Trojan.DownLoader12.29120

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERc547.dir00\svchost.exe.mdmp 16325836412027932

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERc547.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'21#.#2.58.181':139
'21#.#2.161.4':139
'21#.#2.2.151':139
'21#.#2.248.214':139
'21#.#2.252.151':139
'21#.#2.25.253':139
'21#.#2.20.151':139
'21#.#2.202.76':139
'21#.#2.87.202':139
'21#.#2.90.83':445
'21#.#2.120.124':139
'21#.#2.168.81':139
'21#.#2.223.35':139
'21#.#2.4.184':139
'21#.#2.74.253':445
'21#.#2.242.26':445
'21#.#2.42.240':445
'21#.#2.162.130':445
'21#.#2.130.95':445
'21#.#2.167.36':445
'21#.#2.221.33':445
'21#.#2.90.83':139
'21#.#2.142.143':139
'21#.#2.18.64':139
'21#.#2.26.150':445
'21#.#2.90.49':445
'21#.#2.51.92':445
'21#.#2.200.207':139
'21#.#2.6.216':139
'21#.#2.222.154':139
'21#.#2.87.202':445
'21#.#2.165.84':139
'21#.#2.176.93':139
'21#.#2.44.225':139
'21#.#2.207.138':139
'21#.#2.33.220':139
'21#.#2.67.202':139
'21#.#2.174.155':139
'21#.#2.221.166':139
'21#.#2.6.118':139
'21#.#2.202.76':445
'21#.#2.248.214':445
'21#.#2.252.151':445
'21#.#2.25.253':445
'21#.#2.142.143':445
'21#.#2.18.64':445
'21#.#2.4.184':445
'21#.#2.58.181':445
'21#.#2.120.124':445
'21#.#2.168.81':445
'21#.#2.223.35':445
'21#.#2.161.4':445
'21#.#2.2.151':445
'21#.#2.20.151':445
'21#.#2.95.134':139
'21#.#2.130.95':139
'21#.#2.162.130':139
'21#.#2.111.82':139
'21#.#2.197.132':139
'21#.#2.134.134':139
'21#.#2.73.184':139
'21#.#2.42.240':139
'21#.#2.221.33':139
'21#.#2.26.150':139
'21#.#2.167.36':139
'21#.#2.74.253':139
'21#.#2.242.26':139
'21#.#2.38.74':139
'21#.#2.13.145':139
'21#.#2.35.169':139
'21#.#2.162.112':139
'21#.#2.186.20':139
'21#.#2.117.214':139
'21#.#2.148.74':139
'21#.#2.234.162':139
'21#.#2.119.212':139
'21#.#2.196.247':139
'21#.#2.192.218':139
'21#.#2.160.234':139
'21#.#2.252.7':139
'21#.#2.19.248':139
'21#.#2.19.248':445
'21#.#2.119.212':445
'21#.#2.196.247':445
'21#.#2.234.162':445
'21#.#2.160.234':445
'21#.#2.252.7':445
'21#.#2.192.218':445
'21#.#2.95.134':445
'21#.#2.197.132':445
'21#.#2.73.184':445
'21#.#2.38.74':445
'21#.#2.111.82':445
'21#.#2.134.134':445
'21#.#2.162.112':445
'21#.#2.31.104':445
'21#.#2.63.31':445
'21#.#2.80.63':445
'21#.#2.90.49':139
'21#.#2.51.92':139
'21#.#2.103.177':445
'21#.#2.29.80':445
'21#.#2.148.74':445
'21#.#2.13.145':445
'21#.#2.35.169':445
'21#.#2.198.168':445
'21#.#2.186.20':445
'21#.#2.117.214':445
'21#.#2.83.67':139
'21#.#2.145.82':139
'21#.#2.200.68':139
'21#.#2.163.249':445
'21#.#2.187.217':139
'21#.12.9.39':139
'21#.#2.239.178':139
'21#.#2.25.164':445
'21#.#2.159.211':445
'21#.#2.153.237':445
'21#.#2.151.153':445
'21#.12.31.3':445
'21#.#2.187.232':445
'21#.#2.150.248':445
'21#.#2.217.193':139
'21#.#2.163.249':139
'21#.#2.25.164':139
'21#.12.31.3':139
'21#.#2.158.110':445
'21#.#2.143.221':445
'21#.#2.249.143':445
'21#.#2.187.232':139
'21#.#2.151.153':139
'21#.#2.147.227':139
'21#.12.1.28':139
'21#.#2.150.248':139
'21#.#2.159.211':139
'21#.#2.153.237':139
'21#.#2.67.195':139
'21#.#2.31.68':139
'21#.#2.235.30':139
'21#.#2.108.12':139
'21#.#2.4.159':139
'21#.#2.216.166':139
'21#.#2.216.124':139
'21#.#2.110.226':139
'21#.#2.136.110':139
'21#.12.4.10':139
'21#.#2.132.109':139
'21#.#2.169.162':139
'21#.#2.225.200':139
'21#.#2.199.250':139
'21#.#2.187.217':445
'21#.12.9.39':445
'21#.#2.239.178':445
'21#.#2.147.227':445
'21#.12.1.28':445
'21#.#2.217.193':445
'21#.#2.145.82':445
'21#.#2.60.208':139
'21#.#2.77.111':139
'21#.#2.98.105':139
'21#.#2.200.68':445
'21#.#2.35.103':139
'21#.#2.205.180':139
'21#.#2.53.135':139
'21#.#2.112.63':139
'21#.#2.158.110':139
'21#.#2.64.180':139
'21#.#2.99.180':139
'21#.#2.133.232':139
'21#.#2.143.221':139
'21#.#2.200.207':445
'21#.#2.6.216':445
'21#.#2.222.154':445
'21#.#2.249.143':139
'21#.#2.165.84':445
'21#.#2.176.93':445
'21#.#2.32.173':139
'21#.#2.81.176':139
'21#.#2.166.97':139
'21#.#2.65.133':139
'21#.#2.125.165':139
'21#.#2.74.86':139
'21#.#2.133.115':139
'21#.#2.123.239':139
'21#.#2.234.237':139
'21#.#2.180.249':139
'21#.#2.88.147':139
'21#.#2.202.15':139
'21#.#2.76.70':139
'21#.#2.92.16':139
'21#.#2.92.16':445
'21#.#2.234.237':445
'21#.#2.180.249':445
'21#.#2.123.239':445
'21#.#2.202.15':445
'21#.#2.76.70':445
'21#.#2.88.147':445
'21#.#2.133.232':445
'21#.#2.53.135':445
'21#.#2.112.63':445
'21#.#2.32.173':445
'21#.#2.64.180':445
'21#.#2.99.180':445
'21#.#2.65.133':445
'21#.#2.6.118':445
'21#.#2.207.138':445
'21#.#2.33.220':445
'21#.#2.44.225':445
'21#.#2.174.155':445
'21#.#2.221.166':445
'21#.#2.67.202':445
'21#.#2.133.115':445
'21#.#2.81.176':445
'21#.#2.166.97':445
'21#.#2.83.67':445
'21#.#2.125.165':445
'21#.#2.74.86':445
'21#.#2.198.168':139
'21#.#2.254.225':445
'21#.#2.195.151':445
'21#.#2.134.1':445
'21#.#2.123.69':445
'21#.#2.163.222':445
'21#.#2.64.44':445
'21#.#2.182.22':445
'21#.#2.18.246':445
'21#.#2.49.19':445
'21#.#2.14.199':445
'21#.12.10.0':445
'21#.#2.21.252':445
'21#.#2.246.133':445
'21#.#2.34.211':445
'21#.#2.166.69':445
'21#.#2.168.34':445
'21#.#2.249.177':445
'21#.12.2.47':445
'21#.#2.214.248':445
'21#.#2.90.12':445
'21#.#2.197.124':445
'21#.#2.6.153':445
'21#.#2.20.212':445
'21#.#2.152.21':445
'21#.12.1.55':445
'21#.#2.79.249':445
'21#.#2.205.18':445
'21#.#2.145.96':445
'21#.#2.137.222':445
'21#.#2.44.91':445
'21#.#2.130.82':445
'21#.#2.128.67':445
'21#.#2.55.166':445
'21#.#2.178.218':445
'21#.#2.6.153':9988
'21#.#2.163.222':9988
'21#.#2.134.1':9988
'21#.#2.79.249':9988
'21#.12.1.55':9988
'21#.#2.205.18':9988
'21#.#2.98.85':445
'21#.#2.239.200':445
'21#.#2.110.246':445
'21#.#2.191.165':445
'21#.#2.201.3':445
'21#.#2.38.140':445
'21#.#2.50.160':445
'21#.#2.137.57':445
'21#.#2.70.81':445
'21#.#2.13.175':445
'21#.#2.27.209':445
'21#.#2.125.38':445
'21#.#2.65.106':445
'21#.#2.94.97':445
'21#.#2.123.69':139
'21#.#2.163.222':139
'21#.#2.64.44':139
'21#.#2.20.212':139
'21#.#2.152.21':139
'21#.#2.34.211':139
'21#.#2.254.225':139
'21#.12.10.0':139
'21#.#2.21.252':139
'21#.#2.246.133':139
'21#.#2.195.151':139
'21#.#2.134.1':139
'21#.#2.182.22':139
'21#.#2.6.153':139
'21#.12.2.47':139
'21#.#2.33.170':139
'21#.#2.123.121':139
'21#.#2.87.109':139
'21#.#2.90.12':139
'21#.#2.168.34':139
'21#.#2.214.248':139
'21#.12.1.55':139
'21#.#2.79.249':139
'21#.#2.205.18':139
'21#.#2.166.69':139
'21#.#2.249.177':139
'21#.#2.197.124':139
'21#.#2.130.82':139
'21#.#2.128.67':139
'21#.#2.55.166':139
'21#.#2.13.175':139
'21#.#2.27.209':139
'21#.#2.98.85':139
'21#.#2.145.96':139
'21#.#2.123.121':445
'21#.#2.33.170':445
'21#.#2.87.109':445
'21#.#2.137.222':139
'21#.#2.44.91':139
'21#.#2.178.218':139
'21#.#2.70.81':139
'21#.#2.38.140':139
'21#.#2.201.3':139
'21#.#2.239.200':139
'21#.#2.18.246':139
'21#.#2.49.19':139
'21#.#2.14.199':139
'21#.#2.50.160':139
'21#.#2.125.38':139
'21#.#2.65.106':139
'21#.#2.94.97':139
'21#.#2.110.246':139
'21#.#2.191.165':139
'21#.#2.137.57':139
'21#.#2.21.252':9988
'21#.#2.94.184':139
'21#.#2.32.222':139
'21#.#2.186.185':139
'21#.#2.132.170':445
'21#.#2.249.245':445
'21#.#2.196.85':445
'21#.#2.12.187':139
'21#.#2.46.27':139
'21#.#2.126.157':139
'21#.#2.88.126':139
'21#.#2.21.165':139
'21#.#2.78.12':139
'21#.#2.189.27':139
'21#.#2.14.66':445
'21#.#2.95.211':445
'21#.#2.103.137':445
'21#.12.3.9':445
'21#.#2.40.23':445
'21#.#2.157.143':445
'21#.#2.28.157':445
'21#.#2.173.178':445
'21#.#2.218.46':445
'21#.#2.73.42':445
'21#.#2.240.40':445
'21#.#2.85.174':445
'21#.#2.207.31':445
'21#.#2.93.160':445
'21#.#2.39.40':445
'21#.#2.70.151':445
'21#.#2.126.92':445
'21#.#2.126.157':445
'21#.#2.88.126':445
'21#.#2.90.91':445
'21#.#2.105.86':445
'21#.#2.63.31':139
'21#.#2.80.63':139
'21#.#2.29.80':139
'21#.#2.177.104':445
'21#.#2.103.177':139
'21#.#2.31.104':139
'21#.#2.46.27':445
'21#.#2.126.92':139
'21#.#2.105.86':139
'21#.#2.177.104':139
'21#.#2.90.91':139
'21#.#2.39.40':139
'21#.#2.70.151':139
'21#.#2.94.184':445
'21#.#2.21.165':445
'21#.#2.78.12':445
'21#.#2.189.27':445
'21#.#2.32.222':445
'21#.#2.186.185':445
'21#.#2.12.187':445
'21#.#2.165.191':139
'21#.#2.91.58':139
'21#.#2.40.23':139
'21#.#2.28.82':139
'21#.#2.161.28':139
'21#.#2.49.48':139
'21#.#2.157.143':139
'21#.12.3.9':139
'21#.#2.173.178':139
'21#.#2.85.174':139
'21#.#2.28.157':139
'21#.#2.95.211':139
'21#.#2.103.137':139
'21#.#2.82.235':139
'21#.#2.141.213':139
'21#.#2.36.117':139
'21#.#2.76.211':139
'21#.#2.14.199':9988
'21#.#2.104.189':139
'21#.#2.52.40':139
'21#.#2.153.76':139
'21#.#2.51.197':139
'21#.#2.156.139':139
'21#.#2.154.103':139
'21#.#2.15.154':139
'21#.#2.122.128':139
'21#.#2.32.93':139
'21#.#2.32.93':445
'21#.#2.51.197':445
'21#.#2.156.139':445
'21#.#2.153.76':445
'21#.#2.15.154':445
'21#.#2.122.128':445
'21#.#2.154.103':445
'21#.#2.49.48':445
'21#.#2.165.191':445
'21#.#2.91.58':445
'21#.#2.82.235':445
'21#.#2.28.82':445
'21#.#2.161.28':445
'21#.#2.76.211':445
'21#.#2.73.42':139
'21#.#2.240.40':139
'21#.#2.14.66':139
'21#.#2.207.31':139
'21#.#2.93.160':139
'21#.#2.218.46':139
'21#.#2.132.170':139
'21#.#2.52.40':445
'21#.#2.141.213':445
'21#.#2.36.117':445
'21#.#2.249.245':139
'21#.#2.196.85':139
'21#.#2.104.189':445

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней