Trojan.DownLoader12.29012

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERcf10.dir00\svchost.exe.mdmp 16325836412032160

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERcf10.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'84.##3.24.85':139
'84.##3.36.55':139
'84.##3.204.209':445
'84.##3.161.114':139
'84.##3.254.253':139
'84.##3.86.106':139
'84.##3.112.67':445
'84.##3.118.130':445
'84.##3.200.35':445
'84.##3.106.40':445
'84.##3.173.93':445
'84.##3.223.126':445
'84.##3.113.246':139
'84.##3.15.167':139
'84.##3.117.38':139
'84.##3.120.102':139
'84.##3.112.57':139
'84.##3.152.95':139
'84.##3.184.172':139
'84.##3.51.252':139
'84.##3.73.19':139
'84.##3.246.181':139
'84.##3.25.233':139
'84.##3.195.17':139
'84.##3.29.69':139
'84.##3.92.33':445
'84.##3.184.172':445
'84.##3.15.167':445
'84.##3.117.38':445
'84.##3.55.133':445
'84.##3.112.57':445
'84.##3.152.95':445
'84.##3.29.69':445
'84.##3.51.252':445
'84.##3.73.19':445
'84.##3.120.102':445
'84.##3.25.233':445
'84.##3.195.17':445
'84.##3.242.137':445
'84.##3.71.236':445
'84.##3.237.122':445
'84.##3.96.80':445
'84.##3.118.2':445
'84.##3.245.105':445
'84.##3.65.178':445
'84.##3.125.10':445
'84.##3.13.120':445
'84.##3.137.217':445
'84.##3.26.107':445
'84.##3.31.163':445
'84.##3.18.16':445
'84.##3.141.208':139
'84.##3.245.141':139
'84.##3.161.253':445
'84.#33.6.6':139
'84.##3.41.139':139
'84.##3.204.173':139
'84.##3.11.149':445
'84.##3.196.11':445
'84.#33.6.6':445
'84.##3.6.144':445
'84.##3.50.177':445
'84.##3.53.67':445
'84.##3.196.11':139
'84.##3.162.228':445
'84.##3.255.148':445
'84.##3.71.216':445
'84.##3.209.34':445
'84.##3.60.234':445
'84.##3.228.82':445
'84.##3.6.144':139
'84.##3.53.67':139
'84.##3.11.149':139
'84.##3.185.14':445
'84.##3.161.253':139
'84.##3.50.177':139
'84.##3.41.139':445
'84.##3.96.80':139
'84.##3.26.107':139
'84.##3.31.163':139
'84.##3.65.178':139
'84.##3.71.236':139
'84.##3.237.122':139
'84.##3.137.217':139
'84.##3.242.137':139
'84.##3.55.133':139
'84.##3.18.16':139
'84.##3.125.10':139
'84.##3.13.120':139
'84.##3.245.105':139
'84.##3.204.209':139
'84.##3.106.40':139
'84.##3.173.93':139
'84.##3.204.173':445
'84.##3.141.208':445
'84.##3.245.141':445
'84.##3.200.35':139
'84.##3.92.33':139
'84.##3.118.2':139
'84.##3.223.126':139
'84.##3.112.67':139
'84.##3.118.130':139
'84.##3.168.222':139
'84.##3.114.32':139
'84.##3.78.140':445
'84.##3.194.154':139
'84.##3.82.108':139
'84.##3.205.209':139
'84.##3.55.27':445
'84.##3.222.156':445
'84.##3.83.58':445
'84.##3.197.119':445
'84.##3.114.5':445
'84.##3.86.202':445
'84.##3.8.105':139
'84.##3.74.119':139
'84.##3.27.228':139
'84.##3.204.69':139
'84.##3.55.76':139
'84.##3.236.55':139
'84.##3.67.108':139
'84.##3.160.134':139
'84.##3.109.186':139
'84.##3.177.38':139
'84.##3.29.28':139
'84.##3.232.29':139
'84.##3.42.232':139
'84.#33.4.83':445
'84.##3.67.108':445
'84.##3.74.119':445
'84.##3.27.228':445
'84.##3.76.161':445
'84.##3.55.76':445
'84.##3.236.55':445
'84.##3.42.232':445
'84.##3.160.134':445
'84.##3.109.186':445
'84.##3.204.69':445
'84.##3.29.28':445
'84.##3.232.29':445
'84.##3.149.146':445
'84.##3.42.107':445
'84.##3.58.70':445
'84.##3.49.121':445
'84.##3.137.4':445
'84.##3.112.76':445
'84.##3.187.5':445
'84.##3.226.170':445
'84.##3.224.142':445
'84.##3.234.217':445
'84.##3.206.89':445
'84.##3.202.206':445
'84.##3.55.187':445
'84.##3.134.239':139
'84.##3.130.112':139
'84.##3.96.48':445
'84.##3.31.136':139
'84.##3.124.134':139
'84.##3.169.1':139
'84.##3.46.64':445
'84.##3.26.152':445
'84.##3.31.136':445
'84.##3.27.167':445
'84.##3.18.82':445
'84.##3.63.248':445
'84.##3.26.152':139
'84.##3.254.253':445
'84.##3.86.106':445
'84.##3.24.85':445
'84.##3.246.181':445
'84.##3.113.246':445
'84.##3.161.114':445
'84.##3.18.82':139
'84.##3.63.248':139
'84.##3.46.64':139
'84.##3.36.55':445
'84.##3.96.48':139
'84.##3.27.167':139
'84.##3.124.134':445
'84.##3.49.121':139
'84.##3.206.89':139
'84.##3.202.206':139
'84.##3.187.5':139
'84.##3.42.107':139
'84.##3.58.70':139
'84.##3.234.217':139
'84.##3.149.146':139
'84.##3.76.161':139
'84.##3.55.187':139
'84.##3.226.170':139
'84.##3.224.142':139
'84.##3.112.76':139
'84.##3.78.140':139
'84.##3.197.119':139
'84.##3.114.5':139
'84.##3.169.1':445
'84.##3.134.239':445
'84.##3.130.112':445
'84.##3.83.58':139
'84.#33.4.83':139
'84.##3.137.4':139
'84.##3.86.202':139
'84.##3.55.27':139
'84.##3.222.156':139
'84.##3.25.248':445
'84.##3.218.2':445
'84.##3.219.205':445
'84.##3.80.219':445
'84.##3.74.154':445
'84.##3.67.61':445
'84.##3.17.129':445
'84.##3.85.41':445
'84.##3.138.194':445
'84.##3.17.226':445
'84.##3.45.12':445
'84.##3.89.197':445
'84.##3.176.147':445
'84.##3.127.36':445
'84.##3.135.112':445
'84.##3.194.98':445
'84.##3.34.201':445
'84.##3.143.23':445
'84.##3.104.23':445
'84.##3.207.92':445
'84.##3.67.156':445
'84.##3.160.112':445
'84.##3.18.101':445
'84.##3.223.130':445
'84.##3.80.64':445
'84.##3.123.54':445
'84.##3.21.15':445
'84.##3.142.76':445
'84.##3.246.141':445
'84.##3.160.186':445
'84.##3.120.158':445
'84.##3.170.50':445
'84.##3.131.71':445
'84.##3.52.200':445
'84.##3.172.251':445
'84.##3.228.105':445
'84.##3.90.25':445
'84.##3.238.104':445
'84.##3.186.10':445
'84.##3.58.23':445
'84.##3.142.58':445
'84.##3.206.12':445
'84.##3.68.229':445
'84.##3.87.113':445
'84.##3.226.29':445
'84.##3.132.214':445
'84.##3.87.76':445
'84.##3.88.147':445
'84.##3.0.206':445
'84.##3.193.27':445
'84.##3.196.250':445
'84.##3.25.248':139
'84.##3.218.2':139
'84.##3.219.205':139
'84.##3.80.219':139
'84.##3.74.154':139
'84.##3.67.61':139
'84.##3.17.129':139
'84.##3.85.41':139
'84.##3.138.194':139
'84.##3.45.12':139
'84.##3.17.226':139
'84.##3.89.197':139
'84.##3.176.147':139
'84.##3.207.92':139
'84.##3.223.130':139
'84.##3.135.112':139
'84.##3.127.36':139
'84.##3.104.23':139
'84.##3.194.98':139
'84.##3.18.101':139
'84.##3.67.156':139
'84.##3.160.112':139
'84.##3.80.64':139
'84.##3.143.23':139
'84.##3.34.201':139
'84.##3.123.54':139
'84.##3.21.15':139
'84.##3.142.76':139
'84.##3.246.141':139
'84.##3.160.186':139
'84.##3.120.158':139
'84.##3.170.50':139
'84.##3.131.71':139
'84.##3.52.200':139
'84.##3.172.251':139
'84.##3.228.105':139
'84.##3.90.25':139
'84.##3.238.104':139
'84.##3.186.10':139
'84.##3.58.23':139
'84.##3.142.58':139
'84.##3.206.12':139
'84.##3.68.229':139
'84.##3.87.113':139
'84.##3.226.29':139
'84.##3.132.214':139
'84.##3.87.76':139
'84.##3.88.147':139
'84.##3.0.206':139
'84.##3.193.27':139
'84.##3.196.250':139
'84.##3.71.216':139
'84.##3.185.14':139
'84.##3.162.69':445
'84.##3.228.82':139
'84.##3.162.228':139
'84.##3.255.148':139
'84.##3.100.0':445
'84.##3.144.150':445
'84.##3.173.90':445
'84.##3.10.20':445
'84.##3.31.134':445
'84.##3.108.210':445
'84.##3.60.234':139
'84.##3.179.165':139
'84.##3.202.103':139
'84.##3.18.109':139
'84.##3.163.179':139
'84.##3.145.119':139
'84.##3.250.182':139
'84.##3.236.160':139
'84.##3.185.16':139
'84.##3.209.34':139
'84.##3.84.195':139
'84.##3.64.155':139
'84.##3.17.126':139
'84.##3.199.19':445
'84.##3.250.182':445
'84.##3.179.165':445
'84.##3.202.103':445
'84.##3.103.201':445
'84.##3.163.179':445
'84.##3.145.119':445
'84.##3.17.126':445
'84.##3.236.160':445
'84.##3.185.16':445
'84.##3.18.109':445
'84.##3.84.195':445
'84.##3.64.155':445
'84.##3.24.148':445
'84.##3.241.15':445
'84.##3.64.240':445
'84.##3.81.206':445
'84.##3.23.48':445
'84.##3.64.219':445
'84.##3.55.228':445
'84.##3.156.20':445
'84.##3.109.156':445
'84.##3.148.109':445
'84.##3.175.139':445
'84.##3.48.142':445
'84.##3.20.187':445
'84.##3.246.20':139
'84.##3.200.123':139
'84.##3.46.134':445
'84.##3.220.186':139
'84.##3.171.220':139
'84.##3.173.171':139
'84.##3.27.46':445
'84.##3.220.253':445
'84.##3.220.186':445
'84.##3.171.14':445
'84.##3.115.125':445
'84.##3.206.115':445
'84.##3.220.253':139
'84.##3.123.54':9988
'84.##3.68.229':9988
'84.##3.58.23':9988
'84.##3.143.23':9988
'84.##3.74.154':9988
'84.##3.89.197':9988
'84.##3.171.14':139
'84.##3.46.134':139
'84.##3.27.46':139
'84.##3.132.214':9988
'84.##3.115.125':139
'84.##3.206.115':139
'84.##3.171.220':445
'84.##3.81.206':139
'84.##3.175.139':139
'84.##3.48.142':139
'84.##3.55.228':139
'84.##3.241.15':139
'84.##3.64.240':139
'84.##3.148.109':139
'84.##3.24.148':139
'84.##3.103.201':139
'84.##3.20.187':139
'84.##3.156.20':139
'84.##3.109.156':139
'84.##3.64.219':139
'84.##3.246.20':445
'84.##3.10.20':139
'84.##3.31.134':139
'84.##3.173.171':445
'84.##3.200.123':445
'84.##3.162.69':139
'84.##3.173.90':139
'84.##3.199.19':139
'84.##3.23.48':139
'84.##3.108.210':139
'84.##3.100.0':139
'84.##3.144.150':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней