Trojan.DownLoader10.15634

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Startup' = '%APPDATA%\Winodws Runtime\bin.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3560
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4628
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4060
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3360
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4832
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5904
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5964
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4204
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3340
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=6004
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5884
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=6084
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5720
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4708
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5420
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5836
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4296
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4516
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5432
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5532
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5792
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3160
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=1060
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=6064
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5400
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=8188
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=184
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=2492
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4608
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=1056
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4416
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4920
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5732
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5812
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4636
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4124
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=2820
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=2748
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3868
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5712
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4228
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3640
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=2840
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5280
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3768
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5032
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5460
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3240
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4528
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5052
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5232
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=2680
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' -a sha256 -o http://12#################E2TznT5UV8vwAzB:xxxxx@getwork.mining.eligius.st:8337 -T 90 -l yes -t 2
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5220
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4820
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=2728
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=2496
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4112
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3708
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5112
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=2388
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5152
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4728
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3440
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3740
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3820
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5360
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3268
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=2608
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4328
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5412
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4212
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5984
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=4316
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5512
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3108
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=3660
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=6140
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' /pid=5592
'%APPDATA%\Winodws Runtime\Windows Runtime.exe' (загружен из сети Интернет)