Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s /u %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\InstallHelper.dll
- '%TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\setup.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Disk188f.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\devc1802.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\devA1766.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Plug19c7.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\msvc194a.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Firs18fc.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\setu13cc.rra
- %TEMP%\112c.rra
- %TEMP%\{D4216CB5-1DD0-4A06-8F55-50828CB201E0}\_Setup.dll
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\devI16ab.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Inst15a1.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\lice1534.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\isrt1b4e.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Stri1b2f.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\DIFx1b10.rra
- %ALLUSERSPROFILE%\Application Data\Atheros\atheros_installer.log
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\_IsR1bac.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\defa1b8d.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\_ISU1a73.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\lice1a54.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\smal1a25.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Font1af0.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\dotn1ac1.rra
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\core1aa2.rra
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\Notes.txt
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\netathwx.inf
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\netathwx.cat
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\setup.iss
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\setup.inx
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\setup.ini
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\data2.cab
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\data1.hdr
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\data1.cab
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\netathw.inf
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\netathw.cat
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\layout.bin
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\_Setup.dll
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\setup.exe
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\ISSetup.dll
- %TEMP%\{D4216CB5-1DD0-4A06-8F55-50828CB201E0}\setup.ini
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\eea02f38595fd7c8f2957106e40ed7a9_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\Microsoft\Protect\CREDHIST
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\SilentInstall.bat
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\SETUP_ISS\UNINSTALL\setup.iss
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\SETUP_ISS\INSTALL\setup.iss
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\athwx.sys
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\athw.sys
- %TEMP%\7zS48B440F1\Wireless_Foxconn Atheros_v7.6.1.140_XPx86\SilentUninstall.bat
Удаляет следующие файлы:
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\license.txt
Перемещает следующие файлы:
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\dotn1ac1.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\dotnetinstaller.exe
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Font1af0.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\FontData.ini
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\core1aa2.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\corecomp.ini
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\smal1a25.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\small_logo.bmp
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\_ISU1a73.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\_ISUser.dll
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\defa1b8d.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\default.pal
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\_IsR1bac.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\_IsRes.dll
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\isrt1b4e.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\isrt.dll
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\DIFx1b10.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\DIFxData.ini
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Stri1b2f.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\StringTable-0009-English.ips
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\devI16ab.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\devIA64.exe
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\devA1766.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\devAMD64.exe
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Inst15a1.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\InstallHelper.dll
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\setu13cc.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\setup.inx
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\lice1534.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\license.txt
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\msvc194a.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\msvcp60.dll
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Plug19c7.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\PlugPlayPCIDevice.exe
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Firs18fc.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\FirstRemove.exe
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\devc1802.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\devcon.exe
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Disk188f.rra в %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\DiskList.txt
Подменяет следующие файлы:
- %TEMP%\{EE54C1EF-D88C-48D1-9E96-27E88E2B7448}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\license.txt
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
