Trojan.DownLoader12.28955

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER0162.dir00\svchost.exe.mdmp 16325836412029764

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER0162.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'20#.#20.200.106':139
'20#.#20.110.200':139
'20#.#20.82.164':139
'20#.#20.80.236':139
'20#.#20.82.164':445
'20#.#20.110.200':445
'20#.#20.193.110':139
'20#.#20.80.236':445
'20#.#20.200.106':445
'20#.#20.51.213':445
'20#.#20.80.200':445
'20#.#20.153.189':445
'20#.#20.56.199':445
'20#.#20.107.239':445
'20#.#20.30.62':445
'20#.#20.5.147':445
'20#.#20.215.184':445
'20#.#20.43.81':445
'20#.#20.147.80':445
'20#.#20.66.76':139
'20#.#20.199.15':139
'20#.#20.13.219':139
'20#.#20.192.144':139
'20#.#20.59.199':139
'20#.#20.179.32':139
'20#.#20.56.143':139
'20#.#20.164.184':139
'20#.#20.124.37':139
'20#.#20.23.180':139
'20#.#20.26.220':139
'20#.#20.74.20':139
'20#.#20.132.76':139
'20#.#20.30.33':139
'20#.#20.223.45':139
'20#.#20.95.67':139
'20#.#20.64.177':139
'20#.#20.36.106':139
'20#.#20.164.36':139
'20#.#20.68.83':445
'20#.#20.11.0':445
'20#.#20.104.178':445
'20#.#20.55.206':445
'20#.#20.4.161':445
'20#.#20.129.203':445
'20#.#20.217.114':445
'20#.#20.220.65':445
'20#.#20.68.209':445
'20#.#20.85.204':445
'20#.#20.190.77':445
'20#.#20.71.61':445
'20#.#20.82.172':445
'20#.#20.215.184':139
'20#.#20.51.213':139
'20#.#20.178.188':445
'20#.#20.42.250':445
'20#.#20.76.115':445
'20#.#20.71.65':445
'20#.#20.7.65':445
'20#.#20.73.14':445
'20#.#20.223.165':445
'20#.#20.93.156':445
'20#.#20.58.55':445
'20#.#20.28.223':445
'20#.#20.208.211':445
'20#.#20.34.82':445
'20#.#20.154.131':445
'20#.#20.98.154':445
'20#.#20.229.157':445
'20#.#20.117.100':445
'20#.#20.240.79':445
'20#.#20.154.168':445
'20#.#20.87.189':445
'20#.#20.137.216':445
'20#.#20.93.185':445
'20#.#20.167.93':445
'20#.#20.54.116':445
'20#.#20.205.77':445
'20#.#20.23.38':139
'20#.#20.165.105':445
'20#.#20.66.108':445
'20#.#20.30.10':445
'20#.#20.106.79':445
'20#.#20.119.9':445
'20#.#20.114.97':445
'20#.#20.9.114':445
'20#.#20.162.159':445
'20#.#20.140.162':445
'20#.#20.36.113':445
'20#.#20.59.199':445
'20#.#20.164.184':445
'20#.#20.66.76':445
'20#.#20.199.15':445
'20#.#20.124.37':445
'20#.#20.23.38':445
'20#.#20.112.242':445
'20#.#20.179.32':445
'20#.#20.56.143':445
'20#.#20.48.223':445
'20#.#20.0.182':445
'20#.#20.197.11':445
'20#.#20.92.68':445
'20#.#20.207.217':445
'20#.#20.165.156':139
'20#.#20.199.140':139
'20#.#20.7.208':139
'20#.#20.49.155':139
'20#.#20.49.36':445
'20#.#20.183.248':445
'20#.#20.233.203':445
'20#.#20.79.9':445
'20#.#20.247.78':445
'20#.#20.122.233':445
'20#.#20.87.31':445
'20#.#20.175.49':445
'20#.#20.51.10':445
'20#.#20.7.122':445
'20#.#20.192.144':445
'20#.#20.247.78':139
'20#.#20.183.248':139
'20#.#20.9.114':139
'20#.#20.79.9':139
'20#.#20.233.203':139
'20#.#20.7.122':139
'20#.#20.87.31':139
'20#.#20.122.233':139
'20#.#20.51.10':139
'20#.#20.114.97':139
'20#.#20.30.10':139
'20#.#20.106.79':139
'20#.#20.112.242':139
'20#.#20.36.113':139
'20#.#20.165.105':139
'20#.#20.162.159':139
'20#.#20.140.162':139
'20#.#20.66.108':139
'20#.#20.119.9':139
'20#.#20.223.45':445
'20#.#20.36.106':445
'20#.#20.26.220':445
'20#.#20.74.20':445
'20#.#20.164.36':445
'20#.#20.23.180':445
'20#.#20.13.219':445
'20#.#20.95.67':445
'20#.#20.64.177':445
'20#.#20.30.33':445
'20#.#20.197.11':139
'20#.#20.92.68':139
'20#.#20.175.49':139
'20#.#20.49.36':139
'20#.#20.48.223':139
'20#.#20.193.110':445
'20#.#20.132.76':445
'20#.#20.0.182':139
'20#.#20.207.217':139
'20#.#20.6.126':445
'20#.#20.125.48':445
'20#.#20.5.234':139
'20#.#20.220.52':139
'20#.#20.91.18':445
'20#.#20.132.1':445
'20#.#20.174.91':445
'20#.#20.188.87':445
'20#.#20.2.38':445
'20#.#20.89.215':139
'20#.#20.167.97':139
'20#.#20.77.143':139
'20#.#20.177.16':139
'20#.#20.106.187':139
'20#.#20.29.168':139
'20#.#20.170.90':139
'20#.#20.13.171':139
'20#.#20.188.149':139
'20#.#20.187.12':139
'20#.#20.147.0':445
'20#.#20.12.217':445
'20#.#20.166.19':445
'20#.#20.249.156':445
'20#.#20.193.84':445
'20#.#20.202.150':445
'20#.#20.56.227':445
'20#.#20.52.81':445
'20#.#20.150.240':445
'20#.#20.19.130':445
'20#.#20.205.236':445
'20#.#20.56.225':445
'20#.#20.39.67':445
'20#.#20.83.210':445
'20#.#20.149.56':445
'20#.#20.185.79':445
'20#.#20.6.76':445
'20#.#20.191.146':445
'20#.#20.195.114':445
'20#.#20.42.31':139
'20#.#20.191.146':139
'20#.#20.195.114':139
'20#.#20.56.225':139
'20#.#20.149.56':139
'20#.#20.185.79':139
'20#.#20.166.19':139
'20#.#20.249.156':139
'20#.#20.6.76':139
'20#.#20.19.130':139
'20#.#20.205.236':139
'20#.#20.91.18':139
'20#.#20.188.87':139
'20#.#20.6.126':139
'20#.#20.125.48':139
'20#.#20.2.38':139
'20#.#20.39.67':139
'20#.#20.83.210':139
'20#.#20.132.1':139
'20#.#20.174.91':139
'20#.#20.105.21':139
'20#.#20.106.249':139
'20#.#20.95.69':139
'20#.#20.174.4':139
'20#.#20.172.156':139
'20#.#20.240.252':139
'20#.#20.122.241':139
'20#.#20.69.172':139
'20#.#20.239.150':139
'20#.#20.134.157':139
'20#.#20.193.84':139
'20#.#20.52.81':139
'20#.#20.147.0':139
'20#.#20.12.217':139
'20#.#20.150.240':139
'20#.#20.110.57':139
'20#.#20.4.191':139
'20#.#20.202.150':139
'20#.#20.56.227':139
'20#.#20.110.57':445
'20#.#20.117.100':139
'20#.#20.240.79':139
'20#.#20.154.168':139
'20#.#20.87.189':139
'20#.#20.137.216':139
'20#.#20.93.185':139
'20#.#20.167.93':139
'20#.#20.54.116':139
'20#.#20.205.77':139
'20#.#20.220.65':139
'20#.#20.4.161':139
'20#.#20.11.0':139
'20#.#20.190.77':139
'20#.#20.55.206':139
'20#.#20.104.178':139
'20#.#20.85.204':139
'20#.#20.217.114':139
'20#.#20.129.203':139
'20#.#20.68.209':139
'20#.#20.107.239':139
'20#.#20.80.200':139
'20#.#20.68.83':139
'20#.#20.56.199':139
'20#.#20.153.189':139
'20#.#20.147.80':139
'20#.#20.5.147':139
'20#.#20.30.62':139
'20#.#20.43.81':139
'20#.#20.34.82':139
'20#.#20.58.55':139
'20#.#20.73.14':139
'20#.#20.229.157':139
'20#.#20.93.156':139
'20#.#20.223.165':139
'20#.#20.98.154':139
'20#.#20.208.211':139
'20#.#20.28.223':139
'20#.#20.154.131':139
'20#.#20.76.115':139
'20#.#20.177.16':445
'20#.#20.106.187':445
'20#.#20.122.241':445
'20#.#20.42.31':445
'20#.#20.167.97':445
'20#.#20.188.149':445
'20#.#20.187.12':445
'20#.#20.77.143':445
'20#.#20.29.168':445
'20#.#20.240.252':445
'20#.#20.95.69':445
'20#.#20.174.4':445
'20#.#20.4.191':445
'20#.#20.134.157':445
'20#.#20.105.21':445
'20#.#20.69.172':445
'20#.#20.239.150':445
'20#.#20.106.249':445
'20#.#20.172.156':445
'20#.#20.220.52':9988
'20#.#20.71.61':139
'20#.#20.110.57':9988
'20#.#20.240.252':9988
'20#.#20.82.172':139
'20#.#20.7.65':139
'20#.#20.42.250':139
'20#.#20.178.188':139
'20#.#20.71.65':139
'20#.#20.149.56':9988
'20#.#20.89.215':445
'20#.#20.5.234':445
'20#.#20.170.90':445
'20#.#20.13.171':445
'20#.#20.220.52':445
'20#.#20.125.48':9988
'20#.#20.205.236':9988
'20#.#20.188.87':9988
'20#.#20.91.18':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней