Trojan.DownLoader12.28911

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WER350a.dir00\svchost.exe.mdmp 16325836412027408

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER350a.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'81.##2.16.163':139
'81.##2.106.174':139
'81.##2.163.17':139
'81.##2.224.240':139
'81.##2.138.207':139
'81.##2.132.110':139
'81.##2.208.22':139
'81.##2.181.189':139
'81.##2.10.128':139
'81.##2.12.103':139
'81.##2.46.184':139
'81.##2.26.48':139
'81.##2.118.51':139
'81.##2.128.170':139
'81.##2.17.68':139
'81.#32.9.17':139
'81.##2.142.124':139
'81.##2.85.156':139
'81.##2.0.150':139
'81.##2.39.112':139
'81.##2.149.184':139
'81.##2.226.142':139
'81.##2.0.150':445
'81.##2.142.124':445
'81.##2.149.184':445
'81.##2.118.51':445
'81.##2.39.112':445
'81.##2.138.207':445
'81.##2.163.17':445
'81.##2.224.240':445
'81.##2.85.156':445
'81.##2.46.184':445
'81.##2.26.48':445
'81.##2.42.84':139
'81.##2.66.172':139
'81.#32.1.97':139
'81.##2.135.97':139
'81.##2.72.42':139
'81.#32.9.17':445
'81.##2.128.170':445
'81.##2.17.68':445
'81.##2.227.250':139
'81.##2.134.27':445
'81.##2.24.133':139
'81.##2.128.249':139
'81.##2.85.41':139
'81.##2.253.236':139
'81.##2.72.196':139
'81.#32.29.9':139
'81.##2.147.130':445
'81.##2.244.171':139
'81.##2.132.54':139
'81.##2.138.14':139
'81.#32.7.60':139
'81.##2.42.71':139
'81.##2.149.136':139
'81.##2.77.142':139
'81.##2.142.93':139
'81.##2.198.187':139
'81.##2.175.252':139
'81.##2.84.67':139
'81.##2.18.127':139
'81.##2.74.123':139
'81.##2.48.20':139
'81.##2.225.112':445
'81.##2.24.133':445
'81.##2.128.249':445
'81.##2.85.41':445
'81.##2.253.236':445
'81.##2.72.196':445
'81.#32.29.9':445
'81.##2.134.27':139
'81.##2.244.171':445
'81.##2.132.54':445
'81.##2.138.14':445
'81.#32.7.60':445
'81.##2.42.71':445
'81.##2.149.136':445
'81.##2.77.142':445
'81.##2.142.93':445
'81.##2.198.187':445
'81.##2.175.252':445
'81.##2.84.67':445
'81.##2.18.127':445
'81.##2.74.123':445
'81.##2.48.20':445
'81.##2.16.163':445
'81.##2.81.167':139
'81.##2.151.119':139
'81.##2.160.110':445
'81.##2.81.140':445
'81.##2.22.217':445
'81.##2.15.207':139
'81.##2.157.83':139
'81.##2.12.214':139
'81.##2.171.95':139
'81.##2.11.156':139
'81.##2.124.114':445
'81.##2.50.212':445
'81.#32.4.16':445
'81.##2.212.33':445
'81.##2.206.108':445
'81.##2.33.48':445
'81.#32.73.3':445
'81.##2.111.73':445
'81.##2.54.32':445
'81.##2.150.223':445
'81.##2.28.198':445
'81.##2.31.41':139
'81.##2.171.184':139
'81.##2.5.227':139
'81.##2.135.147':139
'81.##2.62.116':139
'81.##2.64.51':139
'81.##2.92.125':139
'81.##2.97.14':139
'81.##2.242.54':139
'81.##2.196.126':139
'81.##2.55.196':139
'81.##2.166.173':139
'81.##2.52.212':139
'81.##2.39.76':139
'81.##2.156.103':139
'81.##2.224.161':139
'81.##2.103.151':139
'81.##2.109.112':139
'81.##2.33.236':139
'81.##2.250.152':139
'81.##2.88.199':139
'81.##2.148.126':139
'81.##2.202.243':139
'81.##2.231.189':139
'81.##2.45.219':139
'81.##2.66.172':445
'81.##2.227.250':445
'81.##2.105.227':139
'81.##2.97.145':139
'81.##2.63.139':139
'81.##2.71.189':139
'81.##2.173.23':139
'81.##2.42.84':445
'81.##2.181.189':445
'81.##2.132.110':445
'81.##2.12.103':445
'81.##2.106.174':445
'81.##2.10.128':445
'81.##2.72.42':445
'81.#32.1.97':445
'81.##2.135.97':445
'81.##2.208.22':445
'81.##2.226.142':445
'81.##2.206.108':139
'81.##2.202.243':445
'81.##2.231.189':445
'81.##2.45.219':445
'81.##2.22.217':139
'81.##2.160.110':139
'81.##2.105.227':445
'81.##2.97.145':445
'81.##2.63.139':445
'81.##2.71.189':445
'81.##2.173.23':445
'81.##2.81.140':139
'81.#32.4.16':139
'81.##2.150.223':139
'81.##2.50.212':139
'81.##2.33.48':139
'81.##2.212.33':139
'81.##2.111.73':139
'81.##2.124.114':139
'81.#32.73.3':139
'81.##2.28.198':139
'81.##2.54.32':139
'81.##2.218.165':445
'81.##2.210.218':445
'81.##2.37.53':445
'81.##2.117.249':445
'81.##2.52.160':445
'81.##2.228.109':445
'81.##2.183.178':445
'81.##2.15.217':445
'81.##2.57.210':445
'81.##2.15.158':445
'81.##2.238.230':445
'81.##2.184.236':139
'81.##2.196.53':139
'81.##2.38.238':139
'81.##2.100.244':139
'81.##2.238.93':139
'81.##2.189.11':445
'81.##2.61.239':445
'81.##2.244.185':139
'81.##2.52.95':139
'81.##2.172.9':139
'81.##2.42.139':445
'81.##2.125.135':445
'81.##2.212.174':445
'81.##2.137.199':445
'81.##2.212.1':445
'81.##2.78.97':445
'81.##2.231.42':445
'81.##2.99.156':445
'81.##2.43.52':445
'81.##2.70.178':445
'81.##2.131.175':445
'81.##2.181.21':445
'81.##2.27.125':445
'81.##2.14.151':445
'81.##2.71.40':445
'81.##2.201.158':445
'81.##2.91.125':445
'81.##2.5.133':445
'81.##2.138.191':445
'81.##2.113.173':445
'81.##2.114.195':445
'81.##2.123.229':445
'81.##2.201.158':139
'81.##2.91.125':139
'81.##2.42.139':139
'81.##2.228.109':139
'81.##2.183.178':139
'81.##2.114.195':139
'81.##2.123.229':139
'81.##2.14.151':139
'81.##2.71.40':139
'81.##2.27.125':139
'81.##2.15.217':139
'81.##2.117.249':139
'81.##2.61.239':139
'81.##2.52.160':139
'81.##2.238.230':139
'81.##2.189.11':139
'81.##2.57.210':139
'81.##2.15.158':139
'81.##2.210.218':139
'81.##2.37.53':139
'81.##2.218.165':139
'81.##2.113.173':139
'81.##2.229.245':139
'81.##2.29.176':139
'81.##2.128.239':139
'81.##2.231.42':139
'81.##2.99.156':139
'81.##2.234.180':139
'81.##2.147.16':139
'81.##2.64.158':139
'81.##2.99.18':139
'81.##2.212.253':139
'81.##2.43.52':139
'81.##2.212.1':139
'81.##2.78.97':139
'81.##2.181.21':139
'81.##2.5.133':139
'81.##2.138.191':139
'81.##2.70.178':139
'81.##2.131.175':139
'81.##2.212.174':139
'81.##2.137.199':139
'81.##2.125.135':139
'81.##2.128.239':445
'81.##2.87.162':445
'81.##2.103.198':445
'81.##2.162.168':445
'81.##2.116.123':139
'81.##2.137.230':445
'81.##2.61.201':445
'81.##2.46.62':445
'81.##2.60.206':445
'81.##2.9.133':445
'81.##2.78.76':445
'81.##2.122.251':139
'81.##2.6.239':139
'81.##2.114.7':139
'81.##2.195.13':139
'81.##2.166.122':139
'81.##2.1.228':139
'81.##2.13.235':139
'81.##2.153.160':139
'81.##2.248.1':139
'81.##2.114.208':139
'81.#32.48.7':139
'81.##2.236.45':445
'81.##2.248.1':445
'81.##2.13.235':445
'81.#32.48.7':445
'81.##2.114.7':445
'81.##2.114.208':445
'81.##2.147.130':139
'81.##2.225.112':139
'81.##2.116.123':445
'81.##2.153.160':445
'81.##2.122.251':445
'81.##2.6.239':445
'81.##2.140.84':445
'81.##2.20.211':445
'81.##2.84.30':445
'81.##2.214.147':445
'81.##2.141.80':445
'81.##2.1.228':445
'81.##2.195.13':445
'81.##2.166.122':445
'81.##2.10.106':445
'81.##2.123.118':445
'81.##2.244.185':445
'81.##2.218.165':9988
'81.##2.172.9':445
'81.##2.196.53':445
'81.##2.52.95':445
'81.##2.42.139':9988
'81.##2.91.125':9988
'81.##2.15.158':9988
'81.##2.189.11':9988
'81.##2.57.210':9988
'81.##2.184.236':445
'81.##2.212.253':445
'81.##2.64.158':445
'81.##2.99.18':445
'81.##2.229.245':445
'81.##2.29.176':445
'81.##2.238.93':445
'81.##2.38.238':445
'81.##2.100.244':445
'81.##2.234.180':445
'81.##2.147.16':445
'81.##2.71.40':9988
'81.##2.214.147':139
'81.##2.141.80':139
'81.##2.236.45':139
'81.##2.61.201':139
'81.##2.46.62':139
'81.##2.10.106':139
'81.##2.123.118':139
'81.##2.20.211':139
'81.##2.84.30':139
'81.##2.140.84':139
'81.##2.60.206':139
'81.##2.131.175':9988
'81.##2.137.230':139
'81.##2.212.174':9988
'81.##2.78.97':9988
'81.##2.137.199':9988
'81.##2.9.133':139
'81.##2.78.76':139
'81.##2.103.198':139
'81.##2.162.168':139
'81.##2.87.162':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней