Trojan.Siggen17.29578

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\CLASSES\st-streamer\shell\open\command] '' = '%ProgramFiles(x86)%\Splashtop\Splashtop Remote\Server\SRUtility.exe -a %1'

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\SSUService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\SSUService] 'ImagePath' = '%ProgramFiles(x86)%\Splashtop\Splashtop Software Updater\SSUService.exe'
[<HKLM>\System\CurrentControlSet\Services\SplashtopRemoteService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\SplashtopRemoteService] 'ImagePath' = '"%ProgramFiles(x86)%\Splashtop\Splashtop Remote\Server\SRService.exe"'

Создает следующие сервисы

'SSUService' %ProgramFiles(x86)%\Splashtop\Splashtop Software Updater\SSUService.exe
'SplashtopRemoteService' "%ProgramFiles(x86)%\Splashtop\Splashtop Remote\Server\SRService.exe"
'SplashtopRemoteService' %ProgramFiles(x86)%\Splashtop\Splashtop Remote\Server\SRService.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\unpack.log
%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\setup.inx
%TEMP%\_is8702.tmp
%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\isrt.dll
%TEMP%\_is8741.tmp
%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\isbew64.exe
%TEMP%\_is8752.tmp
%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\_isres_0x0409.dll
%TEMP%\_is8782.tmp
%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\string1033.txt
%TEMP%\nss8a17.tmp
%TEMP%\nss9389.tmp
%WINDIR%\installer\{b7c5ea94-b96a-41f5-be95-25d78b486678}\arpproducticon.exe
%TEMP%\nss938a.tmp\system.dll
%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuclient.dll
%ProgramFiles(x86)%\splashtop\splashtop software updater\wcxinst.exe
%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuapi.dll
%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuagent.exe
%ProgramFiles(x86)%\splashtop\splashtop software updater\defaultui.dll
%ProgramFiles(x86)%\splashtop\splashtop software updater\uninst.exe
%TEMP%\nss938a.tmp\ssudesc.xml
%TEMP%\_is9f76.tmp
%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\isconfig.ini
%TEMP%\_is9f86.tmp
%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\setup.inx
%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\isconfig.ini
%TEMP%\_is86d2.tmp
%TEMP%\_is86c2.tmp
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srclient.pem
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\splashtop remote\splashtop streamer.lnk
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\uninstall_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\uninstall_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\wdfcoinstaller01009.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\64bits\hidkmdf.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\64bits\sthid.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\64bits\wdfcoinstaller01009.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\devcon.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\devcon64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\difxcmd.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\difxcmd64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\sthidnotsupport.reg
%TEMP%\_is9fb6.tmp
%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuservice.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\sthidsupport.reg
%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\isconfig.ini
%TEMP%\_is7484.tmp
%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\setup.inx
%TEMP%\_is74c4.tmp
%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\isrt.dll
%TEMP%\_is7513.tmp
%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\isbew64.exe
%TEMP%\_is7562.tmp
%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\_isres_0x0409.dll
%TEMP%\_is7582.tmp
%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\string1033.txt
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\sthid.sys
%TEMP%\_is7454.tmp
%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\isrt.dll
%TEMP%\_is9fe6.tmp
%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\isbew64.exe
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\070e0202839d9d67350cd2613e78e416
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\070e0202839d9d67350cd2613e78e416
%WINDIR%\temp\cabe57e.tmp
%WINDIR%\temp\tare58e.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\temp\cabfb9f.tmp
%WINDIR%\temp\tarfba0.tmp
%WINDIR%\temp\cab10f5.tmp
%WINDIR%\temp\tar10f6.tmp
%WINDIR%\temp\cab1135.tmp
%WINDIR%\temp\tar1136.tmp
%WINDIR%\temp\tar26ab.tmp
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\sthid.inf
%WINDIR%\temp\cab26db.tmp
%WINDIR%\temp\tar26dc.tmp
%WINDIR%\temp\cab619c.tmp
%WINDIR%\temp\tar619d.tmp
%WINDIR%\temp\cab61bd.tmp
%WINDIR%\temp\tar61be.tmp
%WINDIR%\temp\cab61ce.tmp
%WINDIR%\temp\tar61cf.tmp
%WINDIR%\temp\cab61f0.tmp
%WINDIR%\temp\tar61f1.tmp
%WINDIR%\temp\{5c9f677d-f397-4f6a-a1eb-f170002eeb66}
%WINDIR%\temp\{179ef93a-dd6a-4739-b91e-ced492ff9717}
%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\string1033.txt
%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\_isres_0x0409.dll
%TEMP%\_isbac8.tmp
%TEMP%\_isa5a7.tmp
%TEMP%\_is9ff7.tmp
%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\_isres_0x0409.dll
%TEMP%\_isa026.tmp
%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\string1033.txt
%TEMP%\_isa527.tmp
%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\isconfig.ini
%TEMP%\_isa547.tmp
%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\setup.inx
%TEMP%\_isa567.tmp
%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\isrt.dll
%TEMP%\_isa597.tmp
%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\isbew64.exe
%ALLUSERSPROFILE%\splashtop\splashtop software updater\tracking\platform_protossu01.csv
%TEMP%\_isba98.tmp
%TEMP%\_isa5c8.tmp
%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\string1033.txt
%WINDIR%\temp\{0816f4e6-2fb5-4c82-a03c-f1856a44a2ea}
%WINDIR%\syswow64\config\systemprofile\appdata\local\gdipfontcachev1.dat
%TEMP%\_isb9c9.tmp
%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\isconfig.ini
%TEMP%\_isb9e9.tmp
%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\setup.inx
%TEMP%\_isba19.tmp
%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\isrt.dll
%TEMP%\_isba78.tmp
%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\isbew64.exe
%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\_isres_0x0409.dll
%WINDIR%\temp\cab26aa.tmp
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\sthid.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\64bits\stmirror.dll
%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\isrt.dll
%TEMP%\_is63f9.tmp
%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\isbew64.exe
%TEMP%\_is6419.tmp
%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\_isres_0x0409.dll
%TEMP%\_is6449.tmp
%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\string1033.txt
%ProgramFiles(x86)%\splashtop\splashtop remote\server\acknowledgements.htm
%ProgramFiles(x86)%\splashtop\splashtop remote\server\amf-vcedem-win32.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\dataproxy.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\dbghelp.dll
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\pinshortcut.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\elevator.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\libmp4v2.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\libx264-116.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\nvfbc.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\pinshortcut.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\pkghelper.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\spupnp.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srademwrapper.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srappbs.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\sraudioresample.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srdxgicaptor.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srfeature.exe
%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\setup.inx
%TEMP%\_is63c9.tmp
%TEMP%\_is6399.tmp
%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\isconfig.ini
%TEMP%\_is6389.tmp
%TEMP%\unpack\run.bat
%TEMP%\unpack\setup.ini
%TEMP%\unpack\prevercheck.exe
%TEMP%\unpack\uninst.iss
%TEMP%\unpack.log.txt
%TEMP%\prever.log
%TEMP%\prever.log.txt
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setup.ini
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setuputil.exe
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\splashtop_software_updater.exe
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\ssu_clean.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srselfsigncertutil.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\libcelt-0.dll
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\description.xml
%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\isconfig.ini
%TEMP%\_is5f40.tmp
%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\setup.inx
%TEMP%\_is5f70.tmp
%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\isrt.dll
%TEMP%\_is5f9f.tmp
%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\isbew64.exe
%TEMP%\_is5fc0.tmp
%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\_isres_0x0409.dll
%TEMP%\_is5fef.tmp
%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\string1033.txt
%TEMP%\unpack\setup.msi
%TEMP%\_is5f10.tmp
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srsendlog.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srserver.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srserver.pem
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\utils\devcon64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\utils\difxcmd.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\utils\difxcmd64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\install.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\installwin7.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\installwin7_64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\stmirror.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\stmirror.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\stvideo.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\stvideo.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\stvideo.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\stvideo.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\64bits\stmirror.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\install_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\64bits\stvideo.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\64bits\stvideo.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\utils\devcon.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\utils\devcon64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\utils\mirror2extend.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srappannotation.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srappbrowser.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srappcam.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srapped.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srappfilehound.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\strlog\splashtop.bl
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\hidkmdf.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\utils\devcon.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\uninstall_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\64bits\stdpms.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\uninstall_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srsoobe.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srupdate.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srupdateinstall.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srutility.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srx264wrapper.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\wbappvidrec.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\install_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\install_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\stgamepad.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\stgamepad.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\stgamepad.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\install_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\uninstall_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\64bits\stgamepad.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\utils\devcon.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\utils\devcon64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\utils\difxcmd.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\utils\difxcmd64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\utils\enum.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\utils\enum64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\install_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\install_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\stdpms.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\stdpms.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\stdpms.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\uninstall_driver64.bat
%WINDIR%\temp\{6cea5395-f796-4f13-8da3-b3fa1a5afb02}

Удаляет следующие файлы

%TEMP%\_is5f10.tmp
%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\isbew64.exe
%TEMP%\_isbac8.tmp
%TEMP%\_isba98.tmp
%TEMP%\_isba78.tmp
%TEMP%\_isba19.tmp
%TEMP%\_isb9e9.tmp
%TEMP%\_isb9c9.tmp
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\ssu_clean.exe
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\splashtop_software_updater.exe
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setuputil.exe
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setup.ini
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\pinshortcut.exe
%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\isrt.dll
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\description.xml
%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\_isres_0x0409.dll
%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\string1033.txt
%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\isconfig.ini
%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\isrt.dll
%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\isbew64.exe
%WINDIR%\temp\{0816f4e6-2fb5-4c82-a03c-f1856a44a2ea}
%TEMP%\_isa5c8.tmp
%TEMP%\_isa5a7.tmp
%TEMP%\_isa597.tmp
%TEMP%\_isa567.tmp
%TEMP%\_isa547.tmp
%TEMP%\_isa527.tmp
%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\setup.inx
%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\isconfig.ini
%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\string1033.txt
%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\_isres_0x0409.dll
%WINDIR%\temp\{179ef93a-dd6a-4739-b91e-ced492ff9717}
%WINDIR%\temp\tar61f1.tmp
%WINDIR%\temp\cab61f0.tmp
%WINDIR%\temp\tar61cf.tmp
%WINDIR%\temp\cab61ce.tmp
%WINDIR%\temp\tar61be.tmp
%WINDIR%\temp\cab61bd.tmp
%WINDIR%\temp\tar619d.tmp
%WINDIR%\temp\cab619c.tmp
%WINDIR%\temp\tar26dc.tmp
%WINDIR%\temp\cab26db.tmp
%WINDIR%\temp\tar26ab.tmp
%WINDIR%\temp\cab26aa.tmp
%WINDIR%\temp\tar1136.tmp
%WINDIR%\temp\cab1135.tmp
%WINDIR%\temp\tar10f6.tmp
%WINDIR%\temp\cab10f5.tmp
%WINDIR%\temp\tarfba0.tmp
%WINDIR%\temp\cabfb9f.tmp
%WINDIR%\temp\tare58e.tmp
%WINDIR%\temp\cabe57e.tmp
%TEMP%\unpack\uninst.iss
%TEMP%\unpack\setup.msi
%TEMP%\unpack\setup.ini
%TEMP%\unpack\run.bat
%TEMP%\unpack\prevercheck.exe
%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\setup.inx
%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\setup.inx
%WINDIR%\temp\{5c9f677d-f397-4f6a-a1eb-f170002eeb66}
%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\_isres_0x0409.dll
%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\isconfig.ini
%TEMP%\_is74c4.tmp
%TEMP%\_is7484.tmp
%TEMP%\_is7454.tmp
%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\setup.inx
%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\_isres_0x0409.dll
%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\string1033.txt
%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\isconfig.ini
%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\isrt.dll
%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\isbew64.exe
%TEMP%\_is6449.tmp
%TEMP%\_is6419.tmp
%TEMP%\_is63f9.tmp
%TEMP%\_is7513.tmp
%TEMP%\_is63c9.tmp
%TEMP%\_is6389.tmp
%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\setup.inx
%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\_isres_0x0409.dll
%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\string1033.txt
%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\isconfig.ini
%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\isrt.dll
%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\isbew64.exe
%TEMP%\_is5fef.tmp
%TEMP%\_is5fc0.tmp
%TEMP%\_is5f9f.tmp
%TEMP%\_is5f70.tmp
%TEMP%\_is5f40.tmp
%TEMP%\_is6399.tmp
%TEMP%\_is7562.tmp
%TEMP%\_is7582.tmp
%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\isbew64.exe
%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\isrt.dll
%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\isbew64.exe
%TEMP%\_isa026.tmp
%TEMP%\_is9ff7.tmp
%TEMP%\_is9fe6.tmp
%TEMP%\_is9fb6.tmp
%TEMP%\_is9f86.tmp
%TEMP%\_is9f76.tmp
%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\setup.inx
%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\_isres_0x0409.dll
%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\string1033.txt
%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\isconfig.ini
%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\isrt.dll
%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\isbew64.exe
%TEMP%\nss938a.tmp\system.dll
%TEMP%\nss938a.tmp\ssudesc.xml
%TEMP%\_is8782.tmp
%TEMP%\_is8752.tmp
%TEMP%\_is8741.tmp
%TEMP%\_is8702.tmp
%TEMP%\_is86d2.tmp
%TEMP%\_is86c2.tmp
%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\setup.inx
%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\_isres_0x0409.dll
%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\string1033.txt
%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\isconfig.ini
%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\isrt.dll
%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\string1033.txt
%WINDIR%\temp\{6cea5395-f796-4f13-8da3-b3fa1a5afb02}

Сетевая активность

Подключается к

'sn.###ashtop.com':80
'sn.###ashtop.com':443
'x.##2.us':80
'oc##.thawte.com':80
'microsoft.com':80
'ds#.##vicevm.com':80

TCP

Запросы HTTP GET

http://sn.###ashtop.com/file_system/apt_repository/dists/ProtoSSU01/released/binary-i386/Packages.gz
http://x.##2.us/x.cer
http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

Другие

'sn.###ashtop.com':443

UDP

DNS ASK sn.###ashtop.com
DNS ASK x.##2.us
DNS ASK oc##.thawte.com
DNS ASK microsoft.com
DNS ASK ds#.##vicevm.com

Другое

Ищет следующие окна

ClassName: 'MsiDialogCloseClass' WindowName: ''
ClassName: '#32770' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\splashtop_software_updater.exe' /S /Caller=SVR
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srsoobe.exe' -s
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe'
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe' -r
'%TEMP%\{f0edab29-5300-4518-b4bc-64aa40b46568}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{366FC70E-65B2-4D0A-94D8-2609A48F8D7B}
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe' -i
'%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuservice.exe'
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srselfsigncertutil.exe' -g
'%TEMP%\{7fcec48c-1346-424a-90fe-457c4abf9566}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4DFAA746-4120-4CDF-A9FA-9241F88346D8}
'%TEMP%\{7beda3e9-68f0-4208-b231-264761dbe745}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{34C0B709-DB77-49BE-B0F8-721AD9879E2B}
'%TEMP%\{e7d54430-32de-4ae3-b403-b185b8edf6f5}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6DD95232-ECF6-412E-B65E-C1F26B68E538}
'%TEMP%\{8d0513f7-bbb6-4af3-ae57-856d15ce42e4}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BF862FB8-F17B-4D01-B1EF-3D7DF97F857E}
'%TEMP%\{e2e03778-4019-4fea-a947-85938e71e170}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ED381AC3-5D19-4382-A199-48C4C372F604}
'%TEMP%\unpack\prevercheck.exe'
'%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\ssu_clean.exe' /S
'%TEMP%\{757fa908-efd6-44be-90c8-cd64ac987a9f}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{86C68612-0897-4833-A8CE-B6A83469DC06}
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe' -i' (со скрытым окном)
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe' -r' (со скрытым окном)
'%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\ssu_clean.exe' /S' (со скрытым окном)
'%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\splashtop_software_updater.exe' /S /Caller=SVR' (со скрытым окном)
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srselfsigncertutil.exe' -g' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c run.bat > %TEMP%\unpack.log.txt' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c run.bat > %TEMP%\unpack.log.txt
'%WINDIR%\syswow64\msiexec.exe' /norestart /i "setup.msi" /qb! /l*v "%TEMP%\PreVer.log.txt" CA_EXTPATH=1

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней