Trojan.DownLoader26.49887

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\RarSFX0\archnet.url
%TEMP%\RarSFX0\Interop.NATUPNPLib.dll
%TEMP%\RarSFX0\Interop.NETCONLib.dll
%TEMP%\RarSFX0\Interop.NetFwTypeLib.dll
<LS_APPDATA>\Spoon\Sandbox\IPCameraViewer\4.0.6.0\xsandbox.bin.__tmp__
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\_MyApplication.app@1.0.0.0\_MyApplication.app@1.0.0.0.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\_MyApplication.app@1.0.0.0\MyApplication.app.manifest.__tmp__
%TEMP%\RarSFX0\it\DSUtilities.resources.dll
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\Grabber.dll\Grabber.dll.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\Manifests\IP Camera Viewer.exe_0x044dfcdec1902c6eba29ca593fdaf643.1.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\Manifests\System.Data.SQLite.dll_0xa63ef5f7ebdca9d2dd871068414691de.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\x86_SQLite.Interop.2010@1.0.104.0\SQLite.Interop.2010.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\x86_SQLite.Interop.2010@1.0.104.0\x86_SQLite.Interop.2010@1.0.104.0.manifest.__tmp__
%ALLUSERSPROFILE%\Application Data\DeskShare\IP Camera Viewer\4\UpdaterSettings
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\wpad[1].cache
%TEMP%\RarSFX0\EULA_it.rtf
%TEMP%\RarSFX0\EULA_pt.rtf
%TEMP%\RarSFX0\EULA_fr.rtf
%TEMP%\RarSFX0\EULA_es.rtf
%TEMP%\RarSFX0\EULA_de.rtf
%TEMP%\RarSFX0\Rename.bat
%TEMP%\RarSFX0\Settings.ipcv
%TEMP%\RarSFX0\WinFirewallHandler.exe
%TEMP%\RarSFX0\de\DSUtilities.resources.dll
%TEMP%\RarSFX0\es\DSUtilities.resources.dll
%TEMP%\RarSFX0\fr\DSUtilities.resources.dll
%TEMP%\Cab1.tmp
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\Manifests\Grabber.dll_0x78a12faa814d54d667a6f54b9ab82d6b.2.manifest.__tmp__
%TEMP%\RarSFX0\Help\IPCV.chm
%TEMP%\RarSFX0\Bullet-1.bmp
%TEMP%\RarSFX0\DesktopExperience.bat
%TEMP%\RarSFX0\DSProductDownloader.exe
%TEMP%\RarSFX0\DsServiceController.exe
%TEMP%\RarSFX0\DSUtilities.dll
%TEMP%\RarSFX0\Eula.rtf
%TEMP%\RarSFX0\IP Camera Viewer.exe
%TEMP%\RarSFX0\pt\DSUtilities.resources.dll
%TEMP%\IPCV 2x Log\ErrorLog\dxdiag.txt

Удаляет следующие файлы:

%TEMP%\Cab1.tmp

Перемещает следующие файлы:

<LS_APPDATA>\Spoon\Sandbox\IPCameraViewer\4.0.6.0\xsandbox.bin.__tmp__ в <LS_APPDATA>\Spoon\Sandbox\IPCameraViewer\4.0.6.0\xsandbox.bin
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\_MyApplication.app@1.0.0.0\_MyApplication.app@1.0.0.0.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\_MyApplication.app@1.0.0.0\_MyApplication.app@1.0.0.0.manifest
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\_MyApplication.app@1.0.0.0\MyApplication.app.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\_MyApplication.app@1.0.0.0\MyApplication.app.manifest
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\Grabber.dll\Grabber.dll.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\Grabber.dll\Grabber.dll.manifest
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\Manifests\Grabber.dll_0x78a12faa814d54d667a6f54b9ab82d6b.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\Manifests\Grabber.dll_0x78a12faa814d54d667a6f54b9ab82d6b.2.manifest
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\Manifests\IP Camera Viewer.exe_0x044dfcdec1902c6eba29ca593fdaf643.1.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\Manifests\IP Camera Viewer.exe_0x044dfcdec1902c6eba29ca593fdaf643.1.manifest
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\Manifests\System.Data.SQLite.dll_0xa63ef5f7ebdca9d2dd871068414691de.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\Manifests\System.Data.SQLite.dll_0xa63ef5f7ebdca9d2dd871068414691de.2.manifest
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\x86_SQLite.Interop.2010@1.0.104.0\SQLite.Interop.2010.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\x86_SQLite.Interop.2010@1.0.104.0\SQLite.Interop.2010.manifest
%TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\x86_SQLite.Interop.2010@1.0.104.0\x86_SQLite.Interop.2010@1.0.104.0.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x0F7D3AAA270FC137\sxs\x86_SQLite.Interop.2010@1.0.104.0\x86_SQLite.Interop.2010@1.0.104.0.manifest

Сетевая активность:

Подключается к:

'st###.turbo.net':443
'wp#d':80
'de###hare.com':443
'download.windowsupdate.com':80

TCP:

Запросы HTTP GET:

http://11#.#11.111.2/wpad.dat via wp#d
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab via download.windowsupdate.com

UDP: