Trojan.PWS.Siggen3.27115

Техническая информация

Вредоносные функции

Внедряет код в

следующие системные процессы:

%WINDIR%\microsoft.net\framework64\v4.0.30319\addinprocess32.exe

Завершает или пытается завершить

следующие системные процессы:

%WINDIR%\microsoft.net\framework64\v4.0.30319\dfsvc.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.02558\setuputility.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\ilasm.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\mscorsvw.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\smsvchost.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regsql.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\comsvcconfig.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_wp.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\addinutil.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\regtlibv12.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_state.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\edmgen.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\installutil.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\wsatconfig.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\jsc.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regiis.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_compiler.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\regsvcs.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\applaunch.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regbrowsers.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\datasvcutil.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\caspol.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\addinprocess.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\servicemodelreg.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\microsoft.workflow.compiler.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\vbc.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.02558\setup.exe