Trojan.DownLoader35.1366

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%ProgramFiles(x86)%\inps\inps uniemens individuale\postinstallation.exe
%ProgramFiles(x86)%\inps\inps uniemens individuale\del.vbs
%ProgramFiles(x86)%\inps\inps uniemens individuale\ko.png
%ProgramFiles(x86)%\inps\inps uniemens individuale\closef.gif
%ProgramFiles(x86)%\inps\inps uniemens individuale\validatore.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\images\testata1_dimostrativodmag.bmp
%ProgramFiles(x86)%\inps\inps uniemens individuale\interop.shdocvw.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\images\testata1_exenpals - new.bmp
%ProgramFiles(x86)%\inps\inps uniemens individuale\inpstools.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\postinstallation.exe.config
%ProgramFiles(x86)%\inps\inps uniemens individuale\icsharpcode.sharpziplib.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\plainlogger.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\images\testata1_base - nobanner.png
%ProgramFiles(x86)%\inps\inps uniemens individuale\leggimi_uniemensindiv.htm
%ProgramFiles(x86)%\inps\inps uniemens individuale\resources\2017-bis\password.txt
%ProgramFiles(x86)%\inps\inps uniemens individuale\interop.repositorytypelib.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\itextsharp.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\images\testata_test.png
%ProgramFiles(x86)%\inps\inps uniemens individuale\microsoft.visualbasic.powerpacks.vs.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\anim\fondoemens.bmp
%WINDIR%\installer\{449118e8-48c0-43a5-9403-7a38dd9b2bee}\_6feff9b68218417f98f549.exe
%WINDIR%\installer\{449118e8-48c0-43a5-9403-7a38dd9b2bee}\_17750f93961942a27616d8.exe
%WINDIR%\installer\{449118e8-48c0-43a5-9403-7a38dd9b2bee}\_7e4c190a1d6046fae67595.exe
%WINDIR%\installer\{449118e8-48c0-43a5-9403-7a38dd9b2bee}\_9d198babbb863009dcf84c.exe
C:\users\public\desktop\inps uniemens individuale.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\inps uniemens individuale\inps uniemens individuale.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\inps uniemens individuale\leggimi_uniemensindiv.htm.lnk
%ProgramFiles(x86)%\inps\inps uniemens individuale\microsoft.practices.enterpriselibrary.data.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\images\testata1_emens_20160201.png
%ProgramFiles(x86)%\inps\inps uniemens individuale\images\testata1_dmag.bmp
%ProgramFiles(x86)%\inps\inps uniemens individuale\padlock.gif
%ProgramFiles(x86)%\inps\inps uniemens individuale\openf.gif
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\baiyycwp\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ijhev4ve\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\u9tlrrpn\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\zl1kvyjz\desktop.ini
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
C:\temp\inps_uniemensindiv_install.msi
%TEMP%\cfg53d.tmp
%ProgramFiles(x86)%\inps\inps uniemens individuale\inpsextxslt.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\microsoft.practices.objectbuilder2.dll
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%ProgramFiles(x86)%\inps\inps uniemens individuale\microsoft.practices.unity.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\uniemensindiv.exe.config
%ProgramFiles(x86)%\inps\inps uniemens individuale\images\testata1_base.png
%ProgramFiles(x86)%\inps\inps uniemens individuale\ok.png
%ProgramFiles(x86)%\inps\inps uniemens individuale\utilities.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\microsoft.practices.enterpriselibrary.logging.database.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\uni256.ico
%ProgramFiles(x86)%\inps\inps uniemens individuale\icon_bullet_16.gif
%ProgramFiles(x86)%\inps\inps uniemens individuale\microsoft.practices.enterpriselibrary.common.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\images\testata1_dimostrativoposagri.bmp
%ProgramFiles(x86)%\inps\inps uniemens individuale\axinterop.shdocvw.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\logging.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\inpszip.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\uniemensindiv.exe
%ProgramFiles(x86)%\inps\inps uniemens individuale\microsoft.practices.enterpriselibrary.logging.dll
%ProgramFiles(x86)%\inps\inps uniemens individuale\j9ubzc4z.newcfg
%ProgramFiles(x86)%\inps\inps uniemens individuale\oymit9go.newcfg

Присваивает атрибут 'скрытый' для следующих файлов

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\baiyycwp\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ijhev4ve\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\u9tlrrpn\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\zl1kvyjz\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini

Удаляет следующие файлы

%ProgramFiles(x86)%\inps\inps uniemens individuale\postinstallation.exe
%ProgramFiles(x86)%\inps\inps uniemens individuale\postinstallation.exe.config
%ProgramFiles(x86)%\inps\inps uniemens individuale\del.vbs

Перемещает следующие файлы

%ProgramFiles(x86)%\inps\inps uniemens individuale\j9ubzc4z.newcfg в %ProgramFiles(x86)%\inps\inps uniemens individuale\uniemensindiv.exe.config
%ProgramFiles(x86)%\inps\inps uniemens individuale\oymit9go.newcfg в %ProgramFiles(x86)%\inps\inps uniemens individuale\uniemensindiv.exe.config

Сетевая активность

Подключается к

'ou#.##nsiagnet.it':25

TCP

Запросы HTTP GET

http://www.si##eb.info/download/download/setup-uniemens_ind/INPS_uniEMensIndiv_Install.msi

UDP

DNS ASK ou#.##nsiagnet.it
DNS ASK si##eb.info

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\inps\inps uniemens individuale\postinstallation.exe' "%ProgramFiles(x86)%\INPS\INPS uniEMens individuale\\"

Запускает на исполнение

'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
'%WINDIR%\syswow64\msiexec.exe' /quiet /i C:\temp\INPS_uniEMensIndiv_Install.msi
'<SYSTEM32>\regsvr32.exe' /s scrrun.dll