Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\DriverNavigator Scheduled Scan.job
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.ConfigLanguageFromSetup.exe DriverNavigator en
- %TEMP%\install\License.exe
- %TEMP%\install\tryyyesesss.exe
- %TEMP%\install\DriverNavigator_Setup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- %TEMP%\is-BOJCQ.tmp\DriverNavigator_Setup.tmp /SL5="$1013C,1583634,140800,%TEMP%\install\DriverNavigator_Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.CheckScheduledScan.exe -create "DriverNavigator Scheduled Scan" "%PROGRAM_FILES%\Easeware\DriverNavigator\DriverNavigator.exe"
Запускает на исполнение:
- <SYSTEM32>\taskkill.exe /F /IM exitttt.cmd
- <SYSTEM32>\cmd.exe /c ""%TEMP%\install\sil_2.bat" "
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\Cab1.tmp
- %TEMP%\Cab3.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %TEMP%\Cab5.tmp
- %TEMP%\CabB.tmp
- %TEMP%\CabD.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\Cab9.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\DriverNavigator\DriverNavigator.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\DriverNavigator\Uninstall DriverNavigator.lnk
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-NL506.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-HE7LM.tmp
- %ALLUSERSPROFILE%\Desktop\DriverNavigator.lnk
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\Easeware\DriverNavigator\unins000.msg
- %PROGRAM_FILES%\Easeware\DriverNavigator\unins000.dat
- %TEMP%\Cab25.tmp
- %TEMP%\Cab27.tmp
- %TEMP%\Cab21.tmp
- %TEMP%\Cab23.tmp
- %TEMP%\Cab29.tmp
- %APPDATA%\Easeware\DriverNavigator\settings.dat
- %APPDATA%\Easeware\DriverNavigator\License.dat
- %TEMP%\Cab2B.tmp
- %TEMP%\Cab2D.tmp
- %TEMP%\Cab13.tmp
- %TEMP%\Cab15.tmp
- %TEMP%\CabF.tmp
- %TEMP%\Cab11.tmp
- %TEMP%\Cab17.tmp
- %TEMP%\Cab1D.tmp
- %TEMP%\Cab1F.tmp
- %TEMP%\Cab19.tmp
- %TEMP%\Cab1B.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-QA433.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-TS77S.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-4OV6J.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-35TVV.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-D5MA1.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-401HF.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\de\is-L2NKV.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-QI684.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-DTKUQ.tmp
- %TEMP%\install\DriverNavigator_Setup.exe
- %TEMP%\install\License.exe
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\install\tryyyesesss.exe
- %TEMP%\is-CKK2V.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-CKK2V.tmp\isxdl.dll
- %TEMP%\install\sil_2.bat
- %TEMP%\is-BOJCQ.tmp\DriverNavigator_Setup.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\uk\is-2278D.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\uk\is-892RV.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\hu\is-G5PCA.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\hu\is-D4KHU.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\uk\is-GLBE3.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-PK9FG.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-63GIO.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-RSMPR.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-0CQAT.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\es-AR\is-ID0MG.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\es-AR\is-TVFP6.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\de\is-PG25R.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\de\is-9PAMD.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\es-AR\is-1M8HT.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\fr\is-LR5CD.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\hu\is-HEIP1.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\fr\is-HVF5L.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\fr\is-V2E1O.tmp
Удаляет следующие файлы:
- %TEMP%\Cab29.tmp
- %TEMP%\Cab27.tmp
- %TEMP%\Cab2D.tmp
- %TEMP%\Cab2B.tmp
- %TEMP%\Cab21.tmp
- %TEMP%\Cab1F.tmp
- %TEMP%\Cab25.tmp
- %TEMP%\Cab23.tmp
- %TEMP%\install\License.exe
- %TEMP%\install\DriverNavigator_Setup.exe
- %TEMP%\$inst\2.tmp
- %TEMP%\install\tryyyesesss.exe
- %TEMP%\is-CKK2V.tmp\isxdl.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.ConfigLanguageFromSetup.exe
- %TEMP%\is-BOJCQ.tmp\DriverNavigator_Setup.tmp
- %TEMP%\is-CKK2V.tmp\_isetup\_shfoldr.dll
- %TEMP%\Cab9.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\CabD.tmp
- %TEMP%\CabB.tmp
- %TEMP%\Cab1.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\Cab5.tmp
- %TEMP%\Cab3.tmp
- %TEMP%\Cab19.tmp
- %TEMP%\Cab17.tmp
- %TEMP%\Cab1D.tmp
- %TEMP%\Cab1B.tmp
- %TEMP%\Cab11.tmp
- %TEMP%\CabF.tmp
- %TEMP%\Cab15.tmp
- %TEMP%\Cab13.tmp
Перемещает следующие файлы:
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\hu\is-D4KHU.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\x64\hu\Easeware.DriverInstall.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\uk\is-2278D.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\uk\DriverNavigator.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\uk\is-892RV.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\uk\Easeware.DriverInstall.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\hu\is-G5PCA.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\hu\Easeware.DriverInstall.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\fr\is-V2E1O.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\fr\Easeware.DriverInstall.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\fr\is-LR5CD.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\x64\fr\Easeware.DriverInstall.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\hu\is-HEIP1.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\hu\DriverNavigator.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-63GIO.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\x64\Easeware.Driver.Backup.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-NL506.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\x64\Easeware.Driver.Core.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-HE7LM.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\x64\Interop.WUApiLib.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-PK9FG.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\x64\Easeware.DriverInstall.exe
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\uk\is-GLBE3.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\x64\uk\Easeware.DriverInstall.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-RSMPR.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.ConfigLanguageFromSetup.exe
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-0CQAT.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.DriverInstall.exe
- %PROGRAM_FILES%\Easeware\DriverNavigator\fr\is-HVF5L.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\fr\DriverNavigator.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-D5MA1.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\UnRAR.exe
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-QI684.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\UnRAR_license.txt
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-DTKUQ.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\Interop.WUApiLib.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-TS77S.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.CheckScheduledScan.exe
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-4OV6J.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\unins000.exe
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-35TVV.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\DriverNavigator.exe
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-QA433.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.Driver.Core.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\es-AR\is-ID0MG.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\es-AR\DriverNavigator.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\es-AR\is-TVFP6.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\es-AR\Easeware.DriverInstall.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\es-AR\is-1M8HT.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\x64\es-AR\Easeware.DriverInstall.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\de\is-9PAMD.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\x64\de\Easeware.DriverInstall.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-401HF.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.Driver.Backup.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\de\is-L2NKV.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\de\DriverNavigator.resources.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\de\is-PG25R.tmp в %PROGRAM_FILES%\Easeware\DriverNavigator\de\Easeware.DriverInstall.resources.dll
Сетевая активность:
Подключается к:
- 'www.download.windowsupdate.com':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- wp#d/wpad.dat
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
