Trojan.DownLoader10.8655

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER847a.dir00\svchost.exe.mdmp 16325836412032548

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER847a.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'22#.#11.242.152':139
'22#.#11.140.250':139
'22#.#11.80.96':139
'22#.#11.153.132':139
'22#.#11.6.191':139
'22#.#11.150.205':139
'22#.#11.190.145':139
'22#.#11.235.47':139
'22#.#11.143.179':139
'22#.#11.194.143':139
'22#.#11.180.20':139
'22#.#11.81.128':139
'22#.#11.62.227':139
'22#.#11.79.220':139
'22#.#11.154.184':445
'22#.#11.189.138':445
'22#.#11.31.47':139
'22#.#11.127.49':139
'22#.#11.32.2':139
'22#.#11.31.208':139
'22#.#11.87.113':139
'22#.#11.70.18':139
'22#.#11.155.235':139
'22#.#11.3.111':445
'22#.#11.34.111':445
'22#.#11.204.46':445
'22#.#11.155.98':445
'22#.#11.167.56':445
'22#.#11.55.86':445
'22#.#11.37.185':445
'22#.#11.84.101':445
'22#.#11.216.21':445
'22#.#11.248.18':445
'22#.#11.3.248':445
'22#.#11.98.119':139
'22#.#11.63.90':139
'22#.#11.177.90':139
'22#.#11.239.155':139
'22#.#11.255.175':139
'22#.#11.169.216':139
'22#.#11.39.13':139
'22#.#11.40.43':139
'22#.#11.233.79':139
'22#.#11.171.9':139
'22#.#11.121.184':139
'22#.#11.103.228':445
'22#.#11.100.244':445
'22#.#11.210.245':445
'22#.#11.79.204':445
'22#.#11.88.105':445
'22#.#11.24.152':445
'22#.#11.13.48':445
'22#.#11.163.176':445
'22#.#11.241.114':445
'22#.#11.39.119':445
'22#.#11.134.144':445
'22#.#11.40.244':445
'22#.#11.11.120':445
'22#.#11.241.240':445
'22#.#11.55.138':445
'22#.#11.108.193':445
'22#.#11.71.204':445
'22#.#11.37.50':445
'22#.#11.206.50':445
'22#.#11.215.25':445
'22#.#11.71.79':445
'22#.#11.43.178':445
'22#.#11.178.101':445
'22#.#11.122.79':139
'22#.#11.216.21':139
'22#.#11.37.185':139
'22#.#11.3.248':139
'22#.#11.55.86':139
'22#.#11.248.18':139
'22#.#11.84.101':139
'22#.#11.74.176':445
'22#.#11.19.53':445
'22#.#11.16.240':445
'22#.#11.220.133':139
'22#.#11.122.79':445
'22#.#11.189.138':139
'22#.#11.74.176':139
'22#.#11.154.184':139
'22#.#11.16.240':139
'22#.#11.19.53':139
'22#.#11.103.228':139
'22#.#11.3.111':139
'22#.#11.34.111':139
'22#.#11.204.46':139
'22#.#11.155.98':139
'22#.#11.167.56':139
'22#.#11.47.202':139
'22#.#11.99.119':139
'22#.#11.238.219':139
'22#.#11.179.113':139
'22#.#11.114.45':139
'22#.#11.26.90':139
'22#.#11.134.160':139
'22#.#11.26.170':139
'22#.#11.85.252':139
'22#.#11.27.140':139
'22#.#11.11.116':139
'22#.#11.211.33':139
'22#.#11.184.174':139
'22#.#11.218.224':139
'22#.#11.32.69':445
'22#.#11.12.130':139
'22#.#11.116.4':139
'22#.#11.185.44':139
'22#.#11.6.16':139
'22#.#11.231.2':139
'22#.#11.4.39':139
'22#.#11.85.53':139
'22#.#11.211.163':139
'22#.#11.92.156':139
'22#.#11.32.191':139
'22#.#11.143.85':139
'22#.#11.53.12':139
'22#.#11.85.141':139
'22#.#11.73.55':139
'22#.#11.26.170':445
'22#.#11.102.234':445
'22#.#11.42.204':139
'22#.#11.79.87':139
'22#.#11.82.158':139
'22#.#11.20.232':139
'22#.#11.32.45':139
'22#.#11.17.91':139
'22#.#11.77.91':139
'22#.#11.100.190':139
'22#.#11.234.239':139
'22#.#11.13.92':139
'22#.#11.40.51':139
'22#.#11.252.6':139
'22#.#11.102.234':139
'22#.#11.141.102':139
'22#.#11.135.91':445
'22#.#11.80.96':445
'22#.#11.190.145':445
'22#.#11.155.235':445
'22#.#11.242.152':445
'22#.#11.140.250':445
'22#.#11.235.47':445
'22#.#11.143.179':445
'22#.#11.180.20':445
'22#.#11.6.191':445
'22#.#11.255.175':445
'22#.#11.239.155':445
'22#.#11.31.208':445
'22#.#11.87.113':445
'22#.#11.81.128':445
'22#.#11.220.133':445
'22#.#11.79.220':445
'22#.#11.32.2':445
'22#.#11.127.49':445
'22#.#11.153.132':445
'22#.#11.62.227':445
'22#.#11.70.18':445
'22#.#11.31.47':445
'22#.#11.194.143':445
'22#.#11.137.5':139
'22#.#11.135.91':139
'22#.#11.118.167':139
'22#.#11.34.250':139
'22#.#11.187.107':139
'22#.#11.32.69':139
'22#.#11.118.167':445
'22#.#11.137.5':445
'22#.#11.241.108':445
'22#.#11.34.250':445
'22#.#11.187.107':445
'22#.#11.63.90':445
'22#.#11.169.216':445
'22#.#11.98.119':445
'22#.#11.177.90':445
'22#.#11.150.205':445
'22#.#11.171.9':445
'22#.#11.40.43':445
'22#.#11.241.108':139
'22#.#11.39.13':445
'22#.#11.233.79':445
'22#.#11.121.184':445
'22#.#11.43.77':445
'22#.#11.7.18':445
'22#.#11.77.197':445
'22#.#11.121.44':445
'22#.#11.32.30':445
'22#.#11.222.187':445
'22#.#11.84.186':445
'22#.#11.38.239':445
'22#.#11.25.203':445
'22#.#11.97.65':445
'22#.#11.158.150':445
'22#.#11.168.76':445
'22#.#11.134.138':139
'22#.#11.43.212':139
'22#.#11.160.196':139
'22#.#11.62.230':139
'22#.#11.196.168':139
'22#.#11.201.90':445
'22#.#11.125.205':445
'22#.#11.30.80':445
'22#.#11.155.146':445
'22#.#11.200.125':445
'22#.#11.168.14':445
'22#.#11.222.1':445
'22#.#11.48.155':445
'22#.#11.129.59':445
'22#.#11.30.193':445
'22#.#11.141.56':445
'22#.#11.192.141':445
'22#.#11.44.71':445
'22#.#11.230.72':445
'22#.#11.218.229':445
'22#.#11.12.178':445
'22#.#11.90.109':445
'22#.#11.5.87':445
'22#.#11.168.22':445
'22#.#11.93.167':445
'22#.#11.221.78':445
'22#.#11.166.203':445
'22#.#11.201.88':445
'22#.#11.191.93':445
'22#.#11.227.88':445
'22#.#11.56.243':445
'22#.#11.105.201':445
'22#.#11.90.191':445
'22#.#11.94.233':445
'22#.#11.32.9':139
'22#.#11.97.65':139
'22#.#11.38.239':139
'22#.#11.168.76':139
'22#.#11.84.186':139
'22#.#11.158.150':139
'22#.#11.25.203':139
'22#.#11.221.78':139
'22#.#11.168.22':139
'22#.#11.201.88':139
'22#.#11.222.1':139
'22#.#11.166.203':139
'22#.#11.155.146':139
'22#.#11.125.205':139
'22#.#11.168.14':139
'22#.#11.201.90':139
'22#.#11.200.125':139
'22#.#11.32.30':139
'22#.#11.7.18':139
'22#.#11.77.197':139
'22#.#11.121.44':139
'22#.#11.30.80':139
'22#.#11.222.187':139
'22#.#11.93.167':139
'22#.#11.12.178':139
'22#.#11.230.72':139
'22#.#11.5.87':139
'22#.#11.44.71':139
'22#.#11.90.109':139
'22#.#11.218.229':139
'22#.#11.180.1':139
'22#.#11.109.229':139
'22#.#11.17.24':139
'22#.#11.11.15':139
'22#.#11.131.123':139
'22#.#11.105.201':139
'22#.#11.227.88':139
'22#.#11.94.233':139
'22#.#11.191.93':139
'22#.#11.90.191':139
'22#.#11.56.243':139
'22#.#11.48.155':139
'22#.#11.129.59':139
'22#.#11.30.193':139
'22#.#11.141.56':139
'22#.#11.192.141':139
'22#.#11.55.138':139
'22#.#11.88.105':139
'22#.#11.71.204':139
'22#.#11.43.77':139
'22#.#11.108.193':139
'22#.#11.37.50':139
'22#.#11.215.25':139
'22#.#11.100.244':139
'22#.#11.241.240':139
'22#.#11.11.120':139
'22#.#11.206.50':139
'22#.#11.244.216':139
'22#.#11.79.237':139
'22#.#11.212.81':139
'22#.#11.58.135':139
'22#.#11.129.188':139
'22#.#11.69.130':139
'22#.#11.79.43':139
'22#.#11.244.20':139
'22#.#11.191.234':139
'22#.#11.167.77':139
'22#.#11.221.204':139
'22#.#11.178.101':139
'22#.#11.58.135':445
'22#.#11.69.130':445
'22#.#11.244.216':445
'22#.#11.79.237':445
'22#.#11.212.81':445
'22#.#11.191.234':445
'22#.#11.79.43':445
'22#.#11.244.20':445
'22#.#11.221.204':445
'22#.#11.167.77':445
'22#.#11.129.188':445
'22#.#11.71.79':139
'22#.#11.163.176':139
'22#.#11.39.119':139
'22#.#11.43.178':139
'22#.#11.24.152':139
'22#.#11.40.244':139
'22#.#11.134.144':139
'22#.#11.13.48':139
'22#.#11.210.245':139
'22#.#11.79.204':139
'22#.#11.241.114':139
'22#.#11.168.14':9988
'22#.#11.201.88':9988
'22#.#11.30.193':9988
'22#.#11.125.205':9988
'22#.#11.93.167':9988
'22#.#11.222.187':9988
'22#.#11.97.65':9988
'22#.#11.200.125':9988
'22#.#11.166.203':9988
'22#.#11.32.30':9988
'22#.#11.56.243':9988
'22#.#11.77.197':9988
'22#.#11.180.1':445
'22#.#11.109.229':445
'22#.#11.131.123':445
'22#.#11.11.15':445
'22#.#11.17.24':445
'22#.#11.32.9':445
'22#.#11.134.138':445
'22#.#11.43.212':445
'22#.#11.160.196':445
'22#.#11.62.230':445
'22#.#11.196.168':445
'22#.#11.201.90':9988
'22#.#11.44.71':9988
'22#.#11.62.230':9988
'22#.#11.134.138':9988
'22#.#11.5.87':9988
'22#.#11.109.229':9988
'22#.#11.227.88':9988
'22#.#11.7.18':9988
'22#.#11.168.22':9988
'22#.#11.221.78':9988
'22#.#11.141.56':9988
'22#.#11.90.109':9988
'22#.#11.180.1':9988
'22#.#11.12.178':9988
'22#.#11.131.123':9988
'22#.#11.218.229':9988
'22#.#11.17.24':9988
'22#.#11.196.168':9988
'22#.#11.43.212':9988
'22#.#11.11.15':9988
'22#.#11.48.155':9988
'22#.#11.160.196':9988
'22#.#11.129.59':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней