Trojan.DownLoader45.753

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\Encrypting Parental Copy Grouping Secure] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Encrypting Parental Copy Grouping Secure] 'ImagePath' = 'C:\mtdlkdn0w1be\cmfqirbn.exe'

Creates the following services

'Encrypting Parental Copy Grouping Secure' C:\mtdlkdn0w1be\cmfqirbn.exe

Modifies file system

Creates the following files

%WINDIR%\mtdlkdn0w1be\llmgfg
C:\mtdlkdn0w1be\llmgfg
C:\mtdlkdn0w1be\wqroqgoo7ftuknowfixs.exe
C:\mtdlkdn0w1be\cmfqirbn.exe
C:\mtdlkdn0w1be\tgqdcy5br.exe
C:\mtdlkdn0w1be\hqcmz69zj

Sets the 'hidden' attribute to the following files

C:\mtdlkdn0w1be\cmfqirbn.exe
C:\mtdlkdn0w1be\tgqdcy5br.exe

Deletes the following files

%WINDIR%\mtdlkdn0w1be\llmgfg
C:\mtdlkdn0w1be\wqroqgoo7ftuknowfixs.exe

Substitutes the following files

%WINDIR%\mtdlkdn0w1be\llmgfg

Network activity

Connects to

'de#####stcharleen.net':80
'ja#####yncaulfield.net':80
'ro#####nethrussell.net':80
'cl#####ndcamellia.net':80
'ma#####ancallista.net':80
'ro#####neharmonie.net':80
'ch#####napemberton.net':80

TCP

HTTP GET requests

http://ro#####nemarianna.net/index.php
http://de#####stkatheryn.net/index.php
http://de#####stcharleen.net/index.php
http://ja#####yncaulfield.net/index.php
http://ro#####nethrussell.net/index.php
http://ja#####ynalfredson.net/index.php
http://cl#####ndcamellia.net/index.php
http://ma#####ancallista.net/index.php
http://ro#####neharmonie.net/index.php

UDP

DNS ASK ag#####anabolics.com
DNS ASK cl#####ndmarianne.net
DNS ASK ch#####nemarianne.net
DNS ASK cl#####ndcallista.net
DNS ASK ch#####necallista.net
DNS ASK ch#####necallista.ru
DNS ASK cl#####ndcaileigh.net
DNS ASK ch#####necaileigh.net
DNS ASK se#####ancamellia.net
DNS ASK ch#####nacamellia.net
DNS ASK se#####anmarianne.net
DNS ASK se#####anmarianne.ru
DNS ASK ch#####namarianne.net
DNS ASK se#####ancallista.net
DNS ASK ch#####nacallista.net
DNS ASK se#####ancaileigh.net
DNS ASK ch#####nacaileigh.net
DNS ASK ch#####nacaileigh.ru
DNS ASK la#####iaalfredson.net
DNS ASK de#####stalfredson.net
DNS ASK la#####iaandrewson.net
DNS ASK de#####standrewson.net
DNS ASK la#####iathrussell.net
DNS ASK la#####iathrussell.ru
DNS ASK de#####stthrussell.net
DNS ASK la#####iaainsworth.net
DNS ASK de#####stainsworth.net
DNS ASK pr#####laalfredson.net
DNS ASK ch#####necamellia.net
DNS ASK cl#####ndcamellia.net
DNS ASK cl#####ndcamellia.ru
DNS ASK cr#####oncaileigh.net
DNS ASK ch#####tacaileigh.ru
DNS ASK co#####cecamellia.net
DNS ASK ha#####tacamellia.net
DNS ASK co#####cemarianne.net
DNS ASK ha#####tamarianne.net
DNS ASK co#####cecallista.net
DNS ASK co#####cecallista.ru
DNS ASK ha#####tacallista.net
DNS ASK co#####cecaileigh.net
DNS ASK ha#####tacaileigh.net
DNS ASK ja#####tacamellia.net
DNS ASK ro#####nemarianne.net
DNS ASK ro#####necamellia.net
DNS ASK ja#####tamarianne.net
DNS ASK ro#####necamellia.ru
DNS ASK ja#####tacallista.net
DNS ASK ro#####necallista.net
DNS ASK ja#####tacaileigh.net
DNS ASK cr#####oncamellia.net
DNS ASK ja#####tacaileigh.ru
DNS ASK ro#####necaileigh.net
DNS ASK ja#####yncamellia.net
DNS ASK ja#####ynmarianne.net
DNS ASK cr#####onmarianne.net
DNS ASK cr#####onmarianne.ru
DNS ASK ja#####yncallista.net
DNS ASK cr#####oncallista.net
DNS ASK ja#####yncaileigh.net
DNS ASK ch#####tacaileigh.net
DNS ASK ma#####analfredson.net
DNS ASK ma#####analfredson.ru
DNS ASK pr#####laandrewson.net
DNS ASK ro#####neainsworth.net
DNS ASK ro#####neainsworth.ru
DNS ASK ja#####ynalfredson.net
DNS ASK cr#####onalfredson.net
DNS ASK ja#####ynandrewson.net
DNS ASK cr#####onandrewson.net
DNS ASK ja#####ynthrussell.net
DNS ASK ja#####ynthrussell.ru
DNS ASK cr#####onthrussell.net
DNS ASK ja#####ynainsworth.net
DNS ASK cr#####onainsworth.net
DNS ASK cl#####ndalfredson.net
DNS ASK ch#####nealfredson.net
DNS ASK ch#####nealfredson.ru
DNS ASK ch#####neandrewson.net
DNS ASK cl#####ndandrewson.net
DNS ASK cl#####ndthrussell.net
DNS ASK ch#####nethrussell.net
DNS ASK cl#####ndainsworth.net
DNS ASK cl#####ndainsworth.ru
DNS ASK ch#####neainsworth.net
DNS ASK se#####analfredson.net
DNS ASK ch#####naalfredson.net
DNS ASK se#####anandrewson.net
DNS ASK ch#####naandrewson.net
DNS ASK ch#####naandrewson.ru
DNS ASK se#####anthrussell.net
DNS ASK ja#####taainsworth.net
DNS ASK ro#####nethrussell.net
DNS ASK ja#####tathrussell.net
DNS ASK ro#####neandrewson.net
DNS ASK pr#####lathrussell.net
DNS ASK ma#####anthrussell.net
DNS ASK pr#####laainsworth.net
DNS ASK pr#####laainsworth.ru
DNS ASK ma#####anainsworth.net
DNS ASK ka#####raalfredson.net
DNS ASK ch#####taalfredson.net
DNS ASK ka#####raandrewson.net
DNS ASK ch#####taandrewson.net
DNS ASK ch#####taandrewson.ru
DNS ASK ka#####rathrussell.net
DNS ASK ch#####tathrussell.net
DNS ASK ch#####taainsworth.net
DNS ASK co#####cealfredson.net
DNS ASK ka#####raainsworth.net
DNS ASK co#####cealfredson.ru
DNS ASK ha#####taalfredson.net
DNS ASK co#####ceandrewson.net
DNS ASK ha#####taandrewson.net
DNS ASK co#####cethrussell.net
DNS ASK ha#####tathrussell.net
DNS ASK ha#####taainsworth.net
DNS ASK co#####ceainsworth.net
DNS ASK ha#####tathrussell.ru
DNS ASK ja#####taalfredson.net
DNS ASK ja#####taandrewson.net
DNS ASK ro#####nealfredson.net
DNS ASK ja#####taandrewson.ru
DNS ASK ma#####anandrewson.net
DNS ASK cr#####onharmonie.net
DNS ASK ja#####ynblackburn.net
DNS ASK ka#####racallista.net
DNS ASK ma#####anveronica.net
DNS ASK pr#####laanjelica.net
DNS ASK ma#####ananjelica.net
DNS ASK pr#####lashaniqua.net
DNS ASK pr#####lashaniqua.ru
DNS ASK ma#####anshaniqua.net
DNS ASK ma#####anharmonie.net
DNS ASK pr#####laharmonie.net
DNS ASK ka#####raveronica.net
DNS ASK ch#####taveronica.net
DNS ASK ch#####taveronica.ru
DNS ASK ka#####raanjelica.net
DNS ASK ka#####rashaniqua.net
DNS ASK ch#####taanjelica.net
DNS ASK ch#####tashaniqua.net
DNS ASK ka#####raharmonie.net
DNS ASK ka#####raharmonie.ru
DNS ASK ch#####taharmonie.net
DNS ASK co#####ceveronica.net
DNS ASK ha#####taveronica.net
DNS ASK co#####ceanjelica.net
DNS ASK ha#####taanjelica.net
DNS ASK ha#####taanjelica.ru
DNS ASK co#####ceshaniqua.net
DNS ASK ha#####tashaniqua.net
DNS ASK co#####ceharmonie.net
DNS ASK ja#####taveronica.net
DNS ASK pr#####laveronica.net
DNS ASK de#####stharmonie.ru
DNS ASK de#####stharmonie.net
DNS ASK la#####iaharmonie.net
DNS ASK ja#####ynblackburn.ru
DNS ASK cr#####onblackburn.net
DNS ASK cl#####ndmasterson.net
DNS ASK ch#####nemasterson.net
DNS ASK cl#####ndpemberton.net
DNS ASK cl#####ndoliverson.net
DNS ASK ch#####neoliverson.net
DNS ASK ch#####neoliverson.ru
DNS ASK ch#####nepemberton.net
DNS ASK cl#####ndblackburn.net
DNS ASK ch#####neblackburn.net
DNS ASK se#####anmasterson.net
DNS ASK se#####anmasterson.ru
DNS ASK se#####anoliverson.net
DNS ASK ch#####namasterson.net
DNS ASK ch#####naoliverson.net
DNS ASK se#####anpemberton.net
DNS ASK ch#####napemberton.net
DNS ASK ch#####napemberton.ru
DNS ASK ch#####nablackburn.net
DNS ASK se#####anblackburn.net
DNS ASK la#####iaveronica.net
DNS ASK de#####stveronica.net
DNS ASK la#####iaanjelica.net
DNS ASK la#####iaanjelica.ru
DNS ASK de#####stanjelica.net
DNS ASK la#####iashaniqua.net
DNS ASK de#####stshaniqua.net
DNS ASK ka#####racaileigh.net
DNS ASK se#####anainsworth.net
DNS ASK ja#####taveronica.ru
DNS ASK ro#####neveronica.net
DNS ASK ch#####nashaniqua.net
DNS ASK ch#####naharmonie.net
DNS ASK se#####anharmonie.ru
DNS ASK la#####iacamellia.net
DNS ASK de#####stcamellia.net
DNS ASK la#####iamarianne.net
DNS ASK de#####stmarianne.net
DNS ASK de#####stmarianne.ru
DNS ASK la#####iacallista.net
DNS ASK de#####stcallista.net
DNS ASK la#####iacaileigh.net
DNS ASK de#####stcaileigh.net
DNS ASK pr#####lacamellia.net
DNS ASK pr#####lacamellia.ru
DNS ASK ma#####ancamellia.net
DNS ASK ma#####anmarianne.net
DNS ASK pr#####lamarianne.net
DNS ASK pr#####lacallista.net
DNS ASK ma#####ancallista.net
DNS ASK ma#####ancallista.ru
DNS ASK pr#####lacaileigh.net
DNS ASK ma#####ancaileigh.net
DNS ASK ka#####racamellia.net
DNS ASK ka#####ramarianne.net
DNS ASK ch#####tacamellia.net
DNS ASK ka#####ramarianne.ru
DNS ASK ch#####tamarianne.net
DNS ASK se#####anharmonie.net
DNS ASK se#####anshaniqua.net
DNS ASK ch#####naanjelica.net
DNS ASK se#####ananjelica.net
DNS ASK ja#####tashaniqua.net
DNS ASK ro#####neanjelica.net
DNS ASK ro#####neshaniqua.net
DNS ASK ro#####neshaniqua.ru
DNS ASK ja#####taharmonie.net
DNS ASK ro#####neharmonie.net
DNS ASK ja#####ynveronica.net
DNS ASK cr#####onveronica.net
DNS ASK ja#####ynanjelica.net
DNS ASK ja#####ynanjelica.ru
DNS ASK cr#####onanjelica.net
DNS ASK ja#####ynshaniqua.net
DNS ASK cr#####onshaniqua.net
DNS ASK ch#####tacallista.net
DNS ASK ja#####ynharmonie.net
DNS ASK cr#####onharmonie.ru
DNS ASK cl#####ndveronica.net
DNS ASK ch#####neveronica.net
DNS ASK cl#####ndanjelica.net
DNS ASK ch#####neanjelica.net
DNS ASK cl#####ndshaniqua.net
DNS ASK ch#####neshaniqua.net
DNS ASK cl#####ndshaniqua.ru
DNS ASK cl#####ndharmonie.net
DNS ASK ch#####neharmonie.net
DNS ASK se#####anveronica.net
DNS ASK ch#####naveronica.net
DNS ASK ch#####naveronica.ru
DNS ASK ja#####taanjelica.net
DNS ASK ha#####taharmonie.net
DNS ASK ch#####naainsworth.net
DNS ASK cl#####ndwilkerson.net
DNS ASK la#####iakatheryn.ru
DNS ASK de#####stcalleigh.net
DNS ASK la#####iajessalyn.net
DNS ASK de#####stjessalyn.ru
DNS ASK la#####iacalleigh.net
DNS ASK pr#####lajessamyn.net
DNS ASK pr#####lajessalyn.net
DNS ASK ma#####anjessamyn.net
DNS ASK pr#####lakatheryn.net
DNS ASK ma#####ankatheryn.net
DNS ASK pr#####lacalleigh.net
DNS ASK pr#####lacalleigh.ru
DNS ASK ma#####ancalleigh.net
DNS ASK ka#####rajessamyn.net
DNS ASK ma#####anjessalyn.net
DNS ASK ch#####tajessamyn.net
DNS ASK ch#####tajessamyn.ru
DNS ASK ka#####rakatheryn.net
DNS ASK ka#####racalleigh.net
DNS ASK ch#####takatheryn.net
DNS ASK ka#####rajessalyn.ru
DNS ASK ch#####tacalleigh.net
DNS ASK ka#####rajessalyn.net
DNS ASK ch#####tajessalyn.net
DNS ASK co#####cejessamyn.net
DNS ASK ha#####tajessamyn.net
DNS ASK ha#####takatheryn.net
DNS ASK de#####stjessalyn.net
DNS ASK de#####stkatheryn.net
DNS ASK la#####iakatheryn.net
DNS ASK la#####iajessamyn.net
DNS ASK cr#####oncharleen.ru
DNS ASK ja#####yntallulah.net
DNS ASK cr#####ontallulah.net
DNS ASK ja#####yncathleen.net
DNS ASK ja#####ynmarianna.net
DNS ASK cr#####oncathleen.net
DNS ASK cl#####ndcharleen.net
DNS ASK ja#####ynmarianna.ru
DNS ASK cr#####onmarianna.net
DNS ASK ch#####necharleen.net
DNS ASK cl#####ndtallulah.net
DNS ASK ch#####netallulah.ru
DNS ASK ch#####netallulah.net
DNS ASK cl#####ndmarianna.net
DNS ASK cl#####ndcathleen.net
DNS ASK ch#####necathleen.net
DNS ASK ch#####nemarianna.net
DNS ASK se#####ancharleen.net
DNS ASK se#####ancharleen.ru
DNS ASK ch#####nacharleen.net
DNS ASK ch#####natallulah.net
DNS ASK se#####antallulah.net
DNS ASK se#####ancathleen.net
DNS ASK ch#####nacathleen.net
DNS ASK ch#####namarianna.net
DNS ASK se#####anmarianna.net
DNS ASK ch#####nacathleen.ru
DNS ASK de#####stjessamyn.net
DNS ASK cr#####oncharleen.net
DNS ASK co#####cekatheryn.net
DNS ASK ha#####takatheryn.ru
DNS ASK co#####cecalleigh.net
DNS ASK ch#####najessamyn.net
DNS ASK ch#####najessamyn.ru
DNS ASK ka#######ayajivayapriroda.ru
DNS ASK ye####gdongwu.cn
DNS ASK ta#####pielenreiten.org
DNS ASK do##bate.cn
DNS ASK un###lgrain.org
DNS ASK ch####isportsmen.ru
DNS ASK si###ypeas.net
DNS ASK bu####rmansion.com
DNS ASK to###tosales.ru
DNS ASK gr###factory.cn
DNS ASK cl#####ortswomen.com
DNS ASK pr##card.ru
DNS ASK cl####portsmen.com
DNS ASK na##top.ru
DNS ASK sc####ainbow.net
DNS ASK gu##155.cn
DNS ASK sp##tnav.ru
DNS ASK so####ryducks.com
DNS ASK pr####anabolikov.ru
DNS ASK pi##asia.cn
DNS ASK ca#####eeitinthecup.org
DNS ASK ha####nhalflion.net
DNS ASK sc#####epuzzlechess.org
DNS ASK ga#####yundongyuan.cn
DNS ASK ga####liongrass.net
DNS ASK se#####anjessamyn.net
DNS ASK ch#####nejessalyn.net
DNS ASK ch#####necalleigh.net
DNS ASK cl#####ndjessalyn.net
DNS ASK ha#####tacalleigh.net
DNS ASK ha#####tajessalyn.net
DNS ASK ro#####nejessamyn.net
DNS ASK ja#####tajessamyn.net
DNS ASK ja#####tajessamyn.ru
DNS ASK ja#####takatheryn.net
DNS ASK ro#####nekatheryn.net
DNS ASK ja#####tacalleigh.net
DNS ASK ro#####necalleigh.net
DNS ASK ja#####tajessalyn.net
DNS ASK ro#####necalleigh.ru
DNS ASK cr#####onjessamyn.net
DNS ASK ro#####nejessalyn.net
DNS ASK ja#####ynkatheryn.ru
DNS ASK ja#####ynjessamyn.net
DNS ASK ja#####ynkatheryn.net
DNS ASK cr#####onkatheryn.net
DNS ASK ja#####yncalleigh.net
DNS ASK cr#####oncalleigh.net
DNS ASK ja#####ynjessalyn.net
DNS ASK cr#####onjessalyn.ru
DNS ASK cr#####onjessalyn.net
DNS ASK ch#####nejessamyn.net
DNS ASK cl#####ndjessamyn.net
DNS ASK cl#####ndkatheryn.net
DNS ASK ch#####nekatheryn.net
DNS ASK cl#####ndcalleigh.net
DNS ASK cl#####ndcalleigh.ru
DNS ASK co#####cejessalyn.net
DNS ASK de#####stcharleen.net
DNS ASK la#####iacaulfield.net
DNS ASK ro#####necathleen.net
DNS ASK ha#####tawilkerson.net
DNS ASK co#####cemathewson.net
DNS ASK ha#####tamathewson.net
DNS ASK co#####cewilkinson.net
DNS ASK ha#####tawilkinson.net
DNS ASK co#####cewilkinson.ru
DNS ASK ja#####tacaulfield.net
DNS ASK ro#####necaulfield.net
DNS ASK ja#####tawilkerson.net
DNS ASK ro#####newilkerson.net
DNS ASK ro#####newilkerson.ru
DNS ASK ja#####tamathewson.net
DNS ASK ro#####nemathewson.net
DNS ASK ja#####tawilkinson.net
DNS ASK ro#####newilkinson.net
DNS ASK ja#####yncaulfield.net
DNS ASK ja#####yncaulfield.ru
DNS ASK cr#####oncaulfield.net
DNS ASK ja#####ynwilkerson.net
DNS ASK cr#####onwilkerson.net
DNS ASK ja#####ynmathewson.net
DNS ASK cr#####onmathewson.net
DNS ASK cr#####onmathewson.ru
DNS ASK ja#####ynwilkinson.net
DNS ASK cr#####onwilkinson.net
DNS ASK cl#####ndcaulfield.net
DNS ASK ch#####necaulfield.net
DNS ASK co#####cewilkerson.net
DNS ASK ha#####tacaulfield.ru
DNS ASK ha#####tacaulfield.net
DNS ASK co#####cecaulfield.net
DNS ASK la#####iacaulfield.ru
DNS ASK la#####iawilkerson.net
DNS ASK de#####stcaulfield.net
DNS ASK la#####iamathewson.net
DNS ASK de#####stmathewson.ru
DNS ASK de#####stwilkerson.net
DNS ASK de#####stmathewson.net
DNS ASK de#####stwilkinson.net
DNS ASK la#####iawilkinson.net
DNS ASK pr#####lacaulfield.net
DNS ASK ma#####ancaulfield.net
DNS ASK pr#####lawilkerson.net
DNS ASK pr#####lawilkerson.ru
DNS ASK ma#####anwilkerson.net
DNS ASK ma#####anmathewson.net
DNS ASK pr#####lamathewson.net
DNS ASK pr#####lawilkinson.net
DNS ASK ma#####anwilkinson.net
DNS ASK ma#####anwilkinson.ru
DNS ASK ka#####racaulfield.net
DNS ASK ch#####tacaulfield.net
DNS ASK ka#####rawilkerson.net
DNS ASK ch#####tawilkerson.net
DNS ASK ka#####ramathewson.net
DNS ASK ka#####ramathewson.ru
DNS ASK ch#####tamathewson.net
DNS ASK ka#####rawilkinson.net
DNS ASK ch#####tawilkinson.net
DNS ASK ro#####nemarianna.net
DNS ASK ch#####nathrussell.net
DNS ASK ch#####newilkerson.net
DNS ASK cl#####ndwilkerson.ru
DNS ASK ma#####anmarianna.net
DNS ASK ka#####racharleen.ru
DNS ASK ch#####tacharleen.net
DNS ASK ka#####ratallulah.net
DNS ASK ch#####tatallulah.net
DNS ASK ka#####racathleen.net
DNS ASK ch#####tamarianna.net
DNS ASK ch#####tacathleen.net
DNS ASK ch#####tacathleen.ru
DNS ASK ka#####ramarianna.net
DNS ASK co#####cecharleen.net
DNS ASK ha#####tacharleen.net
DNS ASK co#####cetallulah.net
DNS ASK co#####cetallulah.ru
DNS ASK ha#####tatallulah.net
DNS ASK co#####cecathleen.net
DNS ASK ha#####tacathleen.net
DNS ASK co#####cemarianna.net
DNS ASK ha#####tamarianna.net
DNS ASK ha#####tamarianna.ru
DNS ASK ja#####tacathleen.net
DNS ASK ja#####tacharleen.net
DNS ASK ro#####necharleen.net
DNS ASK ja#####tatallulah.net
DNS ASK ro#####netallulah.net
DNS ASK ja#####tacathleen.ru
DNS ASK ja#####tamarianna.net
DNS ASK pr#####lamarianna.net
DNS ASK ma#####ancathleen.net
DNS ASK ka#####racharleen.net
DNS ASK pr#####lacathleen.net
DNS ASK ch#####nemathewson.net
DNS ASK ch#####newilkinson.net
DNS ASK cl#####ndwilkinson.net
DNS ASK ch#####newilkinson.ru
DNS ASK se#####ancaulfield.net
DNS ASK ch#####nacaulfield.net
DNS ASK se#####anwilkerson.net
DNS ASK ch#####nawilkerson.net
DNS ASK se#####anmathewson.net
DNS ASK se#####anmathewson.ru
DNS ASK ch#####namathewson.net
DNS ASK ch#####nawilkinson.net
DNS ASK se#####anwilkinson.net
DNS ASK ja#####yncharleen.net
DNS ASK la#####iacharleen.net
DNS ASK de#####stcharleen.ru
DNS ASK de#####sttallulah.net
DNS ASK la#####iacathleen.net
DNS ASK la#####iatallulah.net
DNS ASK de#####stcathleen.net
DNS ASK la#####iamarianna.ru
DNS ASK la#####iamarianna.net
DNS ASK de#####stmarianna.net
DNS ASK pr#####lacharleen.net
DNS ASK ma#####antallulah.net
DNS ASK ma#####ancharleen.net
DNS ASK pr#####latallulah.net
DNS ASK ma#####antallulah.ru
DNS ASK cl#####ndmathewson.net
DNS ASK cr#####onpemberton.net

Miscellaneous

Creates and executes the following

'C:\mtdlkdn0w1be\wqroqgoo7ftuknowfixs.exe'
'C:\mtdlkdn0w1be\cmfqirbn.exe'
'C:\mtdlkdn0w1be\tgqdcy5br.exe' "c:\mtdlkdn0w1be\cmfqirbn.exe"

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial