Trojan.DownLoader11.46168

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\is-BEE48.tmp\Setup.tmp' /SL5="$100E2,1372949,114176,%TEMP%\Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\Setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Завершает или пытается завершить

следующие пользовательские процессы:

opera.exe
firefox.exe
iexplore.exe

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\InnoExtractor\Idiomas\is-7UFQK.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-U4D23.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-IUG0B.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-1R3UH.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-I24OE.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-DUHVJ.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-4RCSH.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-A252B.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-5LLR6.tmp
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\InnoExtractor.lnk
%ALLUSERSPROFILE%\Desktop\InnoExtractor.lnk
%PROGRAM_FILES%\InnoExtractor\Ini.dat
%PROGRAM_FILES%\InnoExtractor\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\InnoExtractor\Uninstall InnoExtractor.lnk
%APPDATA%\InnoExtractor\is-J0J6E.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-GAPGL.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\InnoExtractor\Havysoft Website.url
%ALLUSERSPROFILE%\Start Menu\Programs\InnoExtractor\InnoExtractor.lnk
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-JTV5C.tmp
%PROGRAM_FILES%\InnoExtractor\is-H2N25.tmp
%PROGRAM_FILES%\InnoExtractor\is-2HAQB.tmp
%PROGRAM_FILES%\InnoExtractor\is-18N53.tmp
%PROGRAM_FILES%\InnoExtractor\is-JOCBE.tmp
%PROGRAM_FILES%\InnoExtractor\is-PACRE.tmp
%TEMP%\Setup.exe
%TEMP%\aut1.tmp
%TEMP%\is-FM7E3.tmp\_isetup\_shfoldr.dll
%TEMP%\is-BEE48.tmp\Setup.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-2B46T.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-JV9CR.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-OICOC.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-CVRCE.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-Q5H6F.tmp
%PROGRAM_FILES%\InnoExtractor\is-V3EI1.tmp
%PROGRAM_FILES%\InnoExtractor\is-51MTN.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-UI6VR.tmp
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-B58LP.tmp

Удаляет следующие файлы:

%TEMP%\is-BEE48.tmp\Setup.tmp
%TEMP%\Setup.exe
%TEMP%\aut1.tmp
%TEMP%\is-FM7E3.tmp\_isetup\_shfoldr.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\InnoExtractor\Idiomas\is-DUHVJ.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Italian.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-5LLR6.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Japanese.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-A252B.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Korean.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-OICOC.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\German.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-JTV5C.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Greek.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-4RCSH.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Hungarian.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-I24OE.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Polish.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-IUG0B.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Spanish.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-GAPGL.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Turkish.lng
%APPDATA%\InnoExtractor\is-J0J6E.tmp в %APPDATA%\InnoExtractor\Config.ini
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-U4D23.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Portuguese.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-7UFQK.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Russian.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-1R3UH.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Slovak.lng
%PROGRAM_FILES%\InnoExtractor\is-JOCBE.tmp в %PROGRAM_FILES%\InnoExtractor\7zSD.e32
%PROGRAM_FILES%\InnoExtractor\is-18N53.tmp в %PROGRAM_FILES%\InnoExtractor\InnoExtractor.exe
%PROGRAM_FILES%\InnoExtractor\is-51MTN.tmp в %PROGRAM_FILES%\InnoExtractor\Innounp.e32
%PROGRAM_FILES%\InnoExtractor\is-PACRE.tmp в %PROGRAM_FILES%\InnoExtractor\unins000.exe
%PROGRAM_FILES%\InnoExtractor\is-2HAQB.tmp в %PROGRAM_FILES%\InnoExtractor\7z.dll
%PROGRAM_FILES%\InnoExtractor\is-H2N25.tmp в %PROGRAM_FILES%\InnoExtractor\7z.e32
%PROGRAM_FILES%\InnoExtractor\is-V3EI1.tmp в %PROGRAM_FILES%\InnoExtractor\Rops.e32
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-JV9CR.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Dutch.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-2B46T.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\English.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-CVRCE.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\French.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-B58LP.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Arabic.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-UI6VR.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Chinese.lng
%PROGRAM_FILES%\InnoExtractor\Idiomas\is-Q5H6F.tmp в %PROGRAM_FILES%\InnoExtractor\Idiomas\Czech.lng