Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Classes\XecureWebFileVerify\shell\open\command] '' = 'rundll32.exe "C:\PROGRA~2\SOFTFO~1\XECURE~1\ActiveX\XWEBFI~1.DLL",SFXW_FileVerify %1'
- [<HKLM>\Software\Classes\XecureWebFileDeEnvelop\shell\open\command] '' = 'rundll32.exe "C:\PROGRA~2\SOFTFO~1\XECURE~1\ActiveX\XWEBFI~1.DLL",SFXW_FileDeEnvelop %1'
Вредоносные функции
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
Изменения в файловой системе
Создает следующие файлы
- C:\lni\temp\xw_install.exe
- %ProgramFiles(x86)%\softforum\certstorage\ca\30c538d409e70d253249ccc9e99079732f03c88a\cert_1009.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\30c538d409e70d253249ccc9e99079732f03c88a\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\23cc091fa9604fe1ee13589f69f7f9082345d911\cert_1004.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\23cc091fa9604fe1ee13589f69f7f9082345d911\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\163e7429ee50fa751f8ade6e0fa55414337c3fa5\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\137fb162b695db9b6af5c773a8495982532b34f3\cert_4815997202b44b491b876b5e3054ff7d.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\137fb162b695db9b6af5c773a8495982532b34f3\cert_42df407a00311243eed8d8155bde0393.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\137fb162b695db9b6af5c773a8495982532b34f3\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\132d9ccab674d76a0c1925170730d90cfb8e1e80\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\409a9f6e45acc757e949e73dbd4582d0b95e0411\cert_2764.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\0a22c999c9a1372490e1be6013e4aff15ae33eb8\cert_07.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\0a22c999c9a1372490e1be6013e4aff15ae33eb8\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\0678bdd32b2aa0e6126bee8cd323cb5ca0c7ea27\cert_101d.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\0678bdd32b2aa0e6126bee8cd323cb5ca0c7ea27\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\03fa3e5aa4df9ef779646a2b165bb17c31b0009e\cert_02.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\03fa3e5aa4df9ef779646a2b165bb17c31b0009e\cert.der
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xwuacctl.dll
- %ProgramFiles(x86)%\softforum\certstorage\ca\132d9ccab674d76a0c1925170730d90cfb8e1e80\cert_101c.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\7daae7bdec91ae498717722019288e93c36a3309\cert_2713.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\420eeba3c13b048d6b8ea07e0a92046bafaaf437\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\68c0ed51a6f6e4d41ba0da0c6ac1f517dc18567e\cert_100a.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\68c0ed51a6f6e4d41ba0da0c6ac1f517dc18567e\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\5e98c8c99dd7a0abe2b3d37cbab5a0f1dfe19365\cert_2762.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\5e98c8c99dd7a0abe2b3d37cbab5a0f1dfe19365\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\5c7448e248b10311a69fbffa223c233d41687ca3\cert_2760.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\5c7448e248b10311a69fbffa223c233d41687ca3\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\5578e97a76f02507041458c94b23ea9e11d775d6\cert_03.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\5578e97a76f02507041458c94b23ea9e11d775d6\cert.der
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xwebfileclt.dll
- %ProgramFiles(x86)%\softforum\certstorage\ca\409a9f6e45acc757e949e73dbd4582d0b95e0411\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\527d0fe16be781803176a83fbef722731a12e617\cert_3f811b7a026cc2fbe96c9c69b6c689c8.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\527d0fe16be781803176a83fbef722731a12e617\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\4b3d4575915a11f8acb3cc6922c28e9df75919ce\cert_275f.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\4b3d4575915a11f8acb3cc6922c28e9df75919ce\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\48fa520704829eb91999fb7ebd7b569bd78e93dd\cert_3f810c2a014d7da56956f7a5ff03fcb7.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\48fa520704829eb91999fb7ebd7b569bd78e93dd\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\45b0ceab5b0c76d83f597150791c4e29e96a4e0f\cert_2714.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\45b0ceab5b0c76d83f597150791c4e29e96a4e0f\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\52bdebb8f1d906dcc6775f5109572db5d4db69eb\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\420eeba3c13b048d6b8ea07e0a92046bafaaf437\cert_1003.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\52bdebb8f1d906dcc6775f5109572db5d4db69eb\cert_1002.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\6936c6ff292e764f5fcb56c2e285a4b1b5fa1cec\cert_2717.der
- %ProgramFiles(x86)%\softforum\xecureweb\activex\download\default\xecure_big.bmp
- %ProgramFiles(x86)%\softforum\xecureweb\activex\zip32.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xwebssl.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xwebfilerd.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xwebcs.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xwebcmp.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xwebcertmng.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurest_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecuretsp_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurepvd_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurepkcs12_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurepkcs8_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurepkcs7_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurepkcs5_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurepkc_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecureocsp_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecureldap_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecureio_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\unzip32.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xwsmartcard.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\conf\bankcode.tbl
- %ProgramFiles(x86)%\softforum\xecureweb\activex\gdiplus.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\rootsupd.exe
- %ProgramFiles(x86)%\softforum\xecureweb\activex\conf\issuer.tbl
- %ProgramFiles(x86)%\softforum\xecureweb\activex\conf\policy_en.tbl
- %ProgramFiles(x86)%\softforum\xecureweb\activex\conf\policy.tbl
- %LOCALAPPDATA%low\softforum\xecureweb\activex\conf\clientsm.cfg
- %ProgramFiles(x86)%\softforum\xecureweb\activex\conf\clientsm.cfg
- %ProgramFiles(x86)%\softforum\xecureweb\activex\npxwebplugin_file.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\npxwebplugin.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xwebclt.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\download\default\xecureweb_big.bmp
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xwebui.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xweblangjp.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xweblangch.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xweblangen.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xweblangkr.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurefreeze.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xcrsvr.exe
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xwuacwrapper.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\transkeycs.dll
- %TEMP%\wzse0.tmp\npki\kisa\c8d08ec749ae1f2042b24b7f13c977580ca1cdc1_1.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\84eef6bc2f9b207298a0a4c676cf61b757aa6628\cert.der
- %LOCALAPPDATA%low\npki\crosscert\43d6f3657f659dcd6bc1ce730abf3210a051e711_4126.der
- %LOCALAPPDATA%low\npki\crosscert\0fd92caf8b33b1b2b4f1151c9d786162e19b1427_10078.der
- %ProgramFiles%\npki\yessign\efdc44d2c68dc00ea338c07c93c6c341bf4a8ff0_4124.der
- %ProgramFiles%\npki\yessign\e2ec6d2ce57d9bc09eac015379ba9a8f9a85d90b_10050.der
- %ProgramFiles%\npki\yessign\5204329f8f9d2172bafa3398a8617e2733248d5f_4099.der
- %ProgramFiles%\npki\yessign\4afbbd332d8bb1d18c946bffe042365f1c91cb08_10080.der
- %ProgramFiles%\npki\tradesign\ce671644b27e73fd85a7cd0d1ed3f0d3a52d2639_10023.der
- %ProgramFiles%\npki\tradesign\b507236c57cf3eae8eb532819f91a720dbe8ebe3_4127.der
- %ProgramFiles%\npki\tradesign\4d5d560a0703df83caf3d56d8f19fc12ac90a28a_4105.der
- %ProgramFiles%\npki\signkorea\b063e7eba3dbd862c64427ff65e9316273a7c6cc_10043.der
- %LOCALAPPDATA%low\npki\kica\6f1f0bd880be4ac7184e62cdce3a6fa19b447061_10056.der
- %ProgramFiles%\npki\signkorea\8daa2008f089e01141bc7fa48e2ac4405eca563a_10079.der
- %ProgramFiles%\npki\signkorea\279696bef384dc5901622423e2187bd3418d2d42_4098.der
- %ProgramFiles%\npki\signkorea\045445b0de12c4279ca04f02698bd55b14146307_4128.der
- %ProgramFiles%\npki\ncasign\fe2a1dc3637ebffd31830ab1f1d3f0da2be78d7a_10082.der
- %ProgramFiles%\npki\ncasign\766d8bcdad940df5a5b63f2202b6f59f4349398a_10045.der
- %ProgramFiles%\npki\kisa\ff8a46723358e8488822aa1768da1648098b3591_3.der
- %LOCALAPPDATA%low\npki\crosscert\b674a99b923cc751b122a44fbcb73cfe2233d776_4100.der
- %ProgramFiles%\npki\tradesign\2b7602ae825c7dee81919ef5895bb9e2995ba9af_10084.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\84eef6bc2f9b207298a0a4c676cf61b757aa6628\cert_2712.der
- %LOCALAPPDATA%low\npki\kica\ae52fd0e0e01f83086377ef618c649254a600970_4106.der
- %LOCALAPPDATA%low\npki\yessign\4afbbd332d8bb1d18c946bffe042365f1c91cb08_10080.der
- %LOCALAPPDATA%low\npki\tradesign\ce671644b27e73fd85a7cd0d1ed3f0d3a52d2639_10023.der
- %LOCALAPPDATA%low\npki\tradesign\b507236c57cf3eae8eb532819f91a720dbe8ebe3_4127.der
- %LOCALAPPDATA%low\npki\tradesign\4d5d560a0703df83caf3d56d8f19fc12ac90a28a_4105.der
- %LOCALAPPDATA%low\npki\tradesign\2b7602ae825c7dee81919ef5895bb9e2995ba9af_10084.der
- %LOCALAPPDATA%low\npki\signkorea\b063e7eba3dbd862c64427ff65e9316273a7c6cc_10043.der
- %LOCALAPPDATA%low\npki\signkorea\8daa2008f089e01141bc7fa48e2ac4405eca563a_10079.der
- %ProgramFiles%\npki\kisa\c8d08ec749ae1f2042b24b7f13c977580ca1cdc1_1.der
- %LOCALAPPDATA%low\npki\signkorea\279696bef384dc5901622423e2187bd3418d2d42_4098.der
- %LOCALAPPDATA%low\npki\crosscert\d3c1937bd61f964f1c2c6872acec4c85614cd2dc_10088.der
- %LOCALAPPDATA%low\npki\ncasign\766d8bcdad940df5a5b63f2202b6f59f4349398a_10045.der
- %LOCALAPPDATA%low\npki\kisa\ff8a46723358e8488822aa1768da1648098b3591_3.der
- %LOCALAPPDATA%low\npki\kisa\c8d08ec749ae1f2042b24b7f13c977580ca1cdc1_1.der
- %LOCALAPPDATA%low\npki\kisa\bfb627d8035a76654c6101415631e58b7b3ad9cc_4.der
- %LOCALAPPDATA%low\npki\kisa\2587df3e181c92c06c2e9677d44a009559077649_16.der
- %LOCALAPPDATA%low\npki\kica\d8be3aec4599c59ee39cea811fd21d12b0363e88_4125.der
- %LOCALAPPDATA%low\npki\kica\b909f2b621489a2aba025980862793166a77f559_10081.der
- %LOCALAPPDATA%low\npki\signkorea\045445b0de12c4279ca04f02698bd55b14146307_4128.der
- %ProgramFiles%\npki\kisa\bfb627d8035a76654c6101415631e58b7b3ad9cc_4.der
- %LOCALAPPDATA%low\npki\yessign\5204329f8f9d2172bafa3398a8617e2733248d5f_4099.der
- %ProgramFiles%\npki\kisa\2587df3e181c92c06c2e9677d44a009559077649_16.der
- %ProgramFiles%\npki\kica\d8be3aec4599c59ee39cea811fd21d12b0363e88_4125.der
- %ProgramFiles(x86)%\softforum\certstorage\calist.ini
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurectl_v20.dll
- %ProgramFiles(x86)%\softforum\certstorage\ca\f0496fd72c050996eb08e05280687f17a336ae83\cert_42df402301a9ac1f7d411833d75765c5.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\f0496fd72c050996eb08e05280687f17a336ae83\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\ef57983243311fb938c9b9f4dd66e2321acdd95c\cert_1020.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\ef57983243311fb938c9b9f4dd66e2321acdd95c\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\e253d4a480d9c6b9716ae282440d32dbf19b1a0a\cert_05.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\dac052905418132dc647c7a040ceb6aa45edaf13\cert_2761.der
- %ProgramFiles(x86)%\softforum\certstorage\newmndca.der
- %ProgramFiles(x86)%\softforum\certstorage\newroot.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\dac052905418132dc647c7a040ceb6aa45edaf13\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\c1adebbdde3d949d30f6a600d98da796ae7eb33a\cert_03.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\bf3f4cbad08086cd0782afd2b4403cd0a839b37a\cert_275e.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\bf3f4cbad08086cd0782afd2b4403cd0a839b37a\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\ade9d66e18288893e8234df8cdc970087d005047\cert_410743f0027dad4fe11db9487df2a9ba.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\ade9d66e18288893e8234df8cdc970087d005047\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\a2a1039f746597eb7775c96e0bff8313630e9fc8\cert_101e.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\a2a1039f746597eb7775c96e0bff8313630e9fc8\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\cf8d89dc72cd3304a7e89c5982863b589b0168ee\cert_101f.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\cf8d89dc72cd3304a7e89c5982863b589b0168ee\cert.der
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xwebutil.dll
- %ProgramFiles(x86)%\softforum\certstorage\root\0ef12e12c6f31a2ea28b9028473313fccdd888c6\cert_48479209034cb66f1005525650458b7b.der
- %ProgramFiles(x86)%\softforum\certstorage\root\bdf0d54473d47f581b506dd3584e9ececf0d705b\cert_01.der
- %ProgramFiles(x86)%\softforum\certstorage\root\e7efa5bc23cc9c3e6683c558a7fb14d7fea6107c\cert.der
- %ProgramFiles%\npki\kica\ae52fd0e0e01f83086377ef618c649254a600970_4106.der
- %ProgramFiles%\npki\kica\6f1f0bd880be4ac7184e62cdce3a6fa19b447061_10056.der
- %ProgramFiles%\npki\crosscert\d3c1937bd61f964f1c2c6872acec4c85614cd2dc_10088.der
- %ProgramFiles%\npki\crosscert\b674a99b923cc751b122a44fbcb73cfe2233d776_4100.der
- %ProgramFiles%\npki\crosscert\43d6f3657f659dcd6bc1ce730abf3210a051e711_4126.der
- %ProgramFiles%\npki\crosscert\0fd92caf8b33b1b2b4f1151c9d786162e19b1427_10078.der
- %ProgramFiles(x86)%\softforum\certstorage\root\e7efa5bc23cc9c3e6683c558a7fb14d7fea6107c\cert_3b9aca03.der
- %ProgramFiles%\npki\kica\b909f2b621489a2aba025980862793166a77f559_10081.der
- %ProgramFiles(x86)%\softforum\certstorage\root\064be6dd317317159d7aaf9fb6657268425b5604\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\ca\f0496fd72c050996eb08e05280687f17a336ae83\cert_4815995d01ea173601735bd116f8255c.der
- %ProgramFiles(x86)%\softforum\certstorage\root\5e8d54cd0953a9279f79a5ee62b6702271a08bd9\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\root\4b975cbd73ec36b25f552ad964800c73e892383e\cert_01.der
- %ProgramFiles(x86)%\softforum\certstorage\root\4b975cbd73ec36b25f552ad964800c73e892383e\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\root\2df9c06ae840c62438fb338257ebd9dc0f95a0b2\cert_3cc2814b00e7524d9baa47b7e161f50e.der
- %ProgramFiles(x86)%\softforum\certstorage\root\2df9c06ae840c62438fb338257ebd9dc0f95a0b2\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\root\143f06757a32fb4a04efe58ae847a92e28462f81\cert_02.der
- %ProgramFiles(x86)%\softforum\certstorage\root\143f06757a32fb4a04efe58ae847a92e28462f81\cert.der
- %ProgramFiles(x86)%\softforum\certstorage\root\5e8d54cd0953a9279f79a5ee62b6702271a08bd9\cert_01.der
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurecsp_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurecrypto_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurecrl_v20.dll
- %TEMP%\wzse0.tmp\certstorage\ca\03fa3e5aa4df9ef779646a2b165bb17c31b0009e\cert_02.der
- %TEMP%\wzse0.tmp\npxwebplugin.dll
- %TEMP%\wzse0.tmp\npxwfile.dll
- %TEMP%\wzse0.tmp\npxwfile.xpt
- %TEMP%\wzse0.tmp\npxecure.dll
- %TEMP%\wzse0.tmp\npxecure.xpt
- %TEMP%\wzse0.tmp\npxwfilectl.dll
- %TEMP%\wzse0.tmp\npxecssl40.dll
- %TEMP%\wzse0.tmp\bankcode.tbl
- %TEMP%\wzse0.tmp\issuer.tbl
- %TEMP%\wzse0.tmp\policy_en.tbl
- %TEMP%\wzse0.tmp\policy.tbl
- %TEMP%\wzse0.tmp\xecureweb_big.bmp
- %TEMP%\wzse0.tmp\xecure_big.bmp
- %TEMP%\wzse0.tmp\clientsm.cfg
- %TEMP%\wzse0.tmp\xcrsvr.exe
- %TEMP%\wzse0.tmp\xwuacctl.dll
- %TEMP%\wzse0.tmp\certstorage\ca\0678bdd32b2aa0e6126bee8cd323cb5ca0c7ea27\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\0678bdd32b2aa0e6126bee8cd323cb5ca0c7ea27\cert_101d.der
- %TEMP%\wzse0.tmp\certstorage\ca\c1adebbdde3d949d30f6a600d98da796ae7eb33a\cert_03.der
- %TEMP%\wzse0.tmp\certstorage\ca\48fa520704829eb91999fb7ebd7b569bd78e93dd\cert_3f810c2a014d7da56956f7a5ff03fcb7.der
- %TEMP%\wzse0.tmp\certstorage\ca\527d0fe16be781803176a83fbef722731a12e617\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\ade9d66e18288893e8234df8cdc970087d005047\cert_410743f0027dad4fe11db9487df2a9ba.der
- %TEMP%\wzse0.tmp\certstorage\ca\ade9d66e18288893e8234df8cdc970087d005047\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\a2a1039f746597eb7775c96e0bff8313630e9fc8\cert_101e.der
- %TEMP%\wzse0.tmp\certstorage\ca\a2a1039f746597eb7775c96e0bff8313630e9fc8\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\5578e97a76f02507041458c94b23ea9e11d775d6\cert_03.der
- %TEMP%\wzse0.tmp\certstorage\ca\5578e97a76f02507041458c94b23ea9e11d775d6\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\527d0fe16be781803176a83fbef722731a12e617\cert_3f811b7a026cc2fbe96c9c69b6c689c8.der
- %TEMP%\wzse0.tmp\certstorage\ca\03fa3e5aa4df9ef779646a2b165bb17c31b0009e\cert.der
- %TEMP%\wzse0.tmp\xwebfileclt.dll
- %TEMP%\wzse0.tmp\xecurest_v20.dll
- %TEMP%\wzse0.tmp\certstorage\ca\45b0ceab5b0c76d83f597150791c4e29e96a4e0f\cert_2714.der
- %TEMP%\wzse0.tmp\certstorage\ca\45b0ceab5b0c76d83f597150791c4e29e96a4e0f\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\137fb162b695db9b6af5c773a8495982532b34f3\cert_4815997202b44b491b876b5e3054ff7d.der
- %TEMP%\wzse0.tmp\certstorage\ca\137fb162b695db9b6af5c773a8495982532b34f3\cert_42df407a00311243eed8d8155bde0393.der
- %TEMP%\wzse0.tmp\certstorage\ca\137fb162b695db9b6af5c773a8495982532b34f3\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\0a22c999c9a1372490e1be6013e4aff15ae33eb8\cert_07.der
- %TEMP%\wzse0.tmp\certstorage\ca\0a22c999c9a1372490e1be6013e4aff15ae33eb8\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\48fa520704829eb91999fb7ebd7b569bd78e93dd\cert.der
- %TEMP%\wzse0.tmp\xwebclt.dll
- %TEMP%\wzse0.tmp\xecuretsp_v20.dll
- %TEMP%\wzse0.tmp\xecurectl_v20.dll
- %TEMP%\wzse0.tmp\xwebui.dll
- %TEMP%\wzse0.tmp\xweblangkr.dll
- %TEMP%\wzse0.tmp\rootsupd.exe
- %TEMP%\wzse0.tmp\xecurefreeze.dll
- %TEMP%\wzse0.tmp\xwuacwrapper.dll
- %TEMP%\wzse0.tmp\xwsmartcard.dll
- %TEMP%\wzse0.tmp\unzip32.dll
- %TEMP%\wzse0.tmp\zip32.dll
- %TEMP%\wzse0.tmp\certstorage\ca\cf8d89dc72cd3304a7e89c5982863b589b0168ee\cert.der
- %TEMP%\wzse0.tmp\xweblangch.dll
- %TEMP%\wzse0.tmp\xwebssl.dll
- %TEMP%\wzse0.tmp\xwebfilerd.dll
- %TEMP%\wzse0.tmp\xwebcs.dll
- %TEMP%\wzse0.tmp\xwebcmp.dll
- %TEMP%\wzse0.tmp\xwebcertmng.dll
- %TEMP%\wzse0.tmp\clientsm.exe
- %TEMP%\wzse0.tmp\xw_uninstall.exe
- %TEMP%\wzse0.tmp\xw_setup.exe
- %TEMP%\wzse0.tmp\xwebutil.dll
- %LOCALAPPDATA%low\npki\yessign\e2ec6d2ce57d9bc09eac015379ba9a8f9a85d90b_10050.der
- %TEMP%\wzse0.tmp\xweblangjp.dll
- %TEMP%\wzse0.tmp\miraepkix_v4.dll
- %TEMP%\wzse0.tmp\transkeycs.dll
- %TEMP%\wzse0.tmp\xecurepvd_v20.dll
- %TEMP%\wzse0.tmp\xecurepkcs12_v20.dll
- %TEMP%\wzse0.tmp\xecurepkcs8_v20.dll
- %TEMP%\wzse0.tmp\xecurepkcs7_v20.dll
- %TEMP%\wzse0.tmp\xecurepkcs5_v20.dll
- %TEMP%\wzse0.tmp\xecurepkc_v20.dll
- %TEMP%\wzse0.tmp\xecureocsp_v20.dll
- %TEMP%\wzse0.tmp\gdiplus.dll
- %TEMP%\wzse0.tmp\xecureldap_v20.dll
- %TEMP%\wzse0.tmp\xweblangen.dll
- %TEMP%\wzse0.tmp\xecurecsp_v20.dll
- %TEMP%\wzse0.tmp\xecurecrypto_v20.dll
- %TEMP%\wzse0.tmp\xecurecrl_v20.dll
- %TEMP%\wzse0.tmp\xecurecodec_v20.dll
- %TEMP%\wzse0.tmp\xecurecmp_v20.dll
- %TEMP%\wzse0.tmp\xecureasn_v20.dll
- %TEMP%\wzse0.tmp\nsldap32v50.dll
- %TEMP%\wzse0.tmp\xecureio_v20.dll
- %LOCALAPPDATA%low\npki\ncasign\fe2a1dc3637ebffd31830ab1f1d3f0da2be78d7a_10082.der
- %TEMP%\wzse0.tmp\certstorage\ca\cf8d89dc72cd3304a7e89c5982863b589b0168ee\cert_101f.der
- %TEMP%\wzse0.tmp\certstorage\ca\ef57983243311fb938c9b9f4dd66e2321acdd95c\cert_1020.der
- %TEMP%\wzse0.tmp\certstorage\ca\30c538d409e70d253249ccc9e99079732f03c88a\cert_1009.der
- %TEMP%\wzse0.tmp\certstorage\ca\52bdebb8f1d906dcc6775f5109572db5d4db69eb\cert_1002.der
- %TEMP%\wzse0.tmp\certstorage\ca\52bdebb8f1d906dcc6775f5109572db5d4db69eb\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\4b3d4575915a11f8acb3cc6922c28e9df75919ce\cert_275f.der
- %TEMP%\wzse0.tmp\certstorage\ca\4b3d4575915a11f8acb3cc6922c28e9df75919ce\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\420eeba3c13b048d6b8ea07e0a92046bafaaf437\cert_1003.der
- %TEMP%\wzse0.tmp\certstorage\ca\420eeba3c13b048d6b8ea07e0a92046bafaaf437\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\409a9f6e45acc757e949e73dbd4582d0b95e0411\cert_2764.der
- %TEMP%\wzse0.tmp\certstorage\ca\409a9f6e45acc757e949e73dbd4582d0b95e0411\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\30c538d409e70d253249ccc9e99079732f03c88a\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\5c7448e248b10311a69fbffa223c233d41687ca3\cert_2760.der
- %TEMP%\wzse0.tmp\certstorage\ca\23cc091fa9604fe1ee13589f69f7f9082345d911\cert_1004.der
- %TEMP%\wzse0.tmp\certstorage\ca\23cc091fa9604fe1ee13589f69f7f9082345d911\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\163e7429ee50fa751f8ade6e0fa55414337c3fa5\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\132d9ccab674d76a0c1925170730d90cfb8e1e80\cert_101c.der
- %TEMP%\wzse0.tmp\certstorage\ca\132d9ccab674d76a0c1925170730d90cfb8e1e80\cert.der
- %TEMP%\wzse0.tmp\npki\yessign\efdc44d2c68dc00ea338c07c93c6c341bf4a8ff0_4124.der
- %TEMP%\wzse0.tmp\npxwebplugin_file.dll
- %TEMP%\wzse0.tmp\certstorage\ca\5e98c8c99dd7a0abe2b3d37cbab5a0f1dfe19365\cert.der
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurecodec_v20.dll
- %TEMP%\wzse0.tmp\certstorage\ca\dac052905418132dc647c7a040ceb6aa45edaf13\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\dac052905418132dc647c7a040ceb6aa45edaf13\cert_2761.der
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecurecmp_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\xecureasn_v20.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\miraepkix_v4.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\nsldap32v50.dll
- %ProgramFiles(x86)%\softforum\xecureweb\activex\clientsm.exe
- %ProgramFiles(x86)%\softforum\xecureweb\xw_uninstall.exe
- %ProgramFiles(x86)%\softforum\xecureweb\xw_setup.exe
- %TEMP%\wzse0.tmp\npki\yessign\e2ec6d2ce57d9bc09eac015379ba9a8f9a85d90b_10050.der
- %TEMP%\wzse0.tmp\npki\yessign\5204329f8f9d2172bafa3398a8617e2733248d5f_4099.der
- %TEMP%\wzse0.tmp\certstorage\ca\5e98c8c99dd7a0abe2b3d37cbab5a0f1dfe19365\cert_2762.der
- %TEMP%\wzse0.tmp\certstorage\ca\bf3f4cbad08086cd0782afd2b4403cd0a839b37a\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\84eef6bc2f9b207298a0a4c676cf61b757aa6628\cert_2712.der
- %TEMP%\wzse0.tmp\certstorage\ca\84eef6bc2f9b207298a0a4c676cf61b757aa6628\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\7daae7bdec91ae498717722019288e93c36a3309\cert_2713.der
- %TEMP%\wzse0.tmp\certstorage\ca\6936c6ff292e764f5fcb56c2e285a4b1b5fa1cec\cert_2717.der
- %TEMP%\wzse0.tmp\certstorage\ca\68c0ed51a6f6e4d41ba0da0c6ac1f517dc18567e\cert_100a.der
- %TEMP%\wzse0.tmp\certstorage\ca\68c0ed51a6f6e4d41ba0da0c6ac1f517dc18567e\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\bf3f4cbad08086cd0782afd2b4403cd0a839b37a\cert_275e.der
- %TEMP%\wzse0.tmp\certstorage\ca\5c7448e248b10311a69fbffa223c233d41687ca3\cert.der
- %TEMP%\wzse0.tmp\npki\yessign\4afbbd332d8bb1d18c946bffe042365f1c91cb08_10080.der
- %TEMP%\wzse0.tmp\npki\tradesign\ce671644b27e73fd85a7cd0d1ed3f0d3a52d2639_10023.der
- %TEMP%\wzse0.tmp\certstorage\ca\e253d4a480d9c6b9716ae282440d32dbf19b1a0a\cert_05.der
- %TEMP%\wzse0.tmp\certstorage\root\0ef12e12c6f31a2ea28b9028473313fccdd888c6\cert_48479209034cb66f1005525650458b7b.der
- %TEMP%\wzse0.tmp\certstorage\root\5e8d54cd0953a9279f79a5ee62b6702271a08bd9\cert_01.der
- %TEMP%\wzse0.tmp\certstorage\root\5e8d54cd0953a9279f79a5ee62b6702271a08bd9\cert.der
- %TEMP%\wzse0.tmp\certstorage\root\4b975cbd73ec36b25f552ad964800c73e892383e\cert_01.der
- %TEMP%\wzse0.tmp\certstorage\root\4b975cbd73ec36b25f552ad964800c73e892383e\cert.der
- %TEMP%\wzse0.tmp\certstorage\root\2df9c06ae840c62438fb338257ebd9dc0f95a0b2\cert_3cc2814b00e7524d9baa47b7e161f50e.der
- %TEMP%\wzse0.tmp\certstorage\root\2df9c06ae840c62438fb338257ebd9dc0f95a0b2\cert.der
- %TEMP%\wzse0.tmp\certstorage\root\e7efa5bc23cc9c3e6683c558a7fb14d7fea6107c\cert_3b9aca03.der
- %TEMP%\wzse0.tmp\certstorage\root\143f06757a32fb4a04efe58ae847a92e28462f81\cert_02.der
- %TEMP%\wzse0.tmp\certstorage\root\143f06757a32fb4a04efe58ae847a92e28462f81\cert.der
- %TEMP%\wzse0.tmp\certstorage\root\064be6dd317317159d7aaf9fb6657268425b5604\cert.der
- %TEMP%\wzse0.tmp\certstorage\newroot.der
- %TEMP%\wzse0.tmp\certstorage\newmndca.der
- %TEMP%\wzse0.tmp\certstorage\calist.ini
- %TEMP%\wzse0.tmp\certstorage\ca\f0496fd72c050996eb08e05280687f17a336ae83\cert_4815995d01ea173601735bd116f8255c.der
- %TEMP%\wzse0.tmp\certstorage\ca\f0496fd72c050996eb08e05280687f17a336ae83\cert_42df402301a9ac1f7d411833d75765c5.der
- %TEMP%\wzse0.tmp\certstorage\ca\f0496fd72c050996eb08e05280687f17a336ae83\cert.der
- %TEMP%\wzse0.tmp\certstorage\root\e7efa5bc23cc9c3e6683c558a7fb14d7fea6107c\cert.der
- %TEMP%\wzse0.tmp\certstorage\ca\ef57983243311fb938c9b9f4dd66e2321acdd95c\cert.der
- %TEMP%\wzse0.tmp\npki\crosscert\43d6f3657f659dcd6bc1ce730abf3210a051e711_4126.der
- %TEMP%\wzse0.tmp\npki\crosscert\d3c1937bd61f964f1c2c6872acec4c85614cd2dc_10088.der
- %TEMP%\wzse0.tmp\npki\tradesign\b507236c57cf3eae8eb532819f91a720dbe8ebe3_4127.der
- %TEMP%\wzse0.tmp\npki\crosscert\0fd92caf8b33b1b2b4f1151c9d786162e19b1427_10078.der
- %TEMP%\wzse0.tmp\npki\tradesign\4d5d560a0703df83caf3d56d8f19fc12ac90a28a_4105.der
- %TEMP%\wzse0.tmp\npki\tradesign\2b7602ae825c7dee81919ef5895bb9e2995ba9af_10084.der
- %TEMP%\wzse0.tmp\npki\signkorea\b063e7eba3dbd862c64427ff65e9316273a7c6cc_10043.der
- %TEMP%\wzse0.tmp\npki\signkorea\8daa2008f089e01141bc7fa48e2ac4405eca563a_10079.der
- %TEMP%\wzse0.tmp\npki\signkorea\279696bef384dc5901622423e2187bd3418d2d42_4098.der
- %TEMP%\wzse0.tmp\npki\signkorea\045445b0de12c4279ca04f02698bd55b14146307_4128.der
- %TEMP%\wzse0.tmp\npki\crosscert\b674a99b923cc751b122a44fbcb73cfe2233d776_4100.der
- %TEMP%\wzse0.tmp\npki\ncasign\fe2a1dc3637ebffd31830ab1f1d3f0da2be78d7a_10082.der
- %TEMP%\wzse0.tmp\npki\kisa\ff8a46723358e8488822aa1768da1648098b3591_3.der
- %TEMP%\wzse0.tmp\certstorage\root\bdf0d54473d47f581b506dd3584e9ececf0d705b\cert_01.der
- %TEMP%\wzse0.tmp\npki\kisa\bfb627d8035a76654c6101415631e58b7b3ad9cc_4.der
- %TEMP%\wzse0.tmp\npki\kisa\2587df3e181c92c06c2e9677d44a009559077649_16.der
- %TEMP%\wzse0.tmp\npki\kica\d8be3aec4599c59ee39cea811fd21d12b0363e88_4125.der
- %TEMP%\wzse0.tmp\npki\kica\b909f2b621489a2aba025980862793166a77f559_10081.der
- %TEMP%\wzse0.tmp\npki\kica\ae52fd0e0e01f83086377ef618c649254a600970_4106.der
- %TEMP%\wzse0.tmp\npki\kica\6f1f0bd880be4ac7184e62cdce3a6fa19b447061_10056.der
- %TEMP%\wzse0.tmp\npki\ncasign\766d8bcdad940df5a5b63f2202b6f59f4349398a_10045.der
- %LOCALAPPDATA%low\npki\yessign\efdc44d2c68dc00ea338c07c93c6c341bf4a8ff0_4124.der
Сетевая активность
Подключается к
- 'sa###.#binsure.co.kr':80
TCP
Запросы HTTP GET
- http://sa###.#binsure.co.kr/eus/FileSave/SetupFile/xw_install.exe
UDP
- DNS ASK sa###.#binsure.co.kr
Другое
Ищет следующие окна
- ClassName: 'ClientSM' WindowName: 'ClientSM'
- ClassName: 'RESTARTIE' WindowName: 'RestartIE'
Создает и запускает на исполнение
- 'C:\lni\temp\xw_install.exe'
- '%TEMP%\wzse0.tmp\xw_setup.exe' -i c
- '%ProgramFiles(x86)%\softforum\xecureweb\activex\xcrsvr.exe' /regserver
- '%TEMP%\wzse0.tmp\xw_setup.exe' -i c' (со скрытым окном)
- '%ProgramFiles(x86)%\softforum\xecureweb\activex\xcrsvr.exe' /regserver' (со скрытым окном)
