Trojan.DownLoader12.29029

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1152 -dm 7 7 %TEMP%\WER36f0.dir00\svchost.exe.mdmp 16325836412032304

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER36f0.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'14#.#49.100.163':445
'14#.#49.140.150':445
'14#.#49.38.139':139
'14#.#49.118.98':139
'14#.#49.55.243':445
'14#.#49.148.23':445
'14#.#49.237.240':445
'14#.#49.8.57':445
'14#.#49.36.76':445
'14#.#49.171.175':139
'14#.#49.47.108':139
'14#.#49.27.105':139
'14#.#49.201.228':139
'14#.#49.181.203':139
'14#.#49.11.165':139
'14#.#49.101.165':139
'14#.#49.128.173':139
'14#.#49.228.9':139
'14#.#49.129.219':139
'14#.#49.210.30':445
'14#.#49.89.136':445
'14#.#49.35.72':445
'14#.#49.57.131':445
'14#.#49.50.14':445
'14#.#49.41.112':445
'14#.#49.8.164':445
'14#.#49.73.229':445
'14#.#49.125.48':445
'14#.#49.161.253':445
'14#.#49.90.114':445
'14#.#49.167.89':445
'14#.#49.161.238':445
'14#.#49.94.67':445
'14#.#49.2.167':445
'14#.#49.183.46':445
'14#.#49.47.213':445
'14#.#49.17.3':445
'14#.#49.8.108':445
'14#.#49.8.108':139
'14#.#49.183.46':139
'14#.#49.2.167':139
'14#.#49.17.3':139
'14#.#49.47.213':139
'14#.#49.57.131':139
'14#.#49.210.30':139
'14#.#49.161.253':139
'14#.#49.35.72':139
'14#.#49.167.89':139
'14#.#49.8.57':139
'14#.#49.36.76':139
'14#.#49.140.150':139
'14#.#49.55.243':139
'14#.#49.148.23':139
'14#.#49.94.67':139
'14#.#49.90.114':139
'14#.#49.237.240':139
'14#.#49.161.238':139
'14#.#49.1.59':139
'14#.#49.13.22':139
'14#.#49.253.102':139
'14#.#49.88.201':139
'14#.#49.106.222':139
'14#.#49.204.79':139
'14#.#49.229.6':139
'14#.#49.228.227':139
'14#.#49.21.192':139
'14#.#49.4.51':139
'14#.#49.73.229':139
'14#.#49.125.48':139
'14#.#49.89.136':139
'14#.#49.50.14':139
'14#.#49.41.112':139
'14#.#49.57.10':139
'14#.#49.16.6':139
'14#.#49.8.164':139
'14#.#49.188.150':139
'14#.#49.188.150':445
'14#.#49.31.252':139
'14#.#49.53.138':139
'14#.#49.80.132':139
'14#.#49.131.131':139
'14#.#49.32.150':139
'14#.#49.106.107':139
'14#.#49.232.205':139
'14#.#49.109.67':139
'14#.#49.3.109':139
'14#.#49.50.181':139
'14#.#49.45.177':139
'14#.#49.159.128':139
'14#.#49.80.44':139
'14#.#49.178.149':139
'14#.#49.227.158':139
'14#.#49.86.150':139
'14#.#49.100.19':139
'14#.#49.87.227':139
'14#.#49.205.220':139
'14#.#49.29.245':139
'14#.#49.75.30':139
'14#.#49.130.159':139
'14#.#49.90.213':139
'14#.#49.133.38':139
'14#.#49.57.104':139
'14#.#49.191.69':445
'14#.#49.121.150':139
'14#.#49.57.228':139
'14#.#49.97.230':139
'14#.#49.186.151':139
'14#.#49.53.67':139
'14#.#49.174.253':139
'14#.#49.146.16':139
'14#.#49.254.22':139
'14#.#49.19.36':139
'14#.#49.65.128':139
'14#.#49.209.68':139
'14#.#49.144.209':139
'14#.#49.201.228':445
'14#.#49.181.203':445
'14#.#49.204.79':445
'14#.#49.229.6':445
'14#.#49.47.108':445
'14#.#49.228.9':445
'14#.#49.129.219':445
'14#.#49.27.105':445
'14#.#49.11.165':445
'14#.#49.21.192':445
'14#.#49.4.51':445
'14#.#49.253.102':445
'14#.#49.57.10':445
'14#.#49.16.6':445
'14#.#49.88.201':445
'14#.#49.106.222':445
'14#.#49.228.227':445
'14#.#49.1.59':445
'14#.#49.13.22':445
'14#.#49.165.145':139
'14#.#49.236.139':139
'14#.#49.112.250':139
'14#.#49.146.85':139
'14#.#49.209.230':139
'14#.#49.7.190':139
'14#.#49.198.117':139
'14#.#49.137.123':139
'14#.#49.111.137':139
'14#.#49.60.131':139
'14#.#49.171.175':445
'14#.#49.38.139':445
'14#.#49.101.165':445
'14#.#49.128.173':445
'14#.#49.118.98':445
'14#.#49.143.8':139
'14#.#49.34.122':139
'14#.#49.191.69':139
'14#.#49.182.66':139
'14#.#49.100.163':139
'14#.#49.197.172':139
'14#.#49.64.48':445
'14#.#49.66.204':139
'14#.#49.151.126':139
'14#.#49.162.210':445
'14#.#49.33.103':445
'14#.#49.24.134':445
'14#.#49.105.116':445
'14#.#49.171.203':445
'14#.#49.197.12':139
'14#.#49.161.55':139
'14#.#49.71.224':139
'14#.#49.225.130':139
'14#.#49.11.226':139
'14#.#49.0.219':139
'14#.#49.202.151':139
'14#.#49.217.22':139
'14#.#49.128.182':139
'14#.#49.183.173':139
'14#.#49.139.169':445
'14#.#49.114.28':445
'14#.#49.235.169':445
'14#.#49.56.235':445
'14#.#49.138.62':445
'14#.#49.4.77':445
'14#.#49.44.126':445
'14#.#49.76.199':445
'14#.#49.76.201':445
'14#.#49.102.193':445
'14#.#49.80.81':445
'14#.#49.214.35':445
'14#.#49.144.24':445
'14#.#49.217.143':445
'14#.#49.68.127':445
'14#.#49.192.188':445
'14#.#49.179.139':445
'14#.#49.69.147':445
'14#.#49.116.254':445
'14#.#49.116.254':139
'14#.#49.192.188':139
'14#.#49.68.127':139
'14#.#49.69.147':139
'14#.#49.179.139':139
'14#.#49.56.235':139
'14#.#49.139.169':139
'14#.#49.102.193':139
'14#.#49.235.169':139
'14#.#49.214.35':139
'14#.#49.33.103':139
'14#.#49.171.203':139
'14#.#49.64.48':139
'14#.#49.162.210':139
'14#.#49.105.116':139
'14#.#49.217.143':139
'14#.#49.80.81':139
'14#.#49.24.134':139
'14#.#49.144.24':139
'14#.#49.138.153':139
'14#.#49.56.70':139
'14#.#49.80.49':139
'14#.#49.3.86':139
'14#.#49.94.78':139
'14#.#49.26.216':139
'14#.#49.71.73':139
'14#.#49.64.95':139
'14#.#49.103.176':139
'14#.#49.214.153':139
'14#.#49.76.199':139
'14#.#49.76.201':139
'14#.#49.114.28':139
'14#.#49.138.62':139
'14#.#49.4.77':139
'14#.#49.82.51':139
'14#.#49.14.198':139
'14#.#49.44.126':139
'14#.#49.63.243':139
'14#.#49.63.243':445
'14#.#49.60.168':139
'14#.#49.137.172':139
'14#.#49.215.53':139
'14#.#49.255.27':139
'14#.#49.25.121':139
'14#.#49.110.80':139
'14#.#49.67.84':139
'14#.#49.210.102':139
'14#.#49.70.106':139
'14#.#49.214.170':139
'14#.#49.80.49':9988
'14#.#49.3.86':9988
'14#.#49.4.77':9988
'14#.#49.14.198':9988
'14#.#49.6.18':139
'14#.#49.36.46':139
'14#.#49.197.200':139
'14#.#49.122.5':139
'14#.#49.145.122':139
'14#.#49.25.121':445
'14#.#49.210.102':445
'14#.#49.60.168':445
'14#.#49.137.172':445
'14#.#49.70.106':445
'14#.#49.183.19':445
'14#.#49.31.67':445
'14#.#49.110.80':445
'14#.#49.67.84':445
'14#.#49.255.27':445
'14#.#49.6.18':445
'14#.#49.122.5':445
'14#.#49.183.19':139
'14#.#49.31.67':139
'14#.#49.145.122':445
'14#.#49.214.170':445
'14#.#49.215.53':445
'14#.#49.36.46':445
'14#.#49.197.200':445
'14#.#49.225.130':445
'14#.#49.11.226':445
'14#.#49.26.216':445
'14#.#49.71.73':445
'14#.#49.161.55':445
'14#.#49.128.182':445
'14#.#49.183.173':445
'14#.#49.71.224':445
'14#.#49.0.219':445
'14#.#49.103.176':445
'14#.#49.214.153':445
'14#.#49.80.49':445
'14#.#49.82.51':445
'14#.#49.14.198':445
'14#.#49.3.86':445
'14#.#49.94.78':445
'14#.#49.64.95':445
'14#.#49.138.153':445
'14#.#49.56.70':445
'14#.#49.235.169':9988
'14#.#49.56.235':9988
'14#.#49.192.188':9988
'14#.#49.179.139':9988
'14#.#49.139.169':9988
'14#.#49.76.199':9988
'14#.#49.76.201':9988
'14#.#49.114.28':9988
'14#.#49.138.62':9988
'14#.#49.116.254':9988
'14#.#49.197.12':445
'14#.#49.66.204':445
'14#.#49.202.151':445
'14#.#49.217.22':445
'14#.#49.151.126':445
'14#.#49.24.134':9988
'14#.#49.69.147':9988
'14#.#49.197.172':445
'14#.#49.64.48':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней