':139
'61.##3.120.204':139
'61.##3.23.96':139
'61.##3.234.236':139
'61.##3.30.222':139
'61.##3.43.63':139
'61.##3.110.39':139
'61.##3.200.66':139
'61.##3.87.168':139
'61.##3.195.139':139
'61.##3.129.47':139
'61.##3.154.248':139
'61.##3.167.199':139
'61.##3.198.26':139
'61.##3.104.115':139
'61.##3.104.124':139
'61.##3.212.200':139
'61.##3.163.195':139
'61.##3.99.36':139
'61.##3.144.14':139
'61.##3.147.69':139
'61.##3.101.147':139
'61.#23.9.76':139
'61.##3.89.31':139
'61.##3.237.87':139
'61.##3.20.237':139
'61.##3.86.57':139
'61.##3.168.214':139
'61.##3.77.126':139
'61.##3.240.231':139
'61.##3.187.162':139
'61.##3.148.153':139
'61.##3.104.115':445
'61.##3.168.214':445
'61.##3.77.126':445
'61.##3.237.87':445
'61.##3.99.36':445
'61.##3.89.31':445
'61.#23.9.76':445
'61.##3.129.47':445
'61.##3.20.237':445
'61.##3.240.231':445
'61.##3.179.20':445
'61.##3.110.39':445
'61.##3.101.147':445
'61.##3.120.204':445
'61.##3.212.200':445
'61.##3.23.96':445
'61.##3.187.162':445
'61.##3.163.195':445
'61.##3.105.8':139
'61.##3.113.11':139
'61.##3.107.12':139
'61.##3.101.178':139
'61.##3.126.104':139
'61.##3.104.166':139
'61.##3.59.101':139
'61.##3.228.151':139
'61.##3.70.98':139
'61.##3.48.138':139
'61.##3.55.219':139
'61.##3.147.69':445
'61.##3.144.14':445
'61.##3.226.110':139
'61.#23.2.77':139
'61.#23.1.4':139
'61.##3.204.231':139
'61.##3.195.139':9988
'61.#23.8.32':445
'61.##3.125.27':445
'61.##3.122.205':445
'61.##3.40.195':445
'61.##3.81.254':445
'61.##3.30.191':445
'61.##3.198.204':445
'61.##3.42.152':445
'61.##3.0.239':445
'61.##3.88.184':445
'61.##3.134.188':445
'61.##3.137.81':445
'61.##3.228.229':445
'61.##3.159.137':445
'61.##3.0.160':445
'61.##3.251.211':445
'61.##3.250.183':445
'61.##3.43.178':445
'61.##3.150.81':445
'61.##3.101.252':445
'61.##3.151.198':445
'61.##3.180.130':445
'61.##3.69.24':445
'61.##3.107.196':445
'61.##3.52.180':445
'61.##3.82.52':445
'61.##3.52.185':445
'61.##3.155.174':445
'61.##3.145.252':445
'61.##3.254.95':445
'61.#23.33.6':445
'61.##3.77.39':445
'61.##3.14.101':445
'61.##3.225.30':445
'61.##3.177.218':445
'61.##3.57.214':445
'61.##3.180.148':445
'61.##3.59.145':139
'61.##3.181.154':139
'61.##3.168.132':139
'61.##3.47.78':445
'61.##3.24.90':445
'61.##3.3.168':139
'61.##3.180.148':139
'61.##3.75.159':139
'61.##3.169.13':139
'61.##3.134.126':139
'61.##3.198.155':139
'61.##3.224.142':139
'61.##3.67.160':139
'61.##3.242.69':139
'61.##3.60.91':139
'61.##3.131.161':139
'61.##3.47.243':445
'61.##3.164.28':445
'61.##3.117.107':445
'61.##3.154.115':445
'61.##3.104.47':445
'61.##3.43.143':445
'61.##3.205.221':445
'61.##3.174.156':445
'61.##3.38.122':445
'61.##3.61.82':445
'61.##3.240.43':445
'61.##3.139.108':445
'61.##3.110.161':445
'61.##3.62.51':445
'61.##3.72.180':445
'61.##3.162.15':445
'61.##3.124.209':445
'61.##3.31.216':445
'61.##3.153.38':445
'61.##3.30.191':139
'61.##3.153.38':139
'61.##3.137.81':139
'61.##3.107.196':139
'61.##3.192.20':139
'61.##3.180.130':139
'61.##3.228.229':139
'61.##3.254.95':139
'61.##3.43.178':139
'61.##3.251.211':139
'61.##3.52.185':139
'61.##3.125.27':139
'61.##3.205.221':139
'61.##3.151.198':139
'61.##3.146.238':139
'61.#23.33.6':139
'61.##3.225.30':139
'61.##3.42.152':139
'61.##3.110.39':9988
'61.##3.204.231':9988
'61.##3.144.14':9988
'61.##3.226.110':9988
'61.#23.9.76':9988
'61.##3.70.98':9988
'61.##3.113.11':9988
'61.##3.237.87':9988
'61.##3.120.204':9988
'61.##3.32.33':139
'61.##3.150.81':139
'61.##3.81.254':139
'61.##3.61.82':139
'61.##3.69.24':139
'61.##3.52.180':139
'61.##3.101.252':139
'61.##3.82.52':139
'61.##3.154.105':139
'61.##3.47.243':139
'61.#23.8.32':139
'61.##3.40.195':139
'61.##3.139.108':139
'61.##3.162.15':139
'61.##3.250.183':139
'61.##3.124.209':139
'61.##3.159.137':139
'61.##3.110.161':139
'61.##3.0.160':139
'61.##3.0.239':139
'61.##3.192.20':445
'61.##3.24.90':139
'61.##3.62.51':139
'61.##3.47.78':139
'61.##3.122.205':139
'61.##3.240.43':139
'61.##3.38.122':139
'61.##3.57.214':139
'61.##3.14.101':139
'61.##3.77.39':139
'61.##3.177.218':139
'61.##3.164.28':139
'61.##3.104.47':139
'61.##3.72.180':139
'61.##3.31.216':139
'61.##3.43.143':139
'61.##3.154.115':139
'61.##3.155.174':139
'61.##3.198.204':139
'61.##3.174.156':139
'61.##3.117.107':139
'61.##3.88.184':139
'61.##3.134.188':139
'61.##3.145.252':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней