Trojan.DownLoader11.26537

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\Microsoft Visual Studio 2012.exe'
'%TEMP%\marcoall.exe'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1046\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1045\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1044\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1053\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1051\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1049\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1043\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1038\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1036\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1035\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1042\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1041\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1040\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1055\mbapreq.wxl
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21
%APPDATA%\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD
<SYSTEM32>\d3d9caps.tmp
<SYSTEM32>\d3d9caps.dat
%APPDATA%\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21
%TEMP%\dd_vs_testprofessional_20140730124103.log
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\2070\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\2052\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1060\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\BootstrapperApplicationData.xml
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\HighContrastThemes.xaml
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\3082\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\res\info.ico
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\res\stop.ico
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\BootstrapperCore.dll
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\mbapreq.dll
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\License.htm
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\SkuResources.xaml
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\AdminDeployment.xsd
%TEMP%\aut2.tmp
%TEMP%\marcoall.exe
%TEMP%\aut1.tmp
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\ManagedUx.dll
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\mbahost.dll
%TEMP%\Microsoft Visual Studio 2012.exe
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\mbapreq.thm
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1029\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\HighContrastSkuResources.xaml
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\Themes.xaml
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1032\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1031\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1030\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\BootstrapperCore.config
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\res\warn.ico
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\mbapreq.png
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\1028\mbapreq.wxl
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\LocalizableStrings.xml
%TEMP%\{66c44a00-a542-4e5b-b5c6-32adf082b748}\.ba1\sqmapi.dll