Trojan.Siggen31.36747

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%WINDIR%\tasks\googleupdatetaskmachinecore.job
<SYSTEM32>\tasks\googleupdatetaskmachinecore
%WINDIR%\tasks\googleupdatetaskmachineua.job
<SYSTEM32>\tasks\googleupdatetaskmachineua

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\gupdate] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\gupdate] 'ImagePath' = '"%ProgramFiles(x86)%\Google\Update\GoogleUpdate.exe" /svc'
[HKLM\System\CurrentControlSet\Services\gupdatem] 'ImagePath' = '"%ProgramFiles(x86)%\Google\Update\GoogleUpdate.exe" /medsvc'

Creates the following services

'gupdate' %ProgramFiles(x86)%\Google�pdate\GoogleUpdate.exe" /sv
'gupdatem' %ProgramFiles(x86)%\Google�pdate\GoogleUpdate.exe" /medsv

Malicious functions

Launches a large number of processes

Reads files which store third party applications passwords

%HOMEPATH%\desktop\api-hashmap.html
%APPDATA%\mozilla\firefox\profiles.ini
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\browse.htm

Modifies file system

Creates the following files

%TEMP%\etilqs_glonb9w1zblelil
%TEMP%\etilqs_vmfk9ph66rqgk50
%TEMP%\etilqs_xr5ao4wkhsfy30i
%TEMP%\etilqs_m60bshykwg1eqsg
%TEMP%\etilqs_aejartyk41egpyv
%TEMP%\etilqs_sedknpodz8cbjyi
%TEMP%\etilqs_au5ojhbxji6074y
%TEMP%\etilqs_bbd9yznrdrdaaci
%TEMP%\etilqs_qhggcn9wsdqydom
%TEMP%\etilqs_t5idvv72dw9dhrk
%ProgramFiles(x86)%\gutf67f.tmp
%ProgramFiles(x86)%\gumf67e.tmp\googleupdate.exe
%ProgramFiles(x86)%\gumf67e.tmp\googlecrashhandler.exe
%ProgramFiles(x86)%\gumf67e.tmp\goopdate.dll
%ProgramFiles(x86)%\gumf67e.tmp\npgoogleupdate3.dll
%ProgramFiles(x86)%\gumf67e.tmp\googleupdatehelper.msi
%ProgramFiles(x86)%\gumf67e.tmp\googleupdatebroker.exe
%ProgramFiles(x86)%\gumf67e.tmp\googleupdateondemand.exe
%ProgramFiles(x86)%\gumf67e.tmp\googleupdatecomregistershell64.exe
%ProgramFiles(x86)%\gumf67e.tmp\psmachine.dll
%ProgramFiles(x86)%\gumf67e.tmp\psmachine_64.dll
%ProgramFiles(x86)%\gumf67e.tmp\psuser.dll
%ProgramFiles(x86)%\gumf67e.tmp\psuser_64.dll
%ProgramFiles(x86)%\gumf67e.tmp\googlecrashhandler64.exe
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_am.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_ar.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_bg.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_bn.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_ca.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_cs.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_da.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_de.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_el.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_en.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_en-gb.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_es.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_es-419.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_et.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_fa.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_fi.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_fil.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_fr.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_gu.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_hi.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_hr.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_hu.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_id.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_is.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_it.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_iw.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_ja.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_kn.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_ko.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_lt.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_lv.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_ml.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_mr.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_ms.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_nl.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_no.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_pl.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_pt-br.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_pt-pt.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_ro.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_ru.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_sk.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_sl.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_sr.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_sv.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_sw.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_ta.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_te.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_th.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_tr.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_uk.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_ur.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_vi.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_zh-cn.dll
%ProgramFiles(x86)%\gumf67e.tmp\goopdateres_zh-tw.dll
%ProgramFiles(x86)%\gumf67e.tmp\googleupdatesetup.exe
%ProgramFiles(x86)%\google\update\1.3.25.11\googleupdate.exe
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdate.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\googlecrashhandler.exe
%ProgramFiles(x86)%\google\update\1.3.25.11\googlecrashhandler64.exe
%ProgramFiles(x86)%\google\update\1.3.25.11\googleupdatecomregistershell64.exe
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_am.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_ar.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_bg.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_bn.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_ca.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_cs.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_da.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_de.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_el.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_en.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_en-gb.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_es.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_es-419.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_et.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_fa.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_fi.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_fil.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_fr.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_gu.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_hi.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_hr.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_hu.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_id.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_is.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_it.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_iw.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_ja.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_kn.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_ko.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_lt.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_lv.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_ml.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_mr.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_ms.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_nl.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_no.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_pl.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_pt-br.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_pt-pt.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_ro.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_ru.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_sk.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_sl.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_sr.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_sv.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_sw.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_ta.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_te.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_th.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_tr.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_uk.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_ur.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_vi.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_zh-cn.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\goopdateres_zh-tw.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\googleupdatehelper.msi
%ProgramFiles(x86)%\google\update\1.3.25.11\psuser.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\psuser_64.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\psmachine.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\psmachine_64.dll
%ProgramFiles(x86)%\google\update\googleupdate.exe
%ProgramFiles(x86)%\google\update\1.3.25.11\googleupdatesetup.exe
%ProgramFiles(x86)%\google\update\1.3.25.11\npgoogleupdate3.dll
%ProgramFiles(x86)%\google\update\1.3.25.11\googleupdatebroker.exe
%ProgramFiles(x86)%\google\update\1.3.25.11\googleupdateondemand.exe
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
%HOMEPATH%\desktop\~$hd_and_obesity.docx
%TEMP%\etilqs_qzvya0b0dj0uziq
%TEMP%\etilqs_gcbund8wmwx31li

Modifies the following files

Network activity

Connects to

'st####.femscat.com':443
'au######te.geo.opera.com':80
'au######te.geo.opera.com':443
'google.com':80
'se####.yahoo.com':80
'du###uckgo.com':443
'am##on.com':80
'bing.com':80
'am##on.com':443
'se####.yahoo.com':443
'en.###ipedia.org':80
'en.###ipedia.org':443
'pk#.goog':80
'st####.yezzclips.com':443
'si#####ck2.opera.com':443
'yo##ube.com':443
're###.opera.com':80
'fa###ook.com':80
'bl#####st.rkn.gov.ru':80
'bl#####st.rkn.gov.ru':443
'sd#####es.operacdn.com':443
'ro###.ebay.com':80
'tw##ter.com':80
'bo##ing.com':80
'ro###.ebay.com':443
'bo##ing.com':443
'oc##.#ectigo.com':80
's.##mg.com':443
'fo###.#oogleapis.com':443
'fo###.gstatic.com':443
'pa##al.com':443
'pa####objects.com':443
'ca####e-ebook.com':80
'ca####e-ebook.com':443
'x1.#.lencr.org':80

TCP

HTTP GET requests

http://au######te.geo.opera.com/geolocation/
http://www.google.com/favicon.ico
http://www.am##on.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://en.###ipedia.org/favicon.ico
http://pk#.goog/gsr1/gsr1.crt
http://re###.opera.com/speeddials/partner/facebook
http://www.fa###ook.com/campaign/landing.php?ca#########################
http://bl#####st.rkn.gov.ru/
http://bl#####st.rkn.gov.ru/DDoS01/3f3a321b/
http://re###.opera.com/speeddials/partner/amazon_us
http://re###.opera.com/speeddials/partner/ebay_us
http://re###.opera.com/speeddials/partner/yahoo
http://re###.opera.com/speeddials/partner/twitter_us
http://re###.opera.com/speeddials/partner/booking_com_us
http://re###.opera.com/speeddials/partner/product
http://re###.opera.com/speeddials/partner/youtube
http://re###.opera.com/speeddials/partner/wikipedia_org_us
http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
http://www.ya##o.com/?il#####
http://www.tw##ter.com/?pa################
http://www.op##a.com/follow?ut###############################################################################################
http://www.bo##ing.com/index.html?ai##########################################################################################
http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEDD%2FwfLpTBvFeUXhTs4iywM%3D
http://re###.opera.com/favicon.ico
http://ca####e-ebook.com/favicon.ico
http://x1.#.lencr.org/

Other

'au######te.geo.opera.com':443
'du###uckgo.com':443
'am##on.com':443
'se####.yahoo.com':443
'en.###ipedia.org':443
'si#####ck2.opera.com':443
'yo##ube.com':443
'bl#####st.rkn.gov.ru':443
'sd#####es.operacdn.com':443
'ya##o.com':443
'op##a.com':443
'bo##ing.com':443
'ro###.ebay.com':443
'fo###.#oogleapis.com':443
'fo###.gstatic.com':443
'pa##al.com':443
'pa####objects.com':443
'ca####e-ebook.com':443

UDP

DNS ASK st####.femscat.com
DNS ASK google.com
DNS ASK au######te.geo.opera.com
DNS ASK se####.yahoo.com
DNS ASK du###uckgo.com
DNS ASK am##on.com
DNS ASK bing.com
DNS ASK bi##.#ikimedia.org
DNS ASK en.###ipedia.org
DNS ASK pk#.goog
DNS ASK st####.yezzclips.com
DNS ASK si#####ck2.opera.com
DNS ASK yo##ube.com
DNS ASK re###.opera.com
DNS ASK fa###ook.com
DNS ASK bl#####st.rkn.gov.ru
DNS ASK sd#####es.operacdn.com
DNS ASK ro###.ebay.com
DNS ASK ya##o.com
DNS ASK bo##ing.com
DNS ASK tw##ter.com
DNS ASK op##a.com
DNS ASK oc##.#ectigo.com
DNS ASK s.##mg.com
DNS ASK fo###.#oogleapis.com
DNS ASK fo###.gstatic.com
DNS ASK pa##al.com
DNS ASK pa####objects.com
DNS ASK ca####e-ebook.com
DNS ASK x1.#.lencr.org

Miscellaneous

Searches for the following windows

ClassName: 'Button' WindowName: ''
ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'

Creates and executes the following

'%ProgramFiles(x86)%\gumf67e.tmp\googleupdate.exe' /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={3996D052-26B6-C178-E9E5-B86A7717C1CC}&lang=ru&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=pre...
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /regsvc
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /regserver
'%ProgramFiles(x86)%\google\update\1.3.25.11\googleupdatecomregistershell64.exe'
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjUuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4yNS4xMSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InsxRUQ0MTg...
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={3996D052-26B6-C178-E9E5-B86A7717C1CC}&lang=ru&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers" /installsource tag...
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /svc
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjUuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4yNS4xMSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InswMEJDNDh...
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjUuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4yNS4xMSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins3MkZGMDl...

Executes the following

'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3 /crash-reporter-parent-id=2480
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.3.505978936\1457628966" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.4.790042518\1447934017" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.5.1108369047\894098874" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.6.1240083763\718270860" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.7.1181301134\1935184307" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.8.1978523867\1444577435" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.9.187132771\1387247867" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2480.3.505978936\1457628966" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=1548
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.10.108951259\1101787337" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.11.1679998677\285155247" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.12.584090173\1444446723" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.15.332160280\1733873253" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.16.1233014153\1487372231" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles%\microsoft office\office14\winword.exe' /n "%HOMEPATH%\Desktop\508softwareandos.doc"
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "%HOMEPATH%\Desktop\64bit_notes.htm"
'%ProgramFiles%\microsoft office\office14\winword.exe' /n "%HOMEPATH%\Desktop\adhd_and_obesity.docx"
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "%HOMEPATH%\Desktop\alert.htm"
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "%HOMEPATH%\Desktop\alert.html"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\alert.html"
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "%HOMEPATH%\Desktop\api-hashmap.html"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\64bit_notes.htm"
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "%HOMEPATH%\Desktop\browse.htm"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\api-hashmap.html"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\browse.htm"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\api-hashmap.html" /crash-reporter-parent-id=1736
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.17.342799880\8724487" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\alert.htm"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\alert.html" /crash-reporter-parent-id=1728
'<SYSTEM32>\rundll32.exe' cryptext.dll,CryptExtOpenCER %HOMEPATH%\Desktop\contosoroot_1.cer
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\64bit_notes.htm" /crash-reporter-parent-id=296
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\alert.htm" /crash-reporter-parent-id=2716
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\browse.htm" /crash-reporter-parent-id=172
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.18.108047544\475544989" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.19.1822460472\741708869" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\windows media player\wmplayer.exe' /prefetch:8 /Open "%HOMEPATH%\Desktop\delete.avi"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.21.957480692\1946189773" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'<SYSTEM32>\notepad.exe' %HOMEPATH%\Desktop\desktop.ini
'%ProgramFiles%\microsoft office\office14\winword.exe' /n "%HOMEPATH%\Desktop\february_catalogue__2015.doc"
'%ProgramFiles%\microsoft office\office14\winword.exe' /n "%HOMEPATH%\Desktop\file_p_00000000_1371597592.docx"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2480.26.1976540462\1399844210" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles%\microsoft office\office14\winword.exe' /n "%HOMEPATH%\Desktop\glidescope_review_rev_010.docx"
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "%HOMEPATH%\Desktop\iisstart.htm"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\iisstart.htm"
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "%HOMEPATH%\Desktop\iisstart.html"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\iisstart.html"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\iisstart.htm" /crash-reporter-parent-id=3756
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\iisstart.html" /crash-reporter-parent-id=3780
'%ProgramFiles%\microsoft office\office14\winword.exe' /n "%HOMEPATH%\Desktop\issi2013_template_for_posters.docx"
'%ProgramFiles(x86)%\windows media player\wmplayer.exe' /prefetch:8 /Open "%HOMEPATH%\Desktop\join.avi"
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "%HOMEPATH%\Desktop\tree_view.htm"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\tree_view.htm"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\tree_view.htm" /crash-reporter-parent-id=2356
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3 /crash-reporter-parent-id=2744
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe'
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3 /crash-reporter-parent-id=3944
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3 /crash-reporter-parent-id=3248
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3 /crash-reporter-parent-id=1744
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3 /crash-reporter-parent-id=4136
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3 /crash-reporter-parent-id=4116
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3 /crash-reporter-parent-id=4320
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3 /crash-reporter-parent-id=4512
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3 /crash-reporter-parent-id=4536
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/embed/3?autoplay=1&loop=1&playlist=3 /crash-reporter-parent-id=4676
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\64bit_notes.htm" /crash-reporter-parent-id=2908
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\alert.htm" /crash-reporter-parent-id=3372
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\alert.html" /crash-reporter-parent-id=4828
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\api-hashmap.html" /crash-reporter-parent-id=4084
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\browse.htm" /crash-reporter-parent-id=2748
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\64bit_notes.htm" /crash-reporter-parent-id=4324
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\alert.htm" /crash-reporter-parent-id=4476
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\alert.html" /crash-reporter-parent-id=5016
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\api-hashmap.html" /crash-reporter-parent-id=4516
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\browse.htm" /crash-reporter-parent-id=2684
'%APPDATA%\cloneworm\clone_1_0.exe' ' (with hidden window)
'%APPDATA%\cloneworm\clone_1_1.exe' ' (with hidden window)
'%APPDATA%\cloneworm\clone_1_2.exe' ' (with hidden window)
'%APPDATA%\cloneworm\clone_1_3.exe' ' (with hidden window)
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' ' (with hidden window)
'%APPDATA%\cloneworm\clone_1_5.exe' ' (with hidden window)
'%APPDATA%\cloneworm\clone_1_6.exe' ' (with hidden window)
'%APPDATA%\cloneworm\clone_1_7.exe' ' (with hidden window)
'%APPDATA%\cloneworm\clone_1_8.exe' ' (with hidden window)
'%APPDATA%\cloneworm\clone_1_9.exe' ' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial