Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '{e2803110-78b3-4664-a479-3611a381656a}' = '"%ALLUSERSPROFILE%\Application Data\Package Cache\{e2803110-78b3-4664-a479-3611a381656a}\V...
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\is-BQD9N.tmp\<Имя файла>.tmp
- <SYSTEM32>\api-ms-win-core-profile-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-rtlsupport-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-string-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-synch-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-synch-l1-2-0.dll
- <SYSTEM32>\api-ms-win-core-sysinfo-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-util-l1-1-0.dll
- <SYSTEM32>\api-ms-win-crt-multibyte-l1-1-0.dll
- <SYSTEM32>\api-ms-win-crt-conio-l1-1-0.dll
- <SYSTEM32>\api-ms-win-crt-convert-l1-1-0.dll
- <SYSTEM32>\api-ms-win-crt-environment-l1-1-0.dll
- <SYSTEM32>\api-ms-win-crt-filesystem-l1-1-0.dll
- <SYSTEM32>\api-ms-win-crt-heap-l1-1-0.dll
- <SYSTEM32>\api-ms-win-crt-locale-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-timezone-l1-1-0.dll
- <SYSTEM32>\api-ms-win-crt-math-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-processenvironment-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-namedpipe-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-memory-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-localization-l1-2-0.dll
- <SYSTEM32>\api-ms-win-core-libraryloader-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-interlocked-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-heap-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-handle-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-file-l2-1-0.dll
- <SYSTEM32>\api-ms-win-core-file-l1-2-0.dll
- <SYSTEM32>\api-ms-win-core-file-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-errorhandling-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-debug-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-datetime-l1-1-0.dll
- <SYSTEM32>\api-ms-win-core-processthreads-l1-1-1.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- <SYSTEM32>\api-ms-win-crt-private-l1-1-0.dll
- <SYSTEM32>\mfcm140.dll
- %WINDIR%\Installer\MSI4.tmp
- C:\Config.Msi\37095.rbs
- <SYSTEM32>\mfc140.dll
- <SYSTEM32>\mfc140chs.dll
- <SYSTEM32>\mfc140cht.dll
- <SYSTEM32>\mfc140deu.dll
- <SYSTEM32>\mfc140esn.dll
- <SYSTEM32>\api-ms-win-crt-process-l1-1-0.dll
- <SYSTEM32>\mfc140fra.dll
- <SYSTEM32>\mfc140ita.dll
- <SYSTEM32>\mfc140jpn.dll
- <SYSTEM32>\mfc140kor.dll
- <SYSTEM32>\mfc140rus.dll
- <SYSTEM32>\mfc140u.dll
- %WINDIR%\Installer\37094.ipi
- %WINDIR%\Installer\37092.msi
- <SYSTEM32>\api-ms-win-crt-runtime-l1-1-0.dll
- <SYSTEM32>\ucrtbase.dll
- %TEMP%\dd_vcredist_x86_20180517010421_001_vcRuntimeAdditional_x86.log
- %WINDIR%\Installer\37091.msi
- <SYSTEM32>\vcruntime140.dll
- <SYSTEM32>\vcomp140.dll
- <SYSTEM32>\vccorlib140.dll
- <SYSTEM32>\api-ms-win-core-processthreads-l1-1-0.dll
- <SYSTEM32>\vcamp140.dll
- <SYSTEM32>\api-ms-win-core-console-l1-1-0.dll
- <SYSTEM32>\concrt140.dll
- <SYSTEM32>\api-ms-win-crt-utility-l1-1-0.dll
- <SYSTEM32>\api-ms-win-crt-time-l1-1-0.dll
- <SYSTEM32>\api-ms-win-crt-string-l1-1-0.dll
- <SYSTEM32>\api-ms-win-crt-stdio-l1-1-0.dll
- <SYSTEM32>\msvcp140.dll
- C:\Config.Msi\37090.rbs
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\3708f.ipi
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\3082\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1049\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1046\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1045\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1042\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1041\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1040\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1036\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1031\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1029\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1028\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\logo.png
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\thm.xml
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\2052\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1040\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1055\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1049\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1046\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1045\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1042\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1041\license.rtf
- <SYSTEM32>\mfcm140u.dll
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1036\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1031\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1029\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1028\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\wixstdba.dll
- %TEMP%\is-QULLV.tmp\vcredist_x86_2015_VSU3.exe
- %TEMP%\Setup Log 2018-05-17 #001.txt
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\2052\thm.wxl
- <SYSTEM32>\mfc140enu.dll
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\3082\thm.wxl
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %ALLUSERSPROFILE%\Application Data\Package Cache\{e2803110-78b3-4664-a479-3611a381656a}\state.rsm
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\vcRuntimeMinimum_x86
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\vcRuntimeAdditional_x86
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1055\thm.wxl
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\cab54A5CABBE7274D8A22EB58060AAB7623
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\cabB3E1576D1FEFBB979E13B1A5379E0B16
- %TEMP%\dd_vcredist_x86_20180517010421_000_vcRuntimeMinimum_x86.log
- %WINDIR%\Installer\3708d.msi
- %ALLUSERSPROFILE%\Application Data\Package Cache\{e2803110-78b3-4664-a479-3611a381656a}\VC_redist.x86.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- %TEMP%\dd_vcredist_x86_20180517010421.log
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\BootstrapperApplicationData.xml
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.be\VC_redist.x86.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- %WINDIR%\Installer\37096.msi
Удаляет следующие файлы:
- %WINDIR%\Installer\MSI1.tmp
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1042\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1045\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1045\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1046\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1046\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1049\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1049\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1055\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1055\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\2052\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\2052\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\3082\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\3082\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\BootstrapperApplicationData.xml
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\logo.png
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1042\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\thm.xml
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1041\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1040\thm.wxl
- C:\Config.Msi\37090.rbs
- %WINDIR%\Installer\3708d.msi
- %WINDIR%\Installer\3708f.ipi
- %WINDIR%\Installer\MSI4.tmp
- C:\Config.Msi\37095.rbs
- %WINDIR%\Installer\37092.msi
- %WINDIR%\Installer\37094.ipi
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.be\VC_redist.x86.exe
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1028\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1028\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1029\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1029\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1031\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1031\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1036\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1036\thm.wxl
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1040\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1041\license.rtf
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\wixstdba.dll
Перемещает следующие файлы:
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\vcRuntimeMinimum_x86 в %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\vcRuntimeMinimum_x86
- %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\vcRuntimeMinimum_x86 в %ALLUSERSPROFILE%\Application Data\Package Cache\{BBF2AC74-720C-3CB3-8291-5E34039232FA}v14.0.24215\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\cab54A5CABBE7274D8A22EB58060AAB7623 в %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\cab54A5CABBE7274D8A22EB58060AAB7623
- %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\cab54A5CABBE7274D8A22EB58060AAB7623 в %ALLUSERSPROFILE%\Application Data\Package Cache\{BBF2AC74-720C-3CB3-8291-5E34039232FA}v14.0.24215\packages\vcRuntimeMinimum_x86\cab1.cab
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\vcRuntimeAdditional_x86 в %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\vcRuntimeAdditional_x86
- %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\vcRuntimeAdditional_x86 в %ALLUSERSPROFILE%\Application Data\Package Cache\{69BCE4AC-9572-3271-A2FB-9423BDA36A43}v14.0.24215\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi
- %TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\cabB3E1576D1FEFBB979E13B1A5379E0B16 в %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\cabB3E1576D1FEFBB979E13B1A5379E0B16
- %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\cabB3E1576D1FEFBB979E13B1A5379E0B16 в %ALLUSERSPROFILE%\Application Data\Package Cache\{69BCE4AC-9572-3271-A2FB-9423BDA36A43}v14.0.24215\packages\vcRuntimeAdditional_x86\cab1.cab
Сетевая активность:
Подключается к:
- 'wp#d':80
- '20#.#6.232.182':80
TCP:
Запросы HTTP GET:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl via 20#.#6.232.182
- http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl via 20#.#6.232.182
- http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl via 20#.#6.232.182
UDP:
- DNS ASK wp#d
- DNS ASK crl.microsoft.com
Другое:
Создает и запускает на исполнение:
- '%TEMP%\is-BQD9N.tmp\<Имя файла>.tmp' /SL5="$30092,17856756,57856,<Полный путь к файлу>"
- '%TEMP%\is-QULLV.tmp\vcredist_x86_2015_VSU3.exe' /q
- '%TEMP%\{e2803110-78b3-4664-a479-3611a381656a}\.be\VC_redist.x86.exe' -q -burn.elevated BurnPipe.{0983870A-A91C-435E-B116-2D76214CE310} {6D1A3F04-5814-471B-A3CD-B11D5C5C9BF5} 2856
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' /V
