Trojan.Inject5.59450

Техническая информация

Вредоносные функции

Внедряет код в

следующие системные процессы:

<SYSTEM32>\hwrreg.exe

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\windowsshell680533.log
%WINDIR%\windowssystemupdate11.log

Самоудаляется.

Сетевая активность

Подключается к

'47.#8.35.46':36281
'<LOCALNET>..40.1':51420
'<LOCALNET>..40.3':51420
'<LOCALNET>..40.5':51420
'<LOCALNET>..40.0':51420
'<LOCALNET>..40.7':51420
'<LOCALNET>..40.9':51420
'<LOCALNET>..40.11':51420
'<LOCALNET>..40.15':51420
'<LOCALNET>..40.13':51420
'<LOCALNET>..40.17':51420
'<LOCALNET>..40.2':51420
'<LOCALNET>..40.4':51420
'<LOCALNET>..40.6':51420
'<LOCALNET>..40.45':51420
'<LOCALNET>..40.49':51420
'<LOCALNET>..40.8':51420
'<LOCALNET>..40.51':51420
'<LOCALNET>..40.12':51420
'<LOCALNET>..40.53':51420
'<LOCALNET>..40.14':51420
'<LOCALNET>..40.47':51420
'<LOCALNET>..40.16':51420
'<LOCALNET>..40.26':51420
'<LOCALNET>..40.28':51420
'<LOCALNET>..40.32':51420
'<LOCALNET>..40.30':51420
'<LOCALNET>..40.36':51420
'<LOCALNET>..40.34':51420
'<LOCALNET>..40.38':51420
'<LOCALNET>..40.22':51420
'<LOCALNET>..40.20':51420
'<LOCALNET>..40.18':51420
'<LOCALNET>..40.24':51420
'<LOCALNET>..40.10':51420
'<LOCALNET>..40.19':51420
'<LOCALNET>..40.21':51420
'<LOCALNET>..40.23':51420
'<LOCALNET>..40.29':51420
'<LOCALNET>..40.27':51420
'<LOCALNET>..40.42':51420
'<LOCALNET>..40.35':51420
'<LOCALNET>..40.44':51420
'<LOCALNET>..40.33':51420
'<LOCALNET>..40.31':51420
'<LOCALNET>..40.40':51420
'<LOCALNET>..40.39':51420
'<LOCALNET>..40.37':51420
'<LOCALNET>..40.41':51420
'<LOCALNET>..40.43':51420
'<LOCALNET>..40.46':51420
'<LOCALNET>..40.25':51420
'<LOCALNET>..40.48':51420
'<LOCALNET>..40.54':51420
'<LOCALNET>..40.56':51420
'<LOCALNET>..40.58':51420
'<LOCALNET>..40.60':51420
'<LOCALNET>..40.62':51420
'<LOCALNET>..40.52':51420
'<LOCALNET>..40.57':51420
'<LOCALNET>..40.64':51420
'<LOCALNET>..40.59':51420
'<LOCALNET>..40.61':51420
'<LOCALNET>..40.65':51420
'<LOCALNET>..40.67':51420
'<LOCALNET>..40.55':51420
'<LOCALNET>..40.66':51420
'<LOCALNET>..40.68':51420
'<LOCALNET>..40.70':51420
'<LOCALNET>..40.50':51420
'<LOCALNET>..40.74':51420
'<LOCALNET>..40.72':51420
'<LOCALNET>..40.76':51420
'<LOCALNET>..40.78':51420
'<LOCALNET>..40.80':51420
'<LOCALNET>..40.63':51420
'<LOCALNET>..40.69':51420
'<LOCALNET>..40.82':51420
'<LOCALNET>..40.84':51420
'<LOCALNET>..40.88':51420
'<LOCALNET>..40.90':51420
'<LOCALNET>..40.92':51420
'<LOCALNET>..40.94':51420
'<LOCALNET>..40.96':51420
'<LOCALNET>..40.98':51420
'<LOCALNET>..40.100':51420
'<LOCALNET>..40.102':51420
'<LOCALNET>..40.104':51420
'<LOCALNET>..40.106':51420
'<LOCALNET>..40.108':51420
'<LOCALNET>..40.110':51420
'<LOCALNET>..40.112':51420
'<LOCALNET>..40.114':51420
'<LOCALNET>..40.122':51420
'<LOCALNET>..40.116':51420
'<LOCALNET>..40.128':51420
'<LOCALNET>..40.130':51420
'<LOCALNET>..40.132':51420
'<LOCALNET>..40.134':51420
'<LOCALNET>..40.136':51420
'<LOCALNET>..40.138':51420
'<LOCALNET>..40.77':51420
'<LOCALNET>..40.140':51420
'<LOCALNET>..40.142':51420
'<LOCALNET>..40.144':51420
'<LOCALNET>..40.146':51420
'<LOCALNET>..40.148':51420
'<LOCALNET>..40.150':51420
'<LOCALNET>..40.154':51420
'<LOCALNET>..40.156':51420
'<LOCALNET>..40.158':51420
'<LOCALNET>..40.160':51420
'<LOCALNET>..40.162':51420
'<LOCALNET>..40.166':51420
'<LOCALNET>..40.168':51420
'<LOCALNET>..40.172':51420
'<LOCALNET>..40.176':51420
'<LOCALNET>..40.178':51420
'<LOCALNET>..40.86':51420
'<LOCALNET>..40.75':51420
'<LOCALNET>..40.118':51420
'<LOCALNET>..40.120':51420
'<LOCALNET>..40.124':51420
'<LOCALNET>..40.164':51420
'<LOCALNET>..40.174':51420
'<LOCALNET>..40.180':51420
'<LOCALNET>..40.182':51420
'<LOCALNET>..40.184':51420
'<LOCALNET>..40.186':51420
'<LOCALNET>..40.188':51420
'<LOCALNET>..40.190':51420
'<LOCALNET>..40.192':51420
'<LOCALNET>..40.194':51420
'<LOCALNET>..40.196':51420
'<LOCALNET>..40.198':51420
'<LOCALNET>..40.126':51420
'<LOCALNET>..40.152':51420
'<LOCALNET>..40.170':51420
'<LOCALNET>..40.73':51420
'<LOCALNET>..40.71':51420
'<LOCALNET>..40.81':51420
'<LOCALNET>..40.79':51420
'<LOCALNET>..40.83':51420
'<LOCALNET>..40.85':51420
'<LOCALNET>..40.87':51420
'<LOCALNET>..40.105':51420
'<LOCALNET>..40.107':51420
'<LOCALNET>..40.109':51420
'<LOCALNET>..40.89':51420
'<LOCALNET>..40.93':51420
'<LOCALNET>..40.97':51420
'<LOCALNET>..40.99':51420
'<LOCALNET>..40.95':51420
'<LOCALNET>..40.115':51420
'<LOCALNET>..40.101':51420
'<LOCALNET>..40.91':51420
'<LOCALNET>..40.113':51420
'<LOCALNET>..40.111':51420
'<LOCALNET>..40.117':51420
'<LOCALNET>..40.103':51420
'<LOCALNET>..40.121':51420
'<LOCALNET>..40.123':51420
'<LOCALNET>..40.125':51420
'<LOCALNET>..40.127':51420
'<LOCALNET>..40.133':51420
'<LOCALNET>..40.119':51420
'<LOCALNET>..40.129':51420
'<LOCALNET>..40.135':51420
'<LOCALNET>..40.131':51420
'<LOCALNET>..40.139':51420
'<LOCALNET>..40.141':51420
'<LOCALNET>..40.143':51420
'<LOCALNET>..40.147':51420
'<LOCALNET>..40.145':51420
'<LOCALNET>..40.149':51420
'<LOCALNET>..40.151':51420
'<LOCALNET>..40.153':51420
'<LOCALNET>..40.137':51420
'<LOCALNET>..40.155':51420
'<LOCALNET>..40.157':51420
'<LOCALNET>..40.159':51420
'<LOCALNET>..40.161':51420
'<LOCALNET>..40.165':51420
'<LOCALNET>..40.167':51420
'<LOCALNET>..40.171':51420
'<LOCALNET>..40.169':51420
'<LOCALNET>..40.175':51420
'<LOCALNET>..40.173':51420
'<LOCALNET>..40.177':51420
'<LOCALNET>..40.181':51420
'<LOCALNET>..40.179':51420
'<LOCALNET>..40.187':51420
'<LOCALNET>..40.183':51420
'<LOCALNET>..40.189':51420
'<LOCALNET>..40.191':51420
'<LOCALNET>..40.193':51420
'<LOCALNET>..40.195':51420
'<LOCALNET>..40.197':51420
'<LOCALNET>..40.163':51420
'<LOCALNET>..40.199':51420
'<LOCALNET>..40.185':51420
'43.##9.192.68':46283
'47.##.113.58':46282

TCP

Другие

'47.#8.35.46':36281
'47.##.113.58':46282

UDP

'255.255.255.255':37194

Другое

Запускает на исполнение

'<SYSTEM32>\hwrreg.exe'
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\hwrreg.exe"
'<SYSTEM32>\cmd.exe' /c del <Полный путь к файлу> >> NUL (со скрытым окном)