Техническая информация
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\ext2.tmp
- %TEMP%\{DF57E946-4885-4EEA-A958-D5F82CB21B99}\_ISRES.DLL
- %TEMP%\{DF57E946-4885-4EEA-A958-D5F82CB21B99}\String1045.txt
- %TEMP%\MSI8.tmp
- %TEMP%\MSI9.tmp
- %TEMP%\{DF57E946-4885-4EEA-A958-D5F82CB21B99}\EULA.txt
- %TEMP%\MSIA.tmp
- %TEMP%\5eef.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %TEMP%\{DF57E946-4885-4EEA-A958-D5F82CB21B99}\IsConfig.INI
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %TEMP%\{DF57E946-4885-4EEA-A958-D5F82CB21B99}\ISRT.DLL
- %CommonProgramFiles%\InstallShield\Driver\9\Intel 32\IDriver2.exe
- %TEMP%\plf1.tmp
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\pft3.tmp\0x0415.ini
- %TEMP%\pft3.tmp\APPDPF.cab
- %TEMP%\pft3.tmp\APPUI.cab
- %TEMP%\pft3.tmp\DesignPro 5.msi
- %TEMP%\pft3.tmp\FONTS.cab
- %TEMP%\pft3.tmp\GRAPHICS.cab
- %TEMP%\pft3.tmp\instmsia.exe
- %TEMP%\pft3.tmp\instmsiw.exe
- %TEMP%\pft3.tmp\ISScript9.Msi
- %TEMP%\pft3.tmp\MAINAPP.cab
- %TEMP%\pft3.tmp\SAMPLES.cab
- %TEMP%\pft3.tmp\setup.exe
- %TEMP%\pft3.tmp\Setup.ini
- %TEMP%\pft3.tmp\TEMPLATE.cab
- %WINDIR%\Installer\21bfa.msi
- %WINDIR%\Installer\21bfc.ipi
- %WINDIR%\Installer\MSI5.tmp
- C:\Config.Msi\21bfd.rbs
- %CommonProgramFiles%\InstallShield\Driver\9\Intel 32\IDriver.exe
- %CommonProgramFiles%\InstallShield\Driver\9\Intel 32\objpscnv.dll
- %CommonProgramFiles%\InstallShield\Driver\9\Intel 32\IUserCnv.dll
- %CommonProgramFiles%\InstallShield\Driver\9\Intel 32\IScrCnv.dll
- %CommonProgramFiles%\InstallShield\Driver\9\Intel 32\ISRT.dll
- %CommonProgramFiles%\InstallShield\Driver\9\Intel 32\_ISRES1033.dll
- %CommonProgramFiles%\InstallShield\Driver\9\Intel 32\iGdiCnv.dll
- %TEMP%\{DF57E946-4885-4EEA-A958-D5F82CB21B99}\setup.inx
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
Удаляет следующие файлы:
- %TEMP%\ext2.tmp
- %TEMP%\pft3.tmp\pftw1.pkg
- %WINDIR%\Installer\MSI5.tmp
- C:\Config.Msi\21bfd.rbs
- %WINDIR%\Installer\21bfa.msi
- %WINDIR%\Installer\21bfc.ipi
- %TEMP%\MSI8.tmp
- %TEMP%\MSI9.tmp
- %TEMP%\MSIA.tmp
Сетевая активность:
Подключается к:
- 'wp#d':80
- 'cr#.#hawte.com':80
TCP:
Запросы HTTP GET:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://cr#.#hawte.com/ThawteServerCA.crl
UDP:
- DNS ASK wp#d
- DNS ASK cr#.#hawte.com
Другое:
Создает и запускает на исполнение:
- '%TEMP%\pft3.tmp\setup.exe'
- '%CommonProgramFiles%\InstallShield\Driver\9\Intel 32\IDriver.exe' 32\IDriver.exe -Embedding
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 71F4D700A57AC68DDB5FE9D4F50E91AD C
