Trojan.Starman.5946

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER13db.dir00\svchost.exe.mdmp 16325836412032204

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER13db.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'22#.#95.222.221':445
'22#.#95.151.222':139
'22#.#95.58.20':445
'22#.#95.221.217':445
'22#.#95.146.151':139
'22#.#95.63.71':139
'22#.#95.238.180':139
'22#.#95.125.109':139
'22#.#95.136.30':139
'22#.#95.211.99':445
'22#.#95.41.31':445
'22#.#95.106.231':445
'22#.#95.137.134':445
'22#.#95.79.88':445
'22#.#95.173.14':445
'22#.#95.29.106':445
'22#.#95.100.29':445
'22#.#95.90.95':445
'22#.#95.105.231':445
'22#.#95.116.1':139
'22#.#95.231.9':139
'22#.#95.75.231':139
'22#.#95.24.73':139
'22#.#95.25.91':139
'22#.#95.3.169':139
'22#.#95.46.143':139
'22#.#95.61.130':139
'22#.#95.131.44':139
'22#.#95.235.233':139
'22#.#95.131.49':139
'22#.#95.120.24':139
'22#.#95.133.161':139
'22#.#95.175.225':139
'22#.#95.25.27':139
'22#.#95.201.108':139
'22#.#95.225.183':139
'22#.#95.16.46':139
'22#.#95.178.143':139
'22#.#95.3.120':139
'22#.#95.93.46':445
'22#.#95.123.229':445
'22#.#95.207.165':445
'22#.#95.208.207':445
'22#.#95.57.196':445
'22#.#95.215.34':445
'22#.#95.53.83':445
'22#.#95.27.179':445
'22#.#95.67.206':445
'22#.#95.165.175':445
'22#.#95.25.86':445
'22#.#95.170.83':445
'22#.#95.222.221':139
'22#.#95.5.152':445
'22#.#95.214.170':445
'22#.#95.145.29':445
'22#.#95.105.163':445
'22#.#95.156.57':445
'22#.#95.95.60':445
'22#.#95.208.107':445
'22#.#95.204.61':445
'22#.#95.52.187':445
'22#.#95.123.154':445
'22#.#95.166.180':445
'22#.#95.243.211':445
'22#.#95.3.22':445
'22#.#95.134.3':445
'22#.#95.173.69':445
'22#.#95.21.173':445
'22#.#95.72.99':445
'22#.#95.119.175':445
'22#.#95.65.129':445
'22#.#95.16.50':445
'22#.#95.97.208':445
'22#.#95.34.187':445
'22#.#95.14.73':445
'22#.#95.13.160':445
'22#.#95.15.119':445
'22#.#95.155.102':445
'22#.#95.240.56':445
'22#.#95.249.139':445
'22#.#95.46.143':445
'22#.#95.61.130':445
'22#.#95.80.145':445
'22#.#95.36.95':445
'22#.#95.75.198':445
'22#.#95.144.136':445
'22#.#95.79.15':445
'22#.#95.235.233':445
'22#.#95.131.49':445
'22#.#95.24.73':445
'22#.#95.225.183':445
'22#.#95.16.46':445
'22#.#95.25.91':445
'22#.#95.3.169':445
'22#.#95.131.44':445
'22#.#95.231.9':445
'22#.#95.75.231':445
'22#.#95.166.98':445
'22#.#95.12.176':445
'22#.#95.153.150':445
'22#.#95.77.146':445
'22#.#95.25.111':445
'22#.#95.148.233':445
'22#.#95.204.216':139
'22#.#95.85.96':139
'22#.#95.184.74':445
'22#.#95.217.0':445
'22#.#95.140.125':445
'22#.#95.78.133':445
'22#.#95.245.128':445
'22#.#95.115.121':445
'22#.#95.152.33':445
'22#.#95.159.228':445
'22#.#95.63.245':445
'22#.#95.220.155':445
'22#.#95.139.168':445
'22#.#95.17.182':445
'22#.#95.159.228':139
'22#.#95.139.168':139
'22#.#95.78.133':139
'22#.#95.245.128':139
'22#.#95.17.182':139
'22#.#95.140.125':139
'22#.#95.77.146':139
'22#.#95.63.245':139
'22#.#95.220.155':139
'22#.#95.152.33':139
'22#.#95.80.145':139
'22#.#95.144.136':139
'22#.#95.240.56':139
'22#.#95.249.139':139
'22#.#95.79.15':139
'22#.#95.166.98':139
'22#.#95.115.121':139
'22#.#95.36.95':139
'22#.#95.75.198':139
'22#.#95.25.111':139
'22#.#95.175.225':445
'22#.#95.25.27':445
'22#.#95.238.180':445
'22#.#95.116.1':445
'22#.#95.120.24':445
'22#.#95.178.143':445
'22#.#95.3.120':445
'22#.#95.133.161':445
'22#.#95.201.108':445
'22#.#95.63.71':445
'22#.#95.148.233':139
'22#.#95.184.74':139
'22#.#95.12.176':139
'22#.#95.153.150':139
'22#.#95.217.0':139
'22#.#95.125.109':445
'22#.#95.136.30':445
'22#.#95.151.222':445
'22#.#95.146.151':445
'22#.#95.221.217':139
'22#.#95.113.73':445
'22#.#95.253.246':445
'22#.#95.72.204':139
'22#.#95.13.94':139
'22#.#95.4.122':445
'22#.#95.85.43':445
'22#.#95.210.84':445
'22#.#95.25.52':445
'22#.#95.52.62':445
'22#.#95.142.182':139
'22#.#95.121.121':139
'22#.#95.209.37':139
'22#.#95.63.196':139
'22#.#95.42.23':139
'22#.#95.195.89':139
'22#.#95.246.156':139
'22#.#95.84.193':139
'22#.#95.141.217':139
'22#.#95.92.193':139
'22#.#95.68.200':445
'22#.#95.124.239':445
'22#.#95.187.221':445
'22#.#95.219.168':445
'22#.#95.149.41':445
'22#.#95.70.187':445
'22#.#95.67.130':445
'22#.#95.39.67':445
'22#.#95.238.69':445
'22#.#95.72.135':445
'22#.#95.176.112':445
'22#.#95.208.57':445
'22#.#95.171.246':445
'22#.#95.54.21':445
'22#.#95.245.172':445
'22#.#95.74.22':445
'22#.#95.33.219':445
'22#.#95.209.128':445
'22#.#95.18.10':445
'22#.#95.60.23':445
'22#.#95.74.22':139
'22#.#95.18.10':139
'22#.#95.208.57':139
'22#.#95.171.246':139
'22#.#95.60.23':139
'22#.#95.176.112':139
'22#.#95.219.168':139
'22#.#95.33.219':139
'22#.#95.209.128':139
'22#.#95.245.172':139
'22#.#95.68.200':139
'22#.#95.25.52':139
'22#.#95.113.73':139
'22#.#95.4.122':139
'22#.#95.253.246':139
'22#.#95.210.84':139
'22#.#95.54.21':139
'22#.#95.52.62':139
'22#.#95.85.43':139
'22#.#95.149.41':139
'22#.#95.244.37':139
'22#.#95.113.121':139
'22#.#95.135.195':139
'22#.#95.127.135':139
'22#.#95.159.242':139
'22#.#95.167.131':139
'22#.#95.118.203':139
'22#.#95.100.178':139
'22#.#95.17.124':139
'22#.#95.194.217':139
'22#.#95.70.187':139
'22#.#95.238.69':139
'22#.#95.124.239':139
'22#.#95.187.221':139
'22#.#95.72.135':139
'22#.#95.97.251':139
'22#.#95.6.40':139
'22#.#95.67.130':139
'22#.#95.39.67':139
'22#.#95.65.129':139
'22#.#95.34.187':139
'22#.#95.97.208':139
'22#.#95.119.175':139
'22#.#95.15.119':139
'22#.#95.13.160':139
'22#.#95.72.99':139
'22#.#95.155.102':139
'22#.#95.14.73':139
'22#.#95.16.50':139
'22#.#95.123.229':139
'22#.#95.57.196':139
'22#.#95.208.207':139
'22#.#95.93.46':139
'22#.#95.27.179':139
'22#.#95.53.83':139
'22#.#95.208.107':139
'22#.#95.67.206':139
'22#.#95.215.34':139
'22#.#95.123.154':139
'22#.#95.173.14':139
'22#.#95.90.95':139
'22#.#95.41.31':139
'22#.#95.106.231':139
'22#.#95.105.231':139
'22#.#95.211.99':139
'22#.#95.58.20':139
'22#.#95.29.106':139
'22#.#95.100.29':139
'22#.#95.79.88':139
'22#.#95.52.187':139
'22#.#95.243.211':139
'22#.#95.166.180':139
'22#.#95.204.61':139
'22#.#95.173.69':139
'22#.#95.134.3':139
'22#.#95.137.134':139
'22#.#95.21.173':139
'22#.#95.3.22':139
'22#.#95.63.196':445
'22#.#95.42.23':445
'22#.#95.167.131':445
'22#.#95.118.203':445
'22#.#95.121.121':445
'22#.#95.141.217':445
'22#.#95.92.193':445
'22#.#95.209.37':445
'22#.#95.195.89':445
'22#.#95.17.124':445
'22#.#95.194.217':445
'22#.#95.135.195':445
'22#.#95.6.40':445
'22#.#95.97.251':445
'22#.#95.127.135':445
'22#.#95.159.242':445
'22#.#95.100.178':445
'22#.#95.244.37':445
'22#.#95.113.121':445
'22#.#95.246.156':445
'22#.#95.214.170':139
'22#.#95.156.57':139
'22#.#95.25.86':139
'22#.#95.170.83':139
'22#.#95.95.60':139
'22#.#95.165.175':139
'22#.#95.207.165':139
'22#.#95.145.29':139
'22#.#95.105.163':139
'22#.#95.5.152':139
'22#.#95.72.204':445
'22#.#95.13.94':445
'22#.#95.84.193':445
'22#.#95.142.182':445
'22#.#95.97.251':9988
'22#.#95.219.168':9988
'22#.#95.67.130':9988
'22#.#95.253.246':9988
'22#.#95.209.37':9988

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней