Trojan.Siggen18.36598

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-m8d4v.tmp\is-mqi2a.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\unins000.dat
%ProgramFiles(x86)%\powerpoint repair toolbox\is-kde27.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-cling.tmp
%WINDIR%\syswow64\is-oioc7.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-fh330.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-181mq.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-3t5h1.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-gdndt.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-19hab.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-2qmpm.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-bs5n0.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-o7g8g.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-qph08.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-qnf92.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-2fi2m.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-55qk8.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-f4og0.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-jt177.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-gp71a.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-f87dc.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-7ssor.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-ev8qc.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\is-hr8k4.tmp
%TEMP%\is-i72k4.tmp\_isetup\_iscrypt.dll
%TEMP%\is-i72k4.tmp\_isetup\_shfoldr.dll
%TEMP%\is-i72k4.tmp\_isetup\_setup64.tmp
%TEMP%\is-i72k4.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolboxlauncher.exe
%TEMP%\ska.cab

Перемещает следующие файлы

%ProgramFiles(x86)%\powerpoint repair toolbox\is-hr8k4.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\unins000.exe
%WINDIR%\syswow64\is-oioc7.tmp в %WINDIR%\syswow64\sqlite3.dll
%ProgramFiles(x86)%\powerpoint repair toolbox\is-fh330.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\wmfdist.exe
%ProgramFiles(x86)%\powerpoint repair toolbox\is-181mq.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\turbosearch.exe
%ProgramFiles(x86)%\powerpoint repair toolbox\is-3t5h1.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\ssleay32.dll
%ProgramFiles(x86)%\powerpoint repair toolbox\is-gdndt.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\libeay32.dll
%ProgramFiles(x86)%\powerpoint repair toolbox\is-19hab.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpoint repair toolbox license.txt
%ProgramFiles(x86)%\powerpoint repair toolbox\is-2qmpm.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.trk
%ProgramFiles(x86)%\powerpoint repair toolbox\is-bs5n0.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.rus
%ProgramFiles(x86)%\powerpoint repair toolbox\is-o7g8g.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.ptb
%ProgramFiles(x86)%\powerpoint repair toolbox\is-qph08.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.plk
%ProgramFiles(x86)%\powerpoint repair toolbox\is-qnf92.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.nld
%ProgramFiles(x86)%\powerpoint repair toolbox\is-2fi2m.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.kor
%ProgramFiles(x86)%\powerpoint repair toolbox\is-55qk8.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.jpn
%ProgramFiles(x86)%\powerpoint repair toolbox\is-f4og0.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.ita
%ProgramFiles(x86)%\powerpoint repair toolbox\is-jt177.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.fra
%ProgramFiles(x86)%\powerpoint repair toolbox\is-gp71a.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.esn
%ProgramFiles(x86)%\powerpoint repair toolbox\is-f87dc.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.deu
%ProgramFiles(x86)%\powerpoint repair toolbox\is-7ssor.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.chs
%ProgramFiles(x86)%\powerpoint repair toolbox\is-ev8qc.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.ara
%ProgramFiles(x86)%\powerpoint repair toolbox\is-cling.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolboxlauncher.exe
%ProgramFiles(x86)%\powerpoint repair toolbox\is-kde27.tmp в %ProgramFiles(x86)%\powerpoint repair toolbox\settings.bin

Сетевая активность

Подключается к

'pe###igold.xyz':80

TCP

Запросы HTTP GET

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?eb##############

Запросы HTTP POST

http://pe###igold.xyz/new/net_api

UDP

DNS ASK pe###igold.xyz

Другое

Ищет следующие окна

ClassName: 'PowerPointRTBClassTRE1' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-m8d4v.tmp\is-mqi2a.tmp' /SL4 $C0120 "<Полный путь к файлу>" 10268394 95232
'%ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolboxlauncher.exe'
'%ProgramFiles(x86)%\powerpoint repair toolbox\wmfdist.exe' /Q:A /R:N
'%ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolboxlauncher.exe' 73dfe1e1620bf0c2e55cf9233be897b2