Trojan.DownLoader12.28973

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER0394.dir00\svchost.exe.mdmp 16325836412032304

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'14#.#3.28.202':445
'14#.#3.146.225':445
'14#.#3.47.106':445
'14#.#3.201.206':445
'14#.#3.219.27':445
'14#.#3.86.192':445
'14#.#3.35.158':445
'14#.#3.152.218':445
'14#.#3.30.53':445
'14#.43.7.16':445
'14#.#3.136.56':445
'14#.#3.126.139':445
'14#.#3.40.171':445
'14#.#3.237.254':445
'14#.#3.219.126':445
'14#.#3.147.222':445
'14#.#3.168.139':445
'14#.#3.66.108':445
'14#.#3.31.96':445
'14#.#3.151.21':445
'14#.#3.182.47':445
'14#.#3.175.233':445
'14#.#3.53.92':445
'14#.#3.37.162':445
'14#.#3.103.94':445
'14#.#3.152.32':445
'14#.#3.169.189':445
'14#.#3.57.224':445
'14#.#3.99.87':445
'14#.#3.52.249':445
'14#.#3.99.247':445
'14#.#3.111.75':445
'14#.#3.210.150':445
'14#.#3.109.201':445
'14#.#3.208.2':445
'14#.#3.209.229':445
'14#.#3.12.41':445
'14#.43.50.1':445
'14#.#3.130.196':445
'14#.#3.208.2':139
'14#.43.50.1':139
'14#.#3.99.247':139
'14#.#3.111.75':139
'14#.#3.130.196':139
'14#.#3.52.249':139
'14#.#3.53.92':139
'14#.#3.209.229':139
'14#.#3.12.41':139
'14#.#3.109.201':139
'14#.#3.219.27':139
'14#.#3.152.218':139
'14#.#3.28.202':139
'14#.#3.146.225':139
'14#.#3.30.53':139
'14#.#3.151.21':139
'14#.#3.210.150':139
'14#.#3.86.192':139
'14#.#3.35.158':139
'14#.#3.37.162':139
'14#.#3.64.192':445
'14#.#3.124.10':445
'14#.#3.148.206':445
'14#.#3.69.232':445
'14#.#3.134.160':445
'14#.#3.194.177':445
'14#.#3.33.17':445
'14#.#3.127.134':445
'14#.#3.194.126':445
'14#.#3.3.209':445
'14#.#3.103.94':139
'14#.#3.57.224':139
'14#.#3.182.47':139
'14#.#3.175.233':139
'14#.#3.99.87':139
'14#.#3.184.11':139
'14#.#3.169.183':139
'14#.#3.152.32':139
'14#.#3.169.189':139
'14#.#3.195.1':139
'14#.#3.23.71':139
'14#.#3.141.46':139
'14#.#3.165.141':139
'14#.#3.220.109':445
'14#.#3.79.130':445
'14#.#3.76.35':445
'14#.#3.8.107':445
'14#.#3.255.111':445
'14#.43.2.63':139
'14#.#3.147.64':139
'14#.#3.240.55':139
'14#.#3.134.30':139
'14#.#3.55.102':139
'14#.#3.149.15':139
'14#.#3.28.152':139
'14#.#3.76.189':139
'14#.#3.145.219':139
'14#.#3.91.128':139
'14#.#3.45.51':445
'14#.#3.71.193':445
'14#.#3.250.62':445
'14#.#3.39.129':445
'14#.#3.194.38':445
'14#.#3.45.65':445
'14#.#3.37.125':445
'14#.#3.128.28':445
'14#.#3.102.144':445
'14#.#3.125.24':445
'14#.#3.206.177':445
'14#.#3.224.220':445
'14#.#3.173.245':445
'14#.#3.248.169':445
'14#.#3.241.37':445
'14#.#3.30.11':445
'14#.#3.124.159':445
'14#.#3.169.45':445
'14#.#3.210.29':445
'14#.#3.196.208':445
'14#.#3.30.11':139
'14#.#3.210.29':139
'14#.#3.224.220':139
'14#.#3.173.245':139
'14#.#3.196.208':139
'14#.#3.206.177':139
'14#.#3.39.129':139
'14#.#3.124.159':139
'14#.#3.169.45':139
'14#.#3.241.37':139
'14#.#3.220.109':139
'14#.#3.8.107':139
'14#.#3.184.11':445
'14#.#3.169.183':445
'14#.#3.255.111':139
'14#.#3.45.51':139
'14#.#3.248.169':139
'14#.#3.79.130':139
'14#.#3.76.35':139
'14#.#3.194.38':139
'14#.#3.195.55':139
'14#.#3.165.229':139
'14#.#3.175.247':139
'14#.#3.114.245':139
'14#.#3.216.24':139
'14#.#3.153.110':139
'14#.#3.63.127':139
'14#.#3.240.148':139
'14#.#3.110.234':139
'14#.#3.240.78':139
'14#.#3.45.65':139
'14#.#3.102.144':139
'14#.#3.71.193':139
'14#.#3.250.62':139
'14#.#3.125.24':139
'14#.#3.245.210':139
'14#.#3.143.158':139
'14#.#3.37.125':139
'14#.#3.128.28':139
'14#.#3.201.206':139
'14#.#3.122.87':445
'14#.#3.100.139':445
'14#.#3.20.166':139
'14#.#3.101.20':139
'14#.#3.155.117':445
'14#.#3.8.116':445
'14#.#3.69.216':445
'14#.#3.156.98':445
'14#.#3.149.62':445
'14#.#3.166.21':139
'14#.#3.16.217':139
'14#.#3.64.61':139
'14#.#3.61.219':139
'14#.#3.217.115':139
'14#.#3.121.244':139
'14#.#3.41.243':139
'14#.#3.109.69':139
'14#.#3.37.177':139
'14#.#3.143.52':139
'14#.43.7.20':445
'14#.#3.156.189':445
'14#.#3.16.99':445
'14#.#3.133.186':445
'14#.#3.63.19':445
'14#.#3.28.16':445
'14#.#3.145.31':445
'14#.#3.5.133':445
'14#.#3.26.28':445
'14#.#3.204.25':445
'14#.#3.195.158':445
'14#.#3.217.166':445
'14#.#3.23.148':445
'14#.#3.100.115':445
'14#.#3.164.158':445
'14#.#3.38.120':445
'14#.#3.201.19':445
'14#.43.2.87':445
'14#.#3.218.133':445
'14#.#3.126.80':445
'14#.#3.38.120':139
'14#.#3.218.133':139
'14#.#3.217.166':139
'14#.#3.23.148':139
'14#.#3.126.80':139
'14#.#3.195.158':139
'14#.#3.133.186':139
'14#.#3.201.19':139
'14#.43.2.87':139
'14#.#3.164.158':139
'14#.#3.155.117':139
'14#.#3.156.98':139
'14#.#3.122.87':139
'14#.#3.100.139':139
'14#.#3.149.62':139
'14#.43.7.20':139
'14#.#3.100.115':139
'14#.#3.8.116':139
'14#.#3.69.216':139
'14#.#3.63.19':139
'14#.#3.59.194':139
'14#.#3.130.213':139
'14#.#3.69.213':139
'14#.#3.93.114':139
'14#.#3.27.64':139
'14#.#3.19.244':139
'14#.#3.145.241':139
'14#.#3.62.168':139
'14#.#3.244.25':139
'14#.#3.123.160':139
'14#.#3.28.16':139
'14#.#3.26.28':139
'14#.#3.156.189':139
'14#.#3.16.99':139
'14#.#3.204.25':139
'14#.#3.195.5':139
'14#.#3.203.198':139
'14#.#3.145.31':139
'14#.#3.5.133':139
'14#.#3.39.38':139
'14#.#3.75.217':445
'14#.#3.32.57':139
'14#.#3.38.32':139
'14#.#3.56.120':445
'14#.#3.39.38':445
'14#.#3.3.209':139
'14#.#3.32.57':445
'14#.#3.38.32':445
'14#.#3.56.120':139
'14#.#3.19.244':9988
'14#.#3.61.219':9988
'14#.#3.69.213':9988
'14#.#3.27.64':9988
'14#.#3.121.244':9988
'14#.#3.20.166':9988
'14#.#3.75.217':139
'14#.#3.37.177':9988
'14#.#3.166.21':9988
'14#.#3.148.206':139
'14#.#3.219.126':139
'14#.#3.66.108':139
'14#.#3.136.56':139
'14#.#3.126.139':139
'14#.#3.31.96':139
'14#.43.7.16':139
'14#.#3.47.106':139
'14#.#3.147.222':139
'14#.#3.168.139':139
'14#.#3.237.254':139
'14#.#3.124.10':139
'14#.#3.134.160':139
'14#.#3.69.232':139
'14#.#3.64.192':139
'14#.#3.127.134':139
'14#.#3.33.17':139
'14#.#3.40.171':139
'14#.#3.194.126':139
'14#.#3.194.177':139
'14#.#3.61.219':445
'14#.#3.217.115':445
'14#.#3.19.244':445
'14#.#3.145.241':445
'14#.#3.16.217':445
'14#.#3.37.177':445
'14#.#3.143.52':445
'14#.#3.64.61':445
'14#.#3.121.244':445
'14#.#3.244.25':445
'14#.#3.123.160':445
'14#.#3.69.213':445
'14#.#3.195.5':445
'14#.#3.203.198':445
'14#.#3.93.114':445
'14#.#3.27.64':445
'14#.#3.62.168':445
'14#.#3.59.194':445
'14#.#3.130.213':445
'14#.#3.41.243':445
'14#.#3.38.120':9988
'14#.#3.218.133':9988
'14#.#3.164.158':9988
'14#.#3.23.148':9988
'14#.#3.126.80':9988
'14#.#3.63.19':9988
'14#.#3.28.16':9988
'14#.#3.201.19':9988
'14#.43.2.87':9988
'14#.#3.100.115':9988
'14#.#3.20.166':445
'14#.#3.101.20':445
'14#.#3.109.69':445
'14#.#3.166.21':445
'14#.#3.100.139':9988
'14#.#3.69.216':9988
'14#.43.7.20':9988
'14#.#3.156.98':9988
'14#.#3.149.62':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней