Trojan.Starman.5734

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1152 -dm 7 7 %TEMP%\WER31ee.dir00\svchost.exe.mdmp 16325836412032392

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER31ee.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'82.##6.197.171':445
'82.##6.53.148':445
'82.##6.240.242':445
'82.##6.17.18':445
'82.##6.90.204':445
'82.##6.235.97':445
'82.##6.197.98':445
'82.##6.120.148':445
'82.##6.148.169':445
'82.##6.107.136':445
'82.##6.159.45':445
'82.##6.242.158':445
'82.#96.54.9':445
'82.##6.195.154':445
'82.##6.183.173':445
'82.##6.23.62':445
'82.##6.201.97':445
'82.##6.77.113':445
'82.##6.136.77':445
'82.##6.197.56':445
'82.##6.171.83':445
'82.##6.230.130':445
'82.##6.79.135':445
'82.##6.72.13':445
'82.##6.187.119':445
'82.##6.160.79':445
'82.##6.76.75':445
'82.##6.21.76':445
'82.##6.107.230':445
'82.##6.233.30':445
'82.##6.19.233':445
'82.##6.11.40':445
'82.#96.20.0':139
'82.##6.88.84':139
'82.##6.24.160':139
'82.##6.196.69':445
'82.##6.78.110':445
'82.##6.175.128':139
'82.##6.159.180':445
'82.##6.185.168':445
'82.##6.20.185':445
'82.##6.175.219':445
'82.##6.157.72':445
'82.##6.53.79':445
'82.##6.169.53':445
'82.##6.115.44':445
'82.##6.138.74':445
'82.##6.29.74':445
'82.##6.203.35':445
'82.##6.134.96':445
'82.##6.135.183':445
'82.#96.54.9':139
'82.##6.17.18':139
'82.##6.90.204':139
'82.##6.197.56':139
'82.##6.171.83':139
'82.##6.230.130':139
'82.##6.240.242':139
'82.##6.107.136':139
'82.##6.159.45':139
'82.##6.235.97':139
'82.##6.197.171':139
'82.##6.53.148':139
'82.##6.187.119':139
'82.##6.24.48':445
'82.##6.201.97':139
'82.##6.77.113':139
'82.##6.129.75':445
'82.##6.32.145':445
'82.##6.165.0':445
'82.##6.23.62':139
'82.##6.79.135':139
'82.##6.72.13':139
'82.##6.136.77':139
'82.##6.195.154':139
'82.##6.183.173':139
'82.##6.242.158':139
'82.##6.159.180':139
'82.##6.233.30':139
'82.##6.19.233':139
'82.##6.115.44':139
'82.##6.138.74':139
'82.##6.29.74':139
'82.##6.107.230':139
'82.##6.196.69':139
'82.##6.78.110':139
'82.##6.11.40':139
'82.##6.76.75':139
'82.##6.21.76':139
'82.##6.135.183':139
'82.##6.160.79':139
'82.##6.157.72':139
'82.##6.53.79':139
'82.##6.197.98':139
'82.##6.120.148':139
'82.##6.148.169':139
'82.##6.175.219':139
'82.##6.203.35':139
'82.##6.134.96':139
'82.##6.169.53':139
'82.##6.185.168':139
'82.##6.20.185':139
'82.##6.46.100':445
'82.##6.45.120':445
'82.##6.155.72':445
'82.##6.189.126':445
'82.##6.107.156':445
'82.##6.245.167':445
'82.##6.170.157':445
'82.##6.53.250':445
'82.##6.120.115':445
'82.##6.169.220':445
'82.##6.92.181':445
'82.##6.248.92':445
'82.##6.33.46':445
'82.##6.46.54':445
'82.##6.21.145':445
'82.##6.84.110':445
'82.##6.188.81':445
'82.##6.198.156':445
'82.##6.152.69':445
'82.##6.160.117':445
'82.##6.139.211':445
'82.##6.244.68':445
'82.##6.39.40':445
'82.##6.129.6':445
'82.##6.135.131':445
'82.##6.255.53':445
'82.##6.33.254':445
'82.##6.154.70':445
'82.##6.209.121':445
'82.##6.216.187':445
'82.##6.209.139':445
'82.##6.22.210':445
'82.##6.162.7':139
'82.##6.6.162':139
'82.##6.64.126':139
'82.##6.24.142':445
'82.##6.113.24':445
'82.##6.7.113':139
'82.##6.94.77':445
'82.##6.74.247':445
'82.##6.75.155':445
'82.##6.30.202':445
'82.##6.188.245':445
'82.##6.59.213':445
'82.##6.96.72':445
'82.##6.25.133':445
'82.##6.60.183':445
'82.##6.141.244':445
'82.##6.131.92':445
'82.##6.47.41':445
'82.##6.141.59':445
'82.##6.33.46':139
'82.##6.189.126':139
'82.##6.107.156':139
'82.##6.160.117':139
'82.##6.139.211':139
'82.##6.244.68':139
'82.##6.155.72':139
'82.##6.169.220':139
'82.##6.92.181':139
'82.##6.245.167':139
'82.##6.46.100':139
'82.##6.45.120':139
'82.##6.135.131':139
'82.##6.24.160':445
'82.##6.188.81':139
'82.##6.198.156':139
'82.##6.175.128':445
'82.#96.20.0':445
'82.##6.88.84':445
'82.##6.84.110':139
'82.##6.39.40':139
'82.##6.129.6':139
'82.##6.152.69':139
'82.##6.46.54':139
'82.##6.21.145':139
'82.##6.248.92':139
'82.##6.94.77':139
'82.##6.216.187':139
'82.##6.209.139':139
'82.##6.25.133':139
'82.##6.60.183':139
'82.##6.141.244':139
'82.##6.209.121':139
'82.##6.24.142':139
'82.##6.113.24':139
'82.##6.22.210':139
'82.##6.33.254':139
'82.##6.154.70':139
'82.##6.141.59':139
'82.##6.255.53':139
'82.##6.188.245':139
'82.##6.59.213':139
'82.##6.170.157':139
'82.##6.53.250':139
'82.##6.120.115':139
'82.##6.30.202':139
'82.##6.131.92':139
'82.##6.47.41':139
'82.##6.96.72':139
'82.##6.74.247':139
'82.##6.75.155':139
'82.##6.186.123':445
'82.##6.25.242':445
'82.##6.173.200':445
'82.##6.58.103':445
'82.##6.251.39':445
'82.##6.162.140':445
'82.##6.92.91':445
'82.##6.252.115':445
'82.##6.50.114':445
'82.##6.223.79':445
'82.##6.16.168':445
'82.##6.94.111':445
'82.##6.30.14':445
'82.##6.14.26':445
'82.##6.40.105':445
'82.##6.124.60':445
'82.##6.162.98':445
'82.##6.246.39':445
'82.##6.188.99':445
'82.##6.220.212':445
'82.##6.50.172':445
'82.##6.16.199':445
'82.##6.0.162':445
'82.##6.99.121':445
'82.#96.59.9':445
'82.##6.156.165':445
'82.##6.36.195':445
'82.##6.192.201':445
'82.##6.218.176':445
'82.##6.98.141':445
'82.##6.221.201':445
'82.##6.195.121':445
'82.##6.168.85':445
'82.##6.39.229':445
'82.##6.186.130':445
'82.##6.46.122':445
'82.##6.102.218':445
'82.##6.172.74':445
'82.##6.58.88':445
'82.##6.19.167':445
'82.##6.144.20':445
'82.##6.29.243':445
'82.##6.165.71':445
'82.##6.87.62':445
'82.##6.119.154':445
'82.##6.10.145':445
'82.##6.142.21':445
'82.##6.72.86':445
'82.##6.79.178':445
'82.##6.123.29':445
'82.##6.62.225':445
'82.##6.186.123':139
'82.##6.25.242':139
'82.##6.173.200':139
'82.##6.58.103':139
'82.##6.251.39':139
'82.##6.162.140':139
'82.##6.92.91':139
'82.##6.252.115':139
'82.##6.50.114':139
'82.##6.223.79':139
'82.##6.16.168':139
'82.##6.94.111':139
'82.##6.30.14':139
'82.##6.124.60':139
'82.##6.246.39':139
'82.##6.14.26':139
'82.##6.188.99':139
'82.##6.162.98':139
'82.##6.40.105':139
'82.##6.220.212':139
'82.##6.50.172':139
'82.##6.16.199':139
'82.##6.0.162':139
'82.##6.99.121':139
'82.#96.59.9':139
'82.##6.156.165':139
'82.##6.36.195':139
'82.##6.192.201':139
'82.##6.218.176':139
'82.##6.98.141':139
'82.##6.221.201':139
'82.##6.195.121':139
'82.##6.168.85':139
'82.##6.39.229':139
'82.##6.186.130':139
'82.##6.46.122':139
'82.##6.102.218':139
'82.##6.172.74':139
'82.##6.58.88':139
'82.##6.19.167':139
'82.##6.144.20':139
'82.##6.29.243':139
'82.##6.165.71':139
'82.##6.87.62':139
'82.##6.119.154':139
'82.##6.10.145':139
'82.##6.142.21':139
'82.##6.72.86':139
'82.##6.79.178':139
'82.##6.123.29':139
'82.##6.62.225':139
'82.##6.100.196':445
'82.##6.90.84':445
'82.##6.192.219':445
'82.##6.8.140':445
'82.##6.145.173':445
'82.##6.87.33':445
'82.##6.195.197':445
'82.##6.41.196':445
'82.##6.73.218':445
'82.##6.220.103':445
'82.##6.131.208':445
'82.##6.30.127':445
'82.##6.156.244':445
'82.##6.107.38':445
'82.##6.60.106':445
'82.##6.205.217':445
'82.##6.218.18':445
'82.##6.194.122':445
'82.##6.133.130':445
'82.##6.63.212':445
'82.##6.164.147':445
'82.##6.245.31':445
'82.##6.44.180':445
'82.##6.252.44':445
'82.##6.23.253':445
'82.##6.27.170':445
'82.##6.188.15':445
'82.##6.164.187':445
'82.##6.254.75':445
'82.##6.117.80':445
'82.##6.149.61':445
'82.##6.15.149':445
'82.##6.32.145':139
'82.##6.165.0':139
'82.##6.24.48':139
'82.##6.159.190':445
'82.##6.105.117':445
'82.##6.129.75':139
'82.##6.72.31':445
'82.##6.204.252':445
'82.##6.50.205':445
'82.##6.152.90':445
'82.##6.190.89':445
'82.##6.48.69':445
'82.##6.252.227':445
'82.##6.144.25':445
'82.##6.106.144':445
'82.##6.98.112':445
'82.##6.155.96':445
'82.##6.232.106':445
'82.##6.11.78':445
'82.##6.156.244':139
'82.##6.8.140':139
'82.##6.145.173':139
'82.##6.63.212':139
'82.##6.164.147':139
'82.##6.245.31':139
'82.##6.192.219':139
'82.##6.220.103':139
'82.##6.131.208':139
'82.##6.87.33':139
'82.##6.100.196':139
'82.##6.90.84':139
'82.##6.23.253':139
'82.##6.192.201':9988
'82.##6.218.18':139
'82.##6.194.122':139
'82.##6.124.60':9988
'82.##6.14.26':9988
'82.##6.195.121':9988
'82.##6.205.217':139
'82.##6.44.180':139
'82.##6.252.44':139
'82.##6.133.130':139
'82.##6.107.38':139
'82.##6.60.106':139
'82.##6.30.127':139
'82.##6.72.31':139
'82.##6.117.80':139
'82.##6.149.61':139
'82.##6.144.25':139
'82.##6.106.144':139
'82.##6.98.112':139
'82.##6.254.75':139
'82.##6.159.190':139
'82.##6.105.117':139
'82.##6.15.149':139
'82.##6.188.15':139
'82.##6.164.187':139
'82.##6.11.78':139
'82.##6.27.170':139
'82.##6.190.89':139
'82.##6.48.69':139
'82.##6.195.197':139
'82.##6.41.196':139
'82.##6.73.218':139
'82.##6.152.90':139
'82.##6.155.96':139
'82.##6.232.106':139
'82.##6.252.227':139
'82.##6.204.252':139
'82.##6.50.205':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней