Trojan.DownLoader23.15433

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\RaAutoInstSrv_RT2870] 'ImagePath' = '%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\AutoInstSvc\RaAutoInstSrv.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\RaAutoInstSrv_RT2870] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

'%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\AutoInstSvc\RaAutoInstSrv.exe'
'%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\AutoInstSvc\RaAutoInstSrv.exe' /install
'%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\DriverFiles\RaInst.exe' Install "%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\DriverFiles\RT2870.inf"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\RT2870.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\RT2870.sys
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\Uninstall.exe
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\netr28ux.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\netr28u.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\netr28ux.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\netr28ux.sys
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\DriverFiles\FW_7662.bin
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\DriverFiles\RT2870.inf
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\DriverFiles\RT2870.sys
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\DriverFiles\difxapi.dll
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\DriverFiles\rt2870.cat
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\DriverFiles\Patch_7662.bin
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\DriverFiles\RaCoInst.dat
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\DriverFiles\RaCoInst.dll
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x86\InstAPI.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\RaCoInst.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\RaCoInst.dll
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x64\InstAPI.dll
%APPDATA%\MercuryTemp\SetupFiles\Uninst\Uninstall.exe
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x64\difxapi.dll
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x86\difxapi.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\RaCoInst.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\RaCoInstx.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\netr28u.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\netr28u.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\RaCoInstx.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\RaCoInst.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\RaCoInstx.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\RaCoInstx.dll
%WINDIR%\inf\oem3.PNF
%WINDIR%\LastGood\TMP3.tmp
%WINDIR%\Temp\OLD4.tmp
%WINDIR%\inf\oem3.inf
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\AutoInstSvc\RaAutoInstSrv.exe
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\AutoInstSvc\RaAutoInstSrv.ini
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
%WINDIR%\LastGood\TMP5.tmp
%WINDIR%\Temp\OLDA.tmp
%WINDIR%\LastGood\TMPB.tmp
%WINDIR%\Temp\OLDC.tmp
%WINDIR%\LastGood\TMP9.tmp
%WINDIR%\Temp\OLD6.tmp
%WINDIR%\LastGood\TMP7.tmp
%WINDIR%\Temp\OLD8.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\E48DDEA3BF68DF580551FA0F27950B54
%APPDATA%\Microsoft\CryptnetUrlCache\Content\E48DDEA3BF68DF580551FA0F27950B54
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76
%APPDATA%\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\DriverFiles\InstAPI.dll
%ProgramFiles%\MERCURY\MW150UHЈЁГвЗэ°жЈ©1.0\DriverFiles\RaInst.exe
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD
%APPDATA%\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76
<SYSTEM32>\DRVSTORE\RT2870_FBD970DD6740715E7A41B8ACBDB85501A6B2221B\RaCoInst.dll
<SYSTEM32>\DRVSTORE\RT2870_FBD970DD6740715E7A41B8ACBDB85501A6B2221B\FW_7662.bin
<SYSTEM32>\DRVSTORE\RT2870_FBD970DD6740715E7A41B8ACBDB85501A6B2221B\RaCoInst.dat
<SYSTEM32>\DRVSTORE\RT2870_FBD970DD6740715E7A41B8ACBDB85501A6B2221B\Patch_7662.bin
<SYSTEM32>\DRVSTORE\RT2870_FBD970DD6740715E7A41B8ACBDB85501A6B2221B\RT2870.inf
<SYSTEM32>\DRVSTORE\RT2870_FBD970DD6740715E7A41B8ACBDB85501A6B2221B\rt2870.cat
<SYSTEM32>\DRVSTORE\RT2870_FBD970DD6740715E7A41B8ACBDB85501A6B2221B\rt2870.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\FW_2870.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\FW_3573.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\FW_3573.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\FW_2870.bin
%APPDATA%\MercuryTemp\SetupFiles7z
%APPDATA%\MercuryTemp\7zDec.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\FW_2870.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\FW_3573.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\FW_7610.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\FW_7610.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\FW_7610.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\FW_7601.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\FW_7601.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\FW_7601.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\netr28u.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\netr28u.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\netr28ux.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\netr28u.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\netr28ux.inf
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x86\RaInst.exe
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x64\RaInst64.exe
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x64\RaIOx64.exe
%APPDATA%\MercuryTemp\SetupFiles\AutoInstSvc\RaAutoInstSrv.exe
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\netr28ux.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\RT2870.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\RT2870.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\netr28u.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\netr28ux.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\netr28ux.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\netr28u.cat
%APPDATA%\MercuryTemp\SetupFiles\ConfigFile\FilesModifyConfig.ini
%APPDATA%\MercuryTemp\SetupFiles\AutoInstSvc\RaAutoInstSrv.ini
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\netr28u.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\netr28ux.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\rt2870.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\rt2870.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\RaCoInst.dat

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT

Удаляет следующие файлы:

%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\netr28ux.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\netr28ux.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\RaCoInst.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\RaCoInstx.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\netr28ux.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 64bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\FW_3573.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\FW_7601.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\FW_2870.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\RaCoInstx.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\netr28u.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\netr28u.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\netr28u.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\FW_7610.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8.1 32bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x64\RaInst64.exe
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x64\RaIOx64.exe
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x64\InstAPI.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\RT2870.sys
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x64\difxapi.dll
%APPDATA%\MercuryTemp\SetupFiles\Uninst\Uninstall.exe
%APPDATA%\MercuryTemp\SetupFiles7z
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x86\RaInst.exe
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x86\difxapi.dll
%APPDATA%\MercuryTemp\SetupFiles\DriverTool\x86\InstAPI.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\RT2870.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\RT2870.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\RT2870.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\rt2870.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 32bit\RaCoInst.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\RaCoInstx.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\rt2870.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows XP 64bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\netr28u.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\netr28u.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\FW_7601.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\FW_7610.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\RaCoInst.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\netr28u.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\FW_3573.bin
%WINDIR%\Temp\OLD6.tmp
%WINDIR%\Temp\OLD4.tmp
%WINDIR%\Temp\OLD8.tmp
%WINDIR%\Temp\OLDC.tmp
%WINDIR%\Temp\OLDA.tmp
%APPDATA%\MercuryTemp\SetupFiles\ConfigFile\FilesModifyConfig.ini
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 32bit\FW_2870.bin
%APPDATA%\MercuryTemp\SetupFiles\AutoInstSvc\RaAutoInstSrv.ini
%APPDATA%\MercuryTemp\7zDec.dll
%APPDATA%\MercuryTemp\SetupFiles\AutoInstSvc\RaAutoInstSrv.exe
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\netr28ux.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\RaCoInst.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\netr28u.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\netr28u.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\netr28ux.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\netr28ux.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 64bit\netr28ux.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\netr28u.cat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\RaCoInst.dat
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\RaCoInstx.dll
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\Patch_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\netr28ux.inf
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 7 64bit\netr28ux.sys
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\FW_7610.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\FW_7662.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\FW_7601.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\FW_2870.bin
%APPDATA%\MercuryTemp\SetupFiles\Driver\MT7601U\Windows 8 32bit\FW_3573.bin

Перемещает следующие файлы:

%WINDIR%\LastGood\TMP9.tmp в %WINDIR%\LastGood\system32\DRVSTORE\RT2870_FBD970DD6740715E7A41B8ACBDB85501A6B2221B\FW_7662.bin
%WINDIR%\LastGood\TMPB.tmp в %WINDIR%\LastGood\system32\DRVSTORE\RT2870_FBD970DD6740715E7A41B8ACBDB85501A6B2221B\RaCoInst.dat
%WINDIR%\LastGood\TMP7.tmp в %WINDIR%\LastGood\system32\DRVSTORE\RT2870_FBD970DD6740715E7A41B8ACBDB85501A6B2221B\RaCoInst.dll
%WINDIR%\LastGood\TMP3.tmp в %WINDIR%\LastGood\system32\DRVSTORE\RT2870_FBD970DD6740715E7A41B8ACBDB85501A6B2221B\rt2870.sys
%WINDIR%\LastGood\TMP5.tmp в %WINDIR%\LastGood\system32\DRVSTORE\RT2870_FBD970DD6740715E7A41B8ACBDB85501A6B2221B\Patch_7662.bin

Сетевая активность:

Подключается к:

'20#.#6.232.182':80
'wp#d':80

TCP:

Запросы HTTP GET:

http://www.microsoft.com/pki/CRL/products/Microsoft%20Windows%20Hardware%20Compatibility%20PCA(1).crl via 20#.#6.232.182
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl via 20#.#6.232.182
http://11#.#11.111.1/wpad.dat via wp#d
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl via 20#.#6.232.182

UDP:

DNS ASK www.microsoft.com
DNS ASK crl.microsoft.com
DNS ASK wp#d

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней