Trojan.DownLoader10.2318

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER02dd.dir00\svchost.exe.mdmp 16325836412032476

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER02dd.dir00\svchost.exe.mdmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'19#.#49.115.62':445
'19#.#49.63.183':445
'19#.#49.229.229':445
'19#.#49.8.72':445
'19#.#49.64.232':445
'19#.#49.207.44':445
'19#.#49.57.100':445
'19#.#49.37.40':445
'19#.#49.90.171':445
'19#.#49.33.5':445
'19#.#49.225.99':445
'19#.#49.155.216':445
'19#.#49.118.191':445
'19#.#49.239.93':445
'19#.#49.193.6':445
'19#.#49.245.192':445
'19#.#49.138.40':445
'19#.#49.209.29':445
'19#.#49.93.214':445
'19#.#49.222.224':445
'19#.#49.167.245':445
'19#.#49.203.38':445
'19#.#49.21.41':445
'19#.#49.6.117':445
'19#.#49.117.21':445
'19#.#49.209.57':139
'19#.#49.189.122':139
'19#.#49.92.209':139
'19#.#49.196.20':139
'19#.#49.19.167':139
'19#.#49.33.224':139
'19#.#49.104.38':139
'19#.#49.250.229':445
'19#.#49.231.135':445
'19#.#49.71.50':139
'19#.#49.202.67':139
'19#.#49.16.85':139
'19#.#49.20.210':139
'19#.#49.16.112':139
'19#.#49.90.40':139
'19#.#49.216.252':139
'19#.#49.11.91':445
'19#.#49.250.229':139
'19#.#49.231.135':139
'19#.#49.94.209':139
'19#.#49.23.126':139
'19#.#49.45.188':139
'19#.#49.81.79':139
'19#.#49.96.162':139
'19#.#49.54.200':139
'19#.#49.142.106':445
'19#.#49.209.8':139
'19#.#49.142.106':139
'19#.#49.138.40':139
'19#.#49.253.89':445
'19#.#49.43.49':445
'19#.#49.197.95':139
'19#.#49.21.41':139
'19#.#49.222.224':139
'19#.#49.117.21':139
'19#.#49.209.29':139
'19#.#49.239.93':139
'19#.#49.93.214':139
'19#.#49.68.137':445
'19#.#49.4.41':445
'19#.#49.100.172':445
'19#.#49.73.183':445
'19#.#49.39.68':445
'19#.#49.94.160':445
'19#.#49.219.98':445
'19#.#49.103.21':445
'19#.#49.83.75':445
'19#.#49.123.69':445
'19#.#49.73.3':445
'19#.#49.72.139':445
'19#.#49.126.3':445
'19#.#49.93.152':139
'19#.#49.57.100':139
'19#.#49.37.40':139
'19#.#49.225.99':139
'19#.#49.13.106':139
'19#.#49.155.216':139
'19#.#49.93.152':445
'19#.#49.197.95':445
'19#.#49.209.8':445
'19#.#49.90.171':139
'19#.#49.13.106':445
'19#.#49.11.91':139
'19#.#49.33.5':139
'19#.#49.167.245':139
'19#.#49.203.38':139
'19#.#49.118.191':139
'19#.#49.193.6':139
'19#.#49.245.192':139
'19#.#49.6.117':139
'19#.#49.229.229':139
'19#.#49.63.183':139
'19#.#49.207.44':139
'19#.#49.8.72':139
'19#.#49.64.232':139
'19#.#49.115.62':139
'19#.#49.60.155':445
'19#.#49.226.42':445
'19#.#49.157.5':445
'19#.#49.62.132':445
'19#.#49.38.30':445
'19#.#49.193.137':445
'19#.#49.102.213':445
'19#.#49.201.109':445
'19#.#49.21.158':445
'19#.#49.245.225':445
'19#.#49.179.168':445
'19#.#49.44.138':445
'19#.#49.119.251':445
'19#.#49.40.197':445
'19#.#49.19.218':445
'19#.#49.211.6':445
'19#.#49.207.27':445
'19#.#49.129.207':445
'19#.#49.158.102':445
'19#.#49.66.12':445
'19#.#49.49.97':445
'19#.#49.63.99':445
'19#.#49.227.138':445
'19#.#49.35.36':445
'19#.#49.189.165':445
'19#.#49.28.156':139
'19#.#49.51.28':139
'19#.#49.98.251':139
'19#.#49.251.125':139
'19#.#49.222.197':139
'19#.#49.156.21':139
'19#.#49.6.13':139
'19#.#49.68.234':139
'19#.#49.152.33':139
'19#.#49.28.65':139
'19#.#49.12.236':139
'19#.#49.251.125':445
'19#.#49.134.73':139
'19#.#49.93.17':139
'19#.#49.200.26':139
'19#.#49.63.24':139
'19#.#49.216.221':445
'19#.#49.82.43':445
'19#.#49.94.250':139
'19#.#49.182.124':139
'19#.#49.98.118':139
'19#.#49.184.88':139
'19#.#49.231.229':445
'19#.#49.159.89':139
'19#.#49.57.160':139
'19#.#49.27.253':445
'19#.#49.71.50':445
'19#.#49.202.67':445
'19#.#49.16.85':445
'19#.#49.209.57':445
'19#.#49.189.122':445
'19#.#49.92.209':445
'19#.#49.207.27':139
'19#.#49.129.207':139
'19#.#49.158.102':139
'19#.#49.104.38':445
'19#.#49.87.254':139
'19#.#49.27.253':139
'19#.#49.33.224':445
'19#.#49.81.79':445
'19#.#49.96.162':445
'19#.#49.54.200':445
'19#.#49.16.112':445
'19#.#49.90.40':445
'19#.#49.216.252':445
'19#.#49.20.210':445
'19#.#49.196.20':445
'19#.#49.19.167':445
'19#.#49.94.209':445
'19#.#49.23.126':445
'19#.#49.45.188':445
'19#.#49.157.5':139
'19#.#49.44.138':139
'19#.#49.179.168':139
'19#.#49.60.155':139
'19#.#49.226.42':139
'19#.#49.245.225':139
'19#.#49.216.221':139
'19#.#49.82.43':139
'19#.#49.87.254':445
'19#.#49.102.213':139
'19#.#49.201.109':139
'19#.#49.21.158':139
'19#.#49.49.97':139
'19#.#49.227.138':139
'19#.#49.35.36':139
'19#.#49.189.165':139
'19#.#49.40.197':139
'19#.#49.19.218':139
'19#.#49.211.6':139
'19#.#49.62.132':139
'19#.#49.63.99':139
'19#.#49.119.251':139
'19#.#49.66.12':139
'19#.#49.193.137':139
'19#.#49.38.30':139
'19#.#49.61.177':445
'19#.#49.96.222':445
'19#.#49.4.152':445
'19#.#49.188.121':445
'19#.#49.64.206':445
'19#.#49.158.89':445
'19#.#49.228.160':445
'19#.#49.255.183':445
'19#.#49.233.10':445
'19#.#49.35.25':445
'19#.#49.82.226':445
'19#.#49.8.220':445
'19#.#49.27.1':445
'19#.#49.233.180':445
'19#.#49.31.154':445
'19#.#49.252.240':445
'19#.#49.107.252':445
'19#.#49.17.174':445
'19#.#49.232.84':445
'19#.#49.20.94':445
'19#.#49.96.252':445
'19#.#49.105.105':445
'19#.#49.181.105':445
'19#.#49.61.108':445
'19#.#49.194.154':445
'19#.#49.146.8':445
'19#.#49.194.204':445
'19#.#49.85.89':445
'19#.#49.222.40':445
'19#.#49.91.186':445
'19#.#49.219.167':445
'19#.#49.54.38':445
'19#.#49.152.152':445
'19#.#49.93.1':445
'19#.#49.155.17':445
'19#.#49.48.164':445
'19#.#49.155.211':445
'19#.#49.152.155':445
'19#.#49.51.25':445
'19#.#49.48.113':445
'19#.#49.79.242':445
'19#.#49.126.242':445
'19#.#49.178.18':445
'19#.#49.161.244':445
'19#.#49.111.182':445
'19#.#49.51.209':445
'19#.#49.185.214':445
'19#.#49.28.212':445
'19#.#49.150.88':445
'19#.#49.65.25':445
'19#.#49.208.139':445
'19#.#49.129.69':139
'19#.#49.96.222':139
'19#.#49.4.152':139
'19#.#49.188.121':139
'19#.#49.64.206':139
'19#.#49.158.89':139
'19#.#49.228.160':139
'19#.#49.255.183':139
'19#.#49.233.10':139
'19#.#49.35.25':139
'19#.#49.82.226':139
'19#.#49.8.220':139
'19#.#49.27.1':139
'19#.#49.233.180':139
'19#.#49.31.154':139
'19#.#49.252.240':139
'19#.#49.107.252':139
'19#.#49.17.174':139
'19#.#49.232.84':139
'19#.#49.20.94':139
'19#.#49.96.252':139
'19#.#49.105.105':139
'19#.#49.181.105':139
'19#.#49.61.108':139
'19#.#49.194.154':139
'19#.#49.146.8':139
'19#.#49.194.204':139
'19#.#49.85.89':139
'19#.#49.222.40':139
'19#.#49.91.186':139
'19#.#49.219.167':139
'19#.#49.54.38':139
'19#.#49.152.152':139
'19#.#49.93.1':139
'19#.#49.155.17':139
'19#.#49.48.164':139
'19#.#49.155.211':139
'19#.#49.152.155':139
'19#.#49.51.25':139
'19#.#49.48.113':139
'19#.#49.79.242':139
'19#.#49.126.242':139
'19#.#49.178.18':139
'19#.#49.161.244':139
'19#.#49.111.182':139
'19#.#49.51.209':139
'19#.#49.185.214':139
'19#.#49.28.212':139
'19#.#49.150.88':139
'19#.#49.65.25':139
'19#.#49.208.139':139
'19#.#49.212.215':445
'19#.#49.122.179':445
'19#.#49.153.64':445
'19#.#49.43.49':139
'19#.#49.253.89':139
'19#.#49.111.166':445
'19#.#49.2.110':445
'19#.#49.108.48':445
'19#.#49.221.96':445
'19#.249.4.0':445
'19#.#49.77.181':445
'19#.#49.137.80':445
'19#.#49.68.137':139
'19#.#49.100.172':139
'19#.#49.94.160':139
'19#.#49.73.3':139
'19#.#49.189.52':139
'19#.#49.219.98':139
'19#.#49.73.183':139
'19#.#49.103.21':139
'19#.#49.123.69':139
'19#.#49.72.139':139
'19#.#49.83.75':139
'19#.#49.205.246':139
'19#.#49.126.3':139
'19#.#49.176.42':445
'19#.#49.218.180':445
'19#.#49.72.238':445
'19#.#49.205.234':445
'19#.#49.205.196':445
'19#.#49.235.54':445
'19#.#49.255.170':445
'19#.#49.139.60':445
'19#.#49.189.52':445
'19#.#49.197.104':445
'19#.#49.170.172':445
'19#.#49.182.212':445
'19#.#49.4.159':445
'19#.#49.92.168':445
'19#.#49.102.200':445
'19#.#49.246.201':445
'19#.#49.159.111':445
'19#.#49.101.22':445
'19#.#49.135.159':445
'19#.#49.1.177':445
'19#.#49.40.6':445
'19#.#49.63.196':445
'19#.#49.169.71':445
'19#.#49.36.150':445
'19#.#49.53.191':445
'19#.#49.4.41':139
'19#.#49.212.215':139
'19#.249.4.0':139
'19#.#49.111.166':139
'19#.#49.153.64':139
'19#.#49.246.201':139
'19#.#49.122.179':139
'19#.#49.152.207':139
'19#.#49.77.181':139
'19#.#49.2.110':139
'19#.#49.101.22':139
'19#.#49.102.200':139
'19#.#49.137.80':139
'19#.#49.108.48':139
'19#.#49.61.108':9988
'19#.#49.232.84':9988
'19#.#49.4.152':9988
'19#.#49.129.69':445
'19#.#49.17.174':9988
'19#.#49.31.154':9988
'19#.#49.65.25':9988
'19#.#49.208.139':9988
'19#.#49.219.167':9988
'19#.#49.27.1':9988
'19#.#49.255.183':9988
'19#.#49.79.242':9988
'19#.#49.235.54':139
'19#.#49.205.234':139
'19#.#49.72.238':139
'19#.#49.63.196':139
'19#.#49.218.180':139
'19#.#49.4.159':139
'19#.#49.61.177':139
'19#.#49.39.68':139
'19#.#49.182.212':139
'19#.#49.139.60':139
'19#.#49.255.170':139
'19#.#49.170.172':139
'19#.#49.205.196':139
'19#.#49.71.135':139
'19#.#49.169.71':139
'19#.#49.92.168':139
'19#.#49.221.96':139
'19#.#49.159.111':139
'19#.#49.135.159':139
'19#.#49.176.42':139
'19#.#49.36.150':139
'19#.#49.197.104':139
'19#.#49.40.6':139
'19#.#49.53.191':139
'19#.#49.1.177':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней