Trojan.DownLoader10.9260

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER8769.dir00\svchost.exe.mdmp 16325836412028708

Modifies file system :

Creates the following files:

<SYSTEM32>\oobe\setup\crjrhltv.exe
<SYSTEM32>\oobe\icserror\vcejlxkt.exe
<SYSTEM32>\oobe\setup\kjqkxtnz.exe
<SYSTEM32>\oobe\setup\esjhxblq.exe
<SYSTEM32>\oobe\actsetup\zvswnlev.exe
%TEMP%\WER8769.dir00\svchost.exe.mdmp
<SYSTEM32>\urdvxc.exe
<SYSTEM32>\oobe\actsetup\vrrkkhbn.exe
<SYSTEM32>\oobe\actsetup\nzzwhebn.exe

Deletes itself.

Network activity:

Connects to:

'66.##4.111.84':139
'66.##4.199.176':139
'66.##4.89.134':139
'66.##4.17.142':139
'66.##4.109.16':139
'66.##4.16.112':139
'66.##4.122.54':139
'66.##4.248.47':139
'66.##4.103.2':139
'66.##4.10.29':139
'66.##4.191.180':139
'66.##4.184.8':139
'66.##4.227.145':139
'66.##4.73.96':139
'66.##4.226.219':139
'66.#34.45.1':139
'66.##4.15.186':139
'66.##4.175.235':139
'66.##4.14.161':139
'66.##4.178.242':139
'66.##4.143.42':139
'66.##4.103.163':139
'66.##4.63.25':139
'66.##4.76.105':139
'66.##4.61.81':139
'66.##4.81.102':445
'66.##4.156.187':445
'66.##4.211.113':445
'66.##4.74.204':445
'66.##4.255.40':445
'66.##4.22.95':445
'66.##4.76.62':445
'66.##4.123.157':445
'66.##4.157.83':445
'66.##4.45.132':445
'66.##4.34.197':445
'66.##4.12.168':445
'66.##4.47.157':139
'66.##4.58.91':139
'66.##4.19.197':139
'66.##4.253.87':139
'66.##4.15.49':139
'66.##4.145.90':139
'66.##4.114.32':445
'66.##4.192.79':445
'66.##4.143.85':445
'66.##4.19.60':445
'66.##4.197.50':445
'66.##4.136.145':445
'66.##4.185.106':139
'66.##4.95.87':139
'66.##4.87.19':139
'66.##4.45.183':445
'66.##4.217.34':139
'66.##4.195.192':139
'66.##4.228.95':139
'66.##4.77.168':139
'66.##4.70.207':139
'66.##4.181.230':139
'66.##4.186.57':139
'66.##4.178.44':139
'66.##4.169.167':139
'66.##4.178.154':139
'66.##4.129.0':139
'66.##4.104.37':139
'66.##4.127.27':139
'66.##4.214.224':139
'66.##4.254.16':139
'66.##4.78.207':139
'66.##4.207.194':139
'66.##4.92.213':139
'66.##4.92.170':139
'66.##4.27.175':139
'66.##4.59.240':139
'66.##4.152.240':139
'66.##4.199.176':445
'66.##4.89.134':445
'66.##4.10.29':445
'66.##4.143.42':445
'66.##4.109.16':445
'66.##4.16.112':445
'66.##4.248.47':445
'66.##4.61.81':445
'66.##4.253.87':445
'66.##4.191.180':445
'66.##4.184.8':445
'66.##4.122.54':445
'66.##4.171.95':139
'66.##4.52.187':139
'66.##4.13.147':139
'66.##4.174.184':139
'66.##4.33.109':139
'66.##4.171.95':445
'66.##4.175.235':445
'66.##4.227.145':445
'66.##4.14.161':445
'66.##4.235.176':139
'66.##4.135.86':139
'66.#34.45.1':445
'66.##4.129.93':139
'66.##4.89.13':139
'66.##4.50.85':139
'66.##4.88.44':139
'66.##4.142.234':139
'66.##4.12.108':139
'66.##4.148.85':139
'66.##4.5.181':139
'66.##4.97.69':139
'66.##4.83.105':139
'66.##4.208.67':139
'66.##4.1.203':139
'66.##4.91.138':139
'66.#34.8.28':139
'66.##4.27.190':139
'66.##4.254.178':445
'66.##4.243.150':445
'66.##4.148.199':445
'66.##4.121.28':139
'66.##4.28.85':139
'66.##4.105.220':139
'66.##4.176.218':139
'66.##4.207.74':139
'66.##4.43.200':139
'66.#34.64.4':139
'66.##4.232.252':445
'66.##4.172.75':445
'66.#34.0.1':445
'66.##4.19.25':445
'66.##4.91.13':445
'66.##4.189.158':445
'66.##4.249.222':445
'66.##4.176.177':445
'66.##4.178.150':445
'66.##4.84.221':445
'66.##4.138.212':445
'66.##4.108.144':445
'66.##4.243.150':139
'66.##4.201.83':139
'66.##4.196.109':139
'66.##4.248.165':139
'66.##4.48.182':139
'66.##4.254.178':139
'66.##4.90.22':139
'66.##4.150.185':445
'66.##4.145.191':445
'66.##4.30.83':139
'66.##4.162.148':139
'66.##4.148.199':139
'66.##4.248.165':445
'66.##4.22.95':139
'66.##4.81.102':139
'66.##4.156.187':139
'66.##4.74.204':139
'66.##4.255.40':139
'66.##4.184.70':139
'66.##4.34.197':139
'66.##4.68.69':139
'66.##4.12.168':139
'66.##4.211.113':139
'66.##4.45.132':139
'66.##4.42.160':139
'66.##4.197.50':139
'66.##4.58.136':139
'66.##4.136.145':139
'66.##4.99.116':445
'66.#34.95.9':445
'66.##4.19.60':139
'66.##4.114.32':139
'66.##4.192.79':139
'66.##4.143.85':139
'66.##4.145.137':139
'66.##4.244.186':139
'66.##4.209.193':139
'66.##4.43.165':139
'66.##4.12.108':445
'66.##4.129.93':445
'66.##4.89.13':445
'66.##4.105.220':445
'66.##4.88.44':445
'66.##4.142.234':445
'66.##4.148.85':445
'66.##4.5.181':445
'66.##4.97.69':445
'66.##4.50.85':445
'66.##4.208.67':445
'66.##4.1.203':445
'66.##4.157.83':139
'66.##4.32.29':139
'66.##4.235.231':139
'66.##4.76.62':139
'66.##4.75.123':139
'66.##4.123.157':139
'66.##4.91.138':445
'66.##4.27.190':445
'66.##4.121.28':445
'66.##4.99.116':139
'66.#34.95.9':139
'66.##4.5.106':139
'66.##4.27.87':139
'66.##4.134.83':445
'66.##4.227.93':445
'66.##4.151.48':445
'66.##4.19.240':445
'66.##4.187.53':445
'66.##4.121.123':445
'66.##4.44.205':445
'66.##4.61.27':445
'66.##4.120.113':445
'66.##4.242.144':445
'66.##4.144.70':445
'66.##4.55.44':445
'66.##4.174.134':139
'66.##4.134.163':139
'66.##4.42.104':139
'66.##4.202.209':139
'66.##4.88.117':445
'66.##4.88.117':139
'66.##4.150.72':139
'66.##4.72.224':139
'66.##4.8.226':139
'66.##4.77.59':139
'66.##4.209.46':139
'66.##4.156.229':139
'66.##4.244.210':445
'66.##4.39.171':445
'66.##4.69.82':139
'66.##4.135.253':139
'66.##4.32.234':445
'66.##4.19.240':139
'66.##4.220.184':139
'66.##4.32.219':139
'66.##4.227.93':139
'66.##4.86.118':139
'66.##4.187.53':139
'66.##4.121.123':139
'66.##4.134.83':139
'66.##4.135.249':445
'66.##4.181.135':445
'66.##4.111.220':445
'66.##4.211.143':445
'66.##4.76.171':445
'66.##4.44.48':445
'66.##4.75.16':445
'66.##4.84.242':445
'66.##4.117.204':445
'66.##4.240.119':445
'66.##4.212.18':445
'66.##4.56.241':445
'66.##4.97.124':139
'66.##4.87.115':445
'66.##4.65.229':445
'66.##4.124.142':445
'66.##4.130.223':445
'66.##4.22.152':445
'66.##4.69.87':445
'66.##4.26.244':445
'66.##4.109.125':445
'66.##4.38.149':445
'66.##4.150.31':445
'66.##4.154.179':445
'66.##4.179.247':445
'66.##4.9.254':139
'66.##4.210.139':139
'66.##4.65.121':139
'66.##4.29.204':139
'66.##4.4.167':139
'66.##4.162.171':139
'66.##4.211.251':139
'66.##4.55.208':139
'66.##4.114.130':139
'66.##4.191.88':139
'66.##4.73.226':139
'66.##4.43.209':139
'66.##4.149.96':445
'66.##4.65.229':139
'66.##4.124.142':139
'66.##4.150.31':139
'66.##4.22.152':139
'66.##4.69.87':139
'66.##4.87.115':139
'66.##4.109.125':139
'66.##4.38.149':139
'66.##4.149.96':139
'66.##4.154.179':139
'66.##4.179.247':139
'66.##4.26.244':139
'66.##4.134.163':445
'66.##4.42.104':445
'66.##4.77.59':445
'66.##4.97.124':445
'66.##4.202.209':445
'66.##4.174.134':445
'66.##4.72.224':445
'66.##4.8.226':445
'66.##4.130.223':139
'66.##4.209.46':445
'66.##4.156.229':445
'66.##4.150.72':445
'66.##4.100.136':139
'66.##4.127.152':139
'66.##4.152.172':139
'66.##4.139.162':139
'66.##4.14.88':139
'66.##4.117.70':139
'66.##4.32.161':139
'66.##4.214.224':445
'66.##4.129.0':445
'66.##4.19.154':139
'66.##4.107.147':139
'66.##4.230.194':139
'66.##4.35.108':139
'66.##4.33.254':139
'66.##4.105.178':139
'66.##4.236.153':139
'66.##4.75.201':139
'66.##4.205.145':139
'66.##4.49.190':139
'66.##4.205.77':139
'66.##4.60.97':139
'66.##4.40.235':139
'66.##4.211.247':139
'66.##4.16.63':139
'66.##4.92.170':445
'66.##4.33.109':445
'66.##4.13.147':445
'66.##4.135.86':445
'66.##4.181.230':445
'66.##4.152.240':445
'66.##4.174.184':445
'66.##4.201.222':139
'66.##4.176.81':139
'66.##4.180.208':139
'66.##4.129.233':139
'66.##4.20.123':139
'66.#34.8.27':139
'66.##4.207.194':445
'66.##4.92.213':445
'66.##4.217.34':445
'66.##4.27.175':445
'66.##4.59.240':445
'66.##4.78.207':445
'66.##4.169.167':445
'66.##4.77.168':445
'66.##4.70.207':445
'66.##4.228.95':445
'66.##4.186.57':445
'66.##4.178.44':445
'66.##4.204.55':139
'66.##4.135.249':139
'66.##4.181.135':139
'66.##4.111.220':139
'66.##4.213.26':139
'66.##4.76.171':139
'66.##4.44.48':139
'66.##4.240.119':139
'66.##4.212.18':139
'66.##4.56.241':139
'66.##4.13.197':445
'66.##4.13.197':139
'66.##4.134.220':139
'66.##4.144.70':139
'66.##4.55.44':139
'66.##4.44.205':139
'66.##4.151.48':139
'66.#34.3.96':139
'66.##4.242.144':139
'66.##4.211.143':139
'66.##4.144.180':445
'66.##4.144.180':139
'66.##4.61.27':139
'66.##4.120.113':139
'66.##4.244.210':139
'66.##4.138.144':139
'66.##4.19.154':445
'66.##4.230.194':445
'66.##4.22.108':139
'66.##4.60.97':445
'66.##4.14.88':445
'66.##4.127.152':445
'66.##4.64.100':139
'66.##4.104.143':139
'66.##4.201.230':139
'66.##4.127.106':139
'66.##4.143.204':139
'66.##4.247.3':139
'66.##4.32.234':139
'66.##4.127.106':445
'66.##4.247.3':445
'66.##4.75.16':139
'66.##4.84.242':139
'66.##4.117.204':139
'66.##4.33.254':445
'66.##4.40.235':445
'66.##4.49.190':445
'66.##4.104.143':445
'66.##4.204.55':445
'66.##4.35.108':445
'66.##4.252.19':445
'66.##4.150.127':445
'66.##4.203.178':445
'66.##4.126.4':139
'66.##4.254.226':139
'66.##4.226.251':139
'66.##4.19.100':139
'66.##4.150.127':139
'66.##4.203.178':139
'66.##4.148.176':445
'66.##4.2.229':445
'66.##4.19.100':445
'66.##4.110.145':139
'66.##4.159.122':139
'66.##4.82.82':139
'66.##4.81.41':139
'66.##4.41.29':139
'66.##4.110.145':445
'66.##4.28.151':139
'66.##4.190.170':139
'66.##4.188.212':139
'66.##4.107.71':139
'66.##4.138.194':139
'66.##4.139.96':139
'66.##4.148.176':139
'66.##4.117.131':9988
'66.##4.229.37':9988
'66.##4.38.48':9988
'66.##4.221.144':9988
'66.##4.84.117':9988
'66.##4.29.66':9988
'66.##4.107.29':445
'66.##4.29.71':445
'66.##4.41.168':445
'66.##4.202.152':9988
'66.##4.26.202':9988
'66.##4.232.253':9988
'66.##4.28.206':445
'66.##4.28.206':139
'66.##4.239.116':139
'66.##4.2.229':139
'66.##4.90.64':445
'66.##4.90.64':139
'66.#34.3.31':9988
'66.##4.105.115':9988
'66.##4.27.195':9988
'66.##4.29.71':9988
'66.##4.124.232':9988
'66.##4.180.99':9988
'66.##4.81.41':445
'66.##4.3.165':445
'66.##4.38.224':445
'66.##4.97.172':445
'66.##4.248.176':445
'66.##4.67.128':445
'66.##4.16.134':445
'66.##4.157.32':139
'66.##4.248.176':139
'66.##4.67.128':139
'66.##4.40.194':445
'66.##4.193.97':445
'66.##4.148.102':139
'66.##4.117.180':139
'66.##4.216.99':139
'66.##4.99.185':139
'66.##4.156.152':139
'66.##4.152.110':139
'66.##4.109.217':139
'66.##4.184.25':139
'66.##4.192.111':139
'66.##4.165.148':139
'66.##4.129.36':139
'66.##4.193.181':139
'66.##4.7.165':139
'66.##4.128.171':139
'66.##4.126.4':445
'66.##4.254.226':445
'66.##4.226.251':445
'66.##4.28.151':445
'66.##4.190.170':445
'66.##4.188.212':445
'66.##4.92.90':139
'66.##4.222.114':139
'66.##4.115.80':139
'66.##4.97.179':139
'66.##4.22.148':445
'66.##4.92.90':445
'66.##4.97.172':139
'66.##4.40.194':139
'66.##4.193.97':139
'66.##4.16.134':139
'66.##4.3.165':139
'66.##4.38.224':139
'66.##4.41.29':445
'66.##4.82.82':445
'66.##4.107.71':445
'66.##4.97.179':445
'66.##4.222.114':445
'66.##4.115.80':445
'66.##4.234.170':139
'66.##4.171.150':139
'66.##4.180.99':139
'66.##4.95.199':139
'66.##4.61.40':139
'66.##4.124.232':139
'66.##4.133.158':139
'66.##4.14.193':139
'66.##4.28.191':139
'66.##4.35.170':139
'66.##4.55.114':139
'66.#34.3.31':139
'66.##4.141.51':139
'66.##4.65.131':139
'66.##4.116.137':139
'66.##4.41.168':139
'66.##4.8.119':139
'66.##4.156.163':139
'66.##4.15.202':139
'66.##4.156.110':139
'66.##4.116.18':139
'66.##4.110.66':139
'66.##4.42.123':139
'66.##4.229.41':139
'66.##4.105.115':139
'66.##4.154.120':139
'66.##4.140.25':139
'66.##4.53.188':139
'66.##4.38.48':139
'66.##4.202.152':139
'66.##4.124.186':139
'66.##4.155.97':139
'66.##4.111.239':139
'66.##4.232.253':139
'66.##4.236.79':139
'66.##4.11.170':139
'66.##4.26.202':139
'66.##4.157.221':139
'66.##4.221.144':139
'66.##4.84.117':139
'66.##4.147.226':139
'66.##4.100.248':139
'66.##4.27.195':139
'66.##4.29.66':139
'66.##4.56.229':139
'66.##4.229.37':139
'66.##4.117.131':139
'66.##4.91.10':139
'66.##4.10.44':139
'66.##4.29.71':139
'66.##4.171.150':445
'66.##4.180.99':445
'66.##4.35.170':445
'66.##4.61.40':445
'66.##4.124.232':445
'66.##4.234.170':445
'66.##4.14.193':445
'66.##4.28.191':445
'66.##4.105.115':445
'66.##4.55.114':445
'66.#34.3.31':445
'66.##4.133.158':445
'66.##4.65.131':445
'66.##4.116.137':445
'66.##4.110.66':445
'66.##4.8.119':445
'66.##4.156.163':445
'66.##4.141.51':445
'66.##4.156.110':445
'66.##4.116.18':445
'66.##4.95.199':445
'66.##4.42.123':445
'66.##4.229.41':445
'66.##4.15.202':445
'66.##4.147.226':445
'66.##4.140.25':445
'66.##4.53.188':445
'66.##4.236.79':445
'66.##4.202.152':445
'66.##4.124.186':445
'66.##4.154.120':445
'66.##4.26.202':445
'66.##4.155.97':445
'66.##4.107.29':139
'66.##4.11.170':445
'66.##4.232.253':445
'66.##4.111.239':445
'66.##4.221.144':445
'66.##4.84.117':445
'66.##4.117.131':445
'66.##4.100.248':445
'66.##4.27.195':445
'66.##4.157.221':445
'66.##4.56.229':445
'66.##4.229.37':445
'66.##4.38.48':445
'66.##4.91.10':445
'66.##4.10.44':445
'66.##4.29.66':445
'66.##4.206.156':139
'66.##4.73.233':139
'66.##4.248.46':139
'66.##4.191.62':139
'66.##4.73.105':139
'66.#34.25.9':139
'66.##4.133.176':139
'66.##4.209.33':139
'66.##4.36.83':139
'66.##4.83.41':139
'66.##4.110.206':139
'66.##4.28.237':139
'66.##4.31.48':139
'66.##4.36.239':445
'66.##4.27.79':445
'66.##4.128.251':445
'66.##4.36.83':445
'66.##4.83.41':445
'66.##4.34.70':445
'66.##4.205.34':445
'66.##4.126.190':139
'66.##4.187.106':139
'66.##4.18.127':445
'66.##4.129.208':445
'66.##4.31.89':445
'66.##4.34.70':139
'66.##4.239.193':139
'66.##4.205.34':139
'66.##4.91.185':139
'66.##4.129.208':139
'66.##4.88.238':139
'66.##4.31.89':139
'66.#34.3.94':445
'66.##4.241.108':445
'66.##4.154.132':445
'66.##4.192.56':445
'66.##4.192.56':139
'66.##4.23.84':139
'66.##4.57.151':139
'66.##4.128.251':139
'66.##4.27.211':139
'66.##4.36.239':139
'66.##4.27.79':139
'66.##4.53.131':139
'66.##4.174.177':139
'66.##4.18.127':139
'66.##4.25.110':139
'66.##4.72.189':139
'66.##4.208.56':139
'66.##4.100.116':139
'66.##4.209.33':445
'66.##4.189.158':139
'66.##4.45.33':139
'66.##4.232.252':139
'66.##4.79.206':139
'66.##4.91.13':139
'66.##4.86.252':139
'66.##4.84.221':139
'66.##4.49.186':445
'66.##4.49.186':139
'66.##4.172.75':139
'66.#34.0.1':139
'66.##4.8.198':139
'66.#34.8.22':445
'66.##4.233.204':445
'66.##4.23.138':445
'66.##4.124.122':445
'66.##4.71.44':445
'66.##4.204.110':445
'66.##4.19.25':139
'66.##4.20.178':139
'66.##4.5.253':139
'66.##4.150.185':139
'66.##4.145.191':139
'66.##4.191.18':139
'66.##4.138.212':139
'66.##4.213.7':139
'66.##4.9.238':445
'66.##4.233.204':139
'66.##4.3.188':139
'66.#34.8.22':139
'66.##4.75.212':139
'66.##4.248.46':445
'66.##4.191.62':445
'66.##4.28.237':445
'66.##4.23.138':139
'66.#34.25.9':445
'66.##4.73.233':445
'66.##4.176.177':139
'66.##4.178.150':139
'66.##4.154.216':139
'66.##4.210.116':139
'66.##4.108.144':139
'66.##4.249.222':139
'66.##4.71.44':139
'66.##4.104.213':139
'66.##4.204.110':139
'66.##4.124.122':139
'66.#34.5.92':139
'66.##4.173.79':139
'66.##4.216.99':445
'66.##4.7.165':445
'66.##4.192.111':445
'66.##4.156.152':445
'66.##4.152.110':445
'66.##4.109.217':445
'66.##4.58.219':139
'66.##4.223.251':139
'66.##4.66.117':139
'66.##4.133.153':139
'66.##4.219.252':139
'66.##4.18.115':139
'66.##4.12.182':445
'66.##4.87.150':445
'66.##4.51.82':445
'66.##4.67.229':445
'66.##4.46.199':445
'66.##4.75.206':445
'66.##4.77.231':445
'66.##4.149.19':445
'66.##4.19.207':445
'66.##4.128.86':445
'66.##4.120.33':445
'66.#34.9.56':445
'66.##4.51.100':139
'66.##4.192.184':139
'66.#34.9.56':139
'66.##4.197.147':139
'66.##4.128.86':139
'66.##4.120.33':139
'66.##4.29.189':139
'66.##4.51.149':139
'66.##4.149.19':139
'66.##4.19.207':139
'66.##4.164.41':139
'66.##4.77.231':139
'66.##4.76.56':139
'66.##4.169.82':139
'66.##4.79.115':139
'66.##4.46.199':139
'66.#34.8.12':139
'66.##4.112.221':139
'66.##4.67.229':139
'66.##4.221.34':139
'66.##4.51.82':139
'66.##4.163.150':139
'66.##4.75.206':139
'66.##4.12.182':139
'66.##4.87.150':139
'66.##4.51.100':445
'66.##4.127.136':139
'66.#34.3.94':139
'66.##4.241.108':139
'66.##4.6.140':445
'66.##4.84.170':139
'66.##4.76.232':139
'66.##4.33.232':139
'66.##4.106.165':139
'66.##4.246.7':445
'66.##4.154.132':139
'66.##4.132.124':139
'66.##4.49.93':139
'66.##4.117.27':445
'66.##4.208.63':445
'66.##4.41.187':445
'66.##4.132.124':445
'66.##4.33.232':445
'66.##4.5.184':445
'66.##4.239.177':445
'66.##4.45.146':445
'66.##4.150.86':445
'66.##4.236.174':445
'66.##4.249.78':445
'66.##4.228.19':445
'66.##4.246.7':139
'66.##4.211.182':139
'66.##4.149.6':139
'66.##4.4.248':139
'66.##4.145.71':139
'66.##4.72.41':139
'66.##4.150.86':139
'66.##4.133.153':445
'66.##4.219.252':445
'66.##4.58.219':445
'66.##4.161.222':139
'66.##4.6.140':139
'66.##4.26.76':139
'66.##4.117.27':139
'66.##4.31.249':139
'66.##4.208.63':139
'66.##4.5.184':139
'66.##4.1.136':139
'66.##4.52.26':139
'66.##4.228.19':139
'66.##4.239.177':139
'66.##4.45.146':139
'66.##4.41.187':139
'66.##4.236.174':139
'66.##4.249.78':139

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial