Trojan.DownLoader11.44668

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\AriavpnConnection\AriavpnConnection.exe'

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\AriavpnConnection\PrxDrvPE64.dll
%PROGRAM_FILES%\AriavpnConnection\pshow
%PROGRAM_FILES%\AriavpnConnection\ProxyChecker.exe
%PROGRAM_FILES%\AriavpnConnection\PrxDrvPE.dll
%PROGRAM_FILES%\AriavpnConnection\Settings.dll
%PROGRAM_FILES%\AriavpnConnection\pc2nl\ssleay32.dll
%PROGRAM_FILES%\AriavpnConnection\pc2nl\stunnel.conf
%PROGRAM_FILES%\AriavpnConnection\Settings.ini
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\bin\ssleay32.dll
%PROGRAM_FILES%\AriavpnConnection\p
%PROGRAM_FILES%\AriavpnConnection\pc2nl\padlock.dll
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\OpenVPNPortable.ini
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\bin\openvpnserv.exe
%PROGRAM_FILES%\AriavpnConnection\panel.txt
%PROGRAM_FILES%\AriavpnConnection\PM9.exe
%PROGRAM_FILES%\AriavpnConnection\Proxifier.exe
%PROGRAM_FILES%\AriavpnConnection\password.txt
%PROGRAM_FILES%\AriavpnConnection\pc2nl\pc2nl.exe
%PROGRAM_FILES%\AriavpnConnection\support.txt
%PROGRAM_FILES%\AriavpnConnection\pc2nl\zlib1.dll
%HOMEPATH%\Start Menu\Programs\AriavpnConnection\AriavpnConnection Uninstaller.lnk
%PROGRAM_FILES%\AriavpnConnection\xmllite.dll
%PROGRAM_FILES%\AriavpnConnection\zbd.dll
%HOMEPATH%\Desktop\AriavpnConnection.lnk
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs1.js
%HOMEPATH%\Start Menu\Programs\AriavpnConnection\AriavpnConnection.lnk
%WINDIR%\AriavpnConnection Uninstaller.exe
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\driver\win32\tap0901.cat
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\driver\win32\tap0901.sys
%PROGRAM_FILES%\AriavpnConnection\pc2nl\sureware.dll
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\driver\win64\tap0901.cat
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\driver\win64\tap0901.sys
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\bin\TinyOpenVPNGui.exe
%PROGRAM_FILES%\AriavpnConnection\pc2nl\ubsec.dll
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\bin\tapinstallWin32.exe
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\bin\tapinstallWin64.exe
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\OPENVPN.exe
%PROGRAM_FILES%\AriavpnConnection\Boxed IP updated Icon 03.ico
%PROGRAM_FILES%\AriavpnConnection\pc2nl\capi.dll
%PROGRAM_FILES%\AriavpnConnection\pc2nl\atalla.dll
%PROGRAM_FILES%\AriavpnConnection\aval
%PROGRAM_FILES%\AriavpnConnection\pc2nl\chil.dll
%PROGRAM_FILES%\AriavpnConnection\Profiles\Default.ppx
%PROGRAM_FILES%\AriavpnConnection\pc2nl\gmp.dll
%PROGRAM_FILES%\AriavpnConnection\cpaiam.txt
%PROGRAM_FILES%\AriavpnConnection\pc2nl\cswift.dll
%TEMP%\aiw167109.bmp
%TEMP%\aiw167234.bmp
%TEMP%\aiw166921.bmp
%TEMP%\aiw167015.bmp
%TEMP%\aiw167312.bmp
%PROGRAM_FILES%\AriavpnConnection\pc2nl\aep.dll
%PROGRAM_FILES%\AriavpnConnection\AriavpnConnection.exe
%TEMP%\aiw167390.EXE
%PROGRAM_FILES%\AriavpnConnection\pc2nl\4758cca.dll
%PROGRAM_FILES%\AriavpnConnection\pc2nl\gost.dll
%PROGRAM_FILES%\AriavpnConnection\network_places.ico
%PROGRAM_FILES%\AriavpnConnection\pc2nl\nuron.dll
%PROGRAM_FILES%\AriavpnConnection\pc2nl\msvcr90.dll
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\bin\msvcr90.dll
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\driver\win64\OemWin2k.inf
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\bin\openvpn-gui.exe
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\bin\openvpn.exe
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\driver\win32\OemWin2k.inf
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\bin\openssl.exe
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\data\config\information.txt
%PROGRAM_FILES%\AriavpnConnection\pc2nl\libeay32.dll
%PROGRAM_FILES%\AriavpnConnection\Helper64.exe
%PROGRAM_FILES%\AriavpnConnection\INET.exe
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\bin\libeay32.dll
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\bin\lzo2.dll
<SYSTEM32>\MSINET.OCX
%PROGRAM_FILES%\AriavpnConnection\OPENVPN1\app\bin\libpkcs11-helper-1.dll
%PROGRAM_FILES%\AriavpnConnection\link.txt