Техническая информация
Вредоносные функции:
Запускает на исполнение:
- 'C:\bcaadae33fcfd79a72bfaf8529\install.exe' "/q:a"
- '<SYSTEM32>\msiexec.exe' /V
- '%ProgramFiles%\MonitorDriver\vcredist_x86.exe' "/q:a"
- '%TEMP%\1e76d\<Имя файла>.exe'
- '%TEMP%\Samsung_MonSetup_091006.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setup.ini
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %ALLUSERSPROFILE%\Desktop\Launch Monitor Driver Installer.lnk
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\ISSe9432.rra
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setu9490.rra
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setu94cf.rra
- C:\bcaadae33fcfd79a72bfaf8529\vc_red.msi
- C:\bcaadae33fcfd79a72bfaf8529\install.exe
- C:\bcaadae33fcfd79a72bfaf8529\install.res.1033.dll
- %ProgramFiles%\MonitorDriver\MonS96b3.rra
- %ProgramFiles%\MonitorDriver\vcre96d2.rra
- C:\bcaadae33fcfd79a72bfaf8529\vc_red.cab
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\_set93c5.rra
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\data92bb.rra
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\data92db.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\layo92ac.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setu9377.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setu9329.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\bcaadae33fcfd79a72bfaf8529\install.res.1042.dll
- C:\bcaadae33fcfd79a72bfaf8529\globdata.ini
- C:\bcaadae33fcfd79a72bfaf8529\install.ini
- C:\bcaadae33fcfd79a72bfaf8529\vcredist.bmp
- C:\bcaadae33fcfd79a72bfaf8529\eula.1031.txt
- C:\bcaadae33fcfd79a72bfaf8529\eula.1028.txt
- C:\bcaadae33fcfd79a72bfaf8529\eula.2052.txt
- %WINDIR%\Installer\3a8b4.msi
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
- C:\bcaadae33fcfd79a72bfaf8529\$shtdwn$.req
- %TEMP%\dd_vcredistUI2B0A.txt
- %TEMP%\dd_vcredistMSI2B0A.txt
- C:\bcaadae33fcfd79a72bfaf8529\eula.3082.txt
- C:\bcaadae33fcfd79a72bfaf8529\install.res.3082.dll
- C:\bcaadae33fcfd79a72bfaf8529\install.res.1031.dll
- C:\bcaadae33fcfd79a72bfaf8529\install.res.1028.dll
- C:\bcaadae33fcfd79a72bfaf8529\install.res.1041.dll
- C:\bcaadae33fcfd79a72bfaf8529\install.res.1040.dll
- C:\bcaadae33fcfd79a72bfaf8529\install.res.1036.dll
- C:\bcaadae33fcfd79a72bfaf8529\eula.1041.txt
- C:\bcaadae33fcfd79a72bfaf8529\eula.1040.txt
- C:\bcaadae33fcfd79a72bfaf8529\eula.1036.txt
- C:\bcaadae33fcfd79a72bfaf8529\install.res.2052.dll
- C:\bcaadae33fcfd79a72bfaf8529\eula.1033.txt
- C:\bcaadae33fcfd79a72bfaf8529\eula.1042.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- %APPDATA%\Microsoft\Protect\CREDHIST
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\2d04f5219273b7e242ec142fb0077aee_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\setup.ini
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\Disk1\setup.isn
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\Disk1\setup.iss
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\Disk1\_setup.dll
- %TEMP%\e39f.rra
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\setue48a.rra
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\licee4d8.rra
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\_Setup.dll
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\setup.isn
- %TEMP%\skin34a2.rra
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\Disk1\setup.inx
- %TEMP%\C27F591.inf
- %TEMP%\Samsung_MonSetup_091006.exe
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\_ispackdel.ini
- %TEMP%\1e76d\<Имя файла>.exe
- %TEMP%\c27f591.cat
- %TEMP%\C27F591.icm
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\Disk1\layout.bin
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\Disk1\setup.exe
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\Disk1\setup.ini
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\Disk1\data1.cab
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\Disk1\data1.hdr
- %TEMP%\{AB0F4ACE-DE7C-4DE3-875F-845FF7615678}\Disk1\ISSetup.dll
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\_ISUe4f7.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\Strie584.rra
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\isrte5b3.rra
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\defae620.rra
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\coree516.rra
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\dotne545.rra
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\Fonte564.rra
- %ProgramFiles%\MonitorDriver\C27F77c1.rra
- %ProgramFiles%\MonitorDriver\C27F77f0.rra
- %ProgramFiles%\MonitorDriver\c27f780f.rra
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\_IsRe65e.rra
- %TEMP%\ispre9d9.rra
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\skinea27.rra
Удаляет следующие файлы:
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\skinea27.rra
- %TEMP%\skin34a2.rra
- %TEMP%\1e76d\<Имя файла>.exe
Перемещает следующие файлы:
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\data92db.rra в %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\data1.cab
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setu9329.rra в %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setup.exe
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setu9377.rra в %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setup.isn
- %ProgramFiles%\MonitorDriver\c27f780f.rra в %ProgramFiles%\MonitorDriver\c27f591.cat
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\layo92ac.rra в %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\layout.bin
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\data92bb.rra в %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\data1.hdr
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setu94cf.rra в %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setup.ini
- %ProgramFiles%\MonitorDriver\MonS96b3.rra в %ProgramFiles%\MonitorDriver\MonSetup.exe
- %ProgramFiles%\MonitorDriver\vcre96d2.rra в %ProgramFiles%\MonitorDriver\vcredist_x86.exe
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\_set93c5.rra в %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\_setup.dll
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\ISSe9432.rra в %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\ISSetup.dll
- %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setu9490.rra в %ProgramFiles%\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setup.inx
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\coree516.rra в %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\corecomp.ini
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\dotne545.rra в %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\dotnetinstaller.exe
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\Fonte564.rra в %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\FontData.ini
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\setue48a.rra в %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\setup.inx
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\licee4d8.rra в %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\license.rtf
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\_ISUe4f7.rra в %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\_ISUser.dll
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\_IsRe65e.rra в %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\_IsRes.dll
- %ProgramFiles%\MonitorDriver\C27F77c1.rra в %ProgramFiles%\MonitorDriver\C27F591.inf
- %ProgramFiles%\MonitorDriver\C27F77f0.rra в %ProgramFiles%\MonitorDriver\C27F591.icm
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\Strie584.rra в %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\StringTable-0009-English.ips
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\isrte5b3.rra в %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\isrt.dll
- %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\defae620.rra в %TEMP%\{44E95CD3-C816-46F8-AC55-52D32270E2CD}\{8EA79DBF-D637-448A-89D6-410A087A4493}\default.pal
Сетевая активность:
Подключается к:
- '20#.#6.232.182':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- http://crl.microsoft.com/pki/crl/products/CSPCA.crl via 20#.#6.232.182
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
