Trojan.Starman.5238

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER7e6b.dir00\svchost.exe.mdmp 16325836412032104

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER7e6b.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'19#.#31.186.125':139
'19#.#31.49.186':139
'19#.#31.5.132':139
'19#.#31.112.147':139
'19#.#31.218.57':139
'19#.#31.144.164':139
'19#.#31.140.19':139
'19#.#31.133.116':139
'19#.#31.42.236':139
'19#.#31.73.101':139
'19#.#31.235.2':139
'19#.#31.54.229':445
'19#.#31.158.123':445
'19#.#31.12.155':445
'19#.#31.27.26':445
'19#.#31.117.161':445
'19#.#31.165.124':139
'19#.#31.185.168':139
'19#.#31.220.57':139
'19#.#31.3.239':139
'19#.#31.248.6':139
'19#.#31.186.125':445
'19#.#31.49.186':445
'19#.#31.5.132':445
'19#.#31.112.147':445
'19#.#31.218.57':445
'19#.#31.144.164':445
'19#.#31.140.19':445
'19#.#31.133.116':445
'19#.#31.42.236':445
'19#.#31.73.101':445
'19#.#31.235.2':445
'19#.#31.63.117':139
'19#.#31.156.180':139
'19#.#31.33.20':139
'19#.#31.127.123':139
'19#.#31.166.189':139
'19#.#31.165.124':445
'19#.#31.185.168':445
'19#.#31.220.57':445
'19#.#31.3.239':445
'19#.#31.248.6':445
'19#.#31.19.92':445
'19#.#31.117.161':139
'19#.#31.12.155':139
'19#.#31.27.26':139
'19#.#31.22.83':139
'19#.#31.19.92':139
'19#.#31.63.84':445
'19#.#31.169.205':445
'19#.#31.84.244':445
'19#.#31.54.229':139
'19#.#31.158.123':139
'19#.#31.56.120':139
'19#.#31.6.90':139
'19#.#31.185.130':139
'19#.#31.37.223':139
'19#.#31.157.56':139
'19#.#31.87.235':139
'19#.#31.7.174':139
'19#.#31.63.197':139
'19#.#31.214.240':139
'19#.#31.106.10':139
'19#.#31.129.105':139
'19#.#31.106.10':445
'19#.#31.129.105':445
'19#.#31.185.130':445
'19#.#31.37.223':445
'19#.#31.6.90':445
'19#.#31.56.120':445
'19#.#31.22.83':445
'19#.#31.63.197':445
'19#.#31.214.240':445
'19#.#31.7.174':445
'19#.#31.87.235':445
'19#.#31.7.162':445
'19#.#31.169.136':445
'19#.#31.249.241':445
'19#.#31.56.104':445
'19#.#31.87.46':445
'19#.#31.38.15':445
'19#.#31.157.56':445
'19#.#31.118.209':445
'19#.#31.10.148':445
'19#.#31.209.148':445
'19#.#31.127.123':445
'19#.#31.191.100':445
'19#.#31.1.193':445
'19#.#31.89.188':445
'19#.#31.235.129':445
'19#.#31.91.62':445
'19#.#31.202.215':445
'19#.#31.129.217':445
'19#.#31.77.67':445
'19#.#31.35.78':445
'19#.#31.17.173':445
'19#.#31.213.117':445
'19#.#31.249.147':445
'19#.#31.24.249':445
'19#.#31.148.16':445
'19#.#31.174.163':445
'19#.#31.16.175':445
'19#.#31.114.86':445
'19#.#31.225.158':445
'19#.#31.77.217':445
'19#.#31.82.134':445
'19#.#31.15.141':445
'19#.#31.61.0':139
'19#.#31.140.14':139
'19#.#31.150.242':139
'19#.#31.130.237':139
'19#.#31.104.196':139
'19#.#31.34.140':139
'19#.#31.206.110':139
'19#.#31.80.90':139
'19#.#31.223.250':139
'19#.#31.58.134':139
'19#.#31.237.126':139
'19#.#31.197.160':139
'19#.#31.75.3':139
'19#.#31.59.104':139
'19#.#31.63.211':139
'19#.#31.51.69':139
'19#.#31.154.132':139
'19#.#31.65.73':139
'19#.#31.31.59':139
'19#.#31.26.104':139
'19#.#31.180.26':139
'19#.#31.163.159':445
'19#.#31.16.175':139
'19#.#31.148.16':139
'19#.#31.174.163':139
'19#.#31.160.125':139
'19#.#31.163.159':139
'19#.#31.15.141':139
'19#.#31.77.217':139
'19#.#31.82.134':139
'19#.#31.249.147':139
'19#.#31.24.249':139
'19#.#31.19.253':139
'19#.#31.156.180':445
'19#.#31.173.94':139
'19#.#31.63.117':445
'19#.#31.166.189':445
'19#.#31.33.20':445
'19#.#31.128.129':139
'19#.#31.62.61':139
'19#.#31.119.54':139
'19#.#31.47.250':139
'19#.#31.105.102':139
'19#.#31.47.250':445
'19#.#31.105.102':445
'19#.#31.173.94':445
'19#.#31.202.215':139
'19#.#31.129.217':139
'19#.#31.19.253':445
'19#.#31.160.125':445
'19#.#31.62.61':445
'19#.#31.119.54':445
'19#.#31.128.129':445
'19#.#31.77.67':139
'19#.#31.235.129':139
'19#.#31.91.62':139
'19#.#31.213.117':139
'19#.#31.114.86':139
'19#.#31.225.158':139
'19#.#31.35.78':139
'19#.#31.17.173':139
'19#.#31.1.193':139
'19#.#31.89.188':139
'19#.#31.191.100':139
'19#.#31.32.178':445
'19#.#31.68.149':445
'19#.#31.74.192':445
'19#.#31.46.231':445
'19#.#31.158.114':445
'19#.#31.90.11':445
'19#.#31.85.61':445
'19#.#31.115.142':445
'19#.#31.221.84':445
'19#.#31.64.33':445
'19#.#31.69.167':445
'19#.#31.32.26':139
'19#.#31.52.46':139
'19#.#31.62.38':139
'19#.#31.55.166':139
'19#.#31.113.90':139
'19#.#31.44.178':445
'19#.#31.113.252':445
'19#.#31.232.184':139
'19#.#31.182.52':139
'19#.#31.41.182':139
'19#.#31.7.128':445
'19#.#31.137.194':445
'19#.#31.175.160':445
'19#.#31.2.115':445
'19#.#31.50.165':445
'19#.#31.223.98':445
'19#.#31.251.195':445
'19#.#31.52.4':445
'19#.#31.123.159':445
'19#.#31.4.12':445
'19#.#31.214.222':445
'19#.#31.157.185':445
'19#.#31.145.196':445
'19#.#31.22.39':445
'19#.#31.61.198':445
'19#.#31.95.129':445
'19#.#31.114.117':445
'19#.#31.15.3':445
'19#.#31.202.75':445
'19#.#31.210.160':445
'19#.#31.108.180':445
'19#.#31.165.227':139
'19#.#31.95.129':139
'19#.#31.22.39':139
'19#.#31.61.198':139
'19#.#31.90.11':139
'19#.#31.85.61':139
'19#.#31.108.180':139
'19#.#31.202.75':139
'19#.#31.210.160':139
'19#.#31.157.185':139
'19#.#31.145.196':139
'19#.#31.115.142':139
'19#.#31.69.167':139
'19#.#31.46.231':139
'19#.#31.44.178':139
'19#.#31.158.114':139
'19#.#31.113.252':139
'19#.#31.221.84':139
'19#.#31.64.33':139
'19#.#31.68.149':139
'19#.#31.74.192':139
'19#.#31.32.178':139
'19#.#31.121.101':139
'19#.#31.140.120':139
'19#.#31.93.40':139
'19#.#31.223.98':139
'19#.#31.251.195':139
'19#.#31.63.42':139
'19#.#31.226.192':139
'19#.#31.167.154':139
'19#.#31.1.92':139
'19#.#31.10.126':139
'19#.#31.52.4':139
'19#.#31.2.115':139
'19#.#31.50.165':139
'19#.#31.214.222':139
'19#.#31.114.117':139
'19#.#31.15.3':139
'19#.#31.123.159':139
'19#.#31.4.12':139
'19#.#31.7.128':139
'19#.#31.175.160':139
'19#.#31.137.194':139
'19#.#31.93.40':445
'19#.#31.25.122':445
'19#.#31.243.151':445
'19#.#31.164.159':445
'19#.#31.71.237':445
'19#.#31.139.98':445
'19#.#31.49.41':445
'19#.#31.191.254':445
'19#.#31.15.213':445
'19#.#31.195.233':445
'19#.#31.42.243':445
'19#.#31.19.128':445
'19#.#31.80.188':139
'19#.#31.196.200':139
'19#.#31.30.91':139
'19#.#31.100.122':139
'19#.#31.30.156':139
'19#.#31.72.3':139
'19#.#31.120.108':445
'19#.#31.160.196':139
'19#.#31.17.197':139
'19#.#31.93.17':139
'19#.#31.249.241':139
'19#.#31.7.162':139
'19#.#31.87.46':139
'19#.#31.169.205':139
'19#.#31.56.104':139
'19#.#31.118.209':139
'19#.#31.38.15':139
'19#.#31.209.148':139
'19#.#31.169.136':139
'19#.#31.10.148':139
'19#.#31.63.84':139
'19#.#31.80.188':445
'19#.#31.196.200':445
'19#.#31.30.91':445
'19#.#31.100.122':445
'19#.#31.30.156':445
'19#.#31.72.3':445
'19#.#31.84.244':139
'19#.#31.160.196':445
'19#.#31.17.197':445
'19#.#31.93.17':445
'19#.#31.191.254':139
'19#.#31.41.182':445
'19#.#31.232.184':445
'19#.#31.182.52':445
'19#.#31.32.26':445
'19#.#31.52.46':445
'19#.#31.74.192':9988
'19#.#31.64.33':9988
'19#.#31.32.178':9988
'19#.#31.44.178':9988
'19#.#31.113.252':9988
'19#.#31.62.38':445
'19#.#31.10.126':445
'19#.#31.167.154':445
'19#.#31.1.92':445
'19#.#31.121.101':445
'19#.#31.140.120':445
'19#.#31.55.166':445
'19#.#31.113.90':445
'19#.#31.165.227':445
'19#.#31.63.42':445
'19#.#31.226.192':445
'19#.#31.164.159':139
'19#.#31.25.122':139
'19#.#31.139.98':139
'19#.#31.19.128':139
'19#.#31.71.237':139
'19#.#31.15.213':139
'19#.#31.49.41':139
'19#.#31.42.243':139
'19#.#31.243.151':139
'19#.#31.195.233':139
'19#.#31.120.108':139
'19#.#31.202.75':9988
'19#.#31.108.180':9988
'19#.#31.157.185':9988
'19#.#31.61.198':9988
'19#.#31.22.39':9988
'19#.#31.137.194':9988
'19#.#31.7.128':9988
'19#.#31.175.160':9988
'19#.#31.2.115':9988
'19#.#31.50.165':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней