Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\rarsfx0\drivermagician.exe
- %ProgramFiles(x86)%\driver magician\language\is-3vdvj.tmp
- %ProgramFiles(x86)%\driver magician\language\is-8gjhb.tmp
- %ProgramFiles(x86)%\driver magician\language\is-bnq0d.tmp
- %ProgramFiles(x86)%\driver magician\language\is-vgnr0.tmp
- %ProgramFiles(x86)%\driver magician\is-ld8c8.tmp
- %ProgramFiles(x86)%\driver magician\is-dfbvm.tmp
- %ProgramFiles(x86)%\driver magician\is-t0qj6.tmp
- %APPDATA%\driver magician\is-hkqfs.tmp
- %WINDIR%\syswow64\is-1bk7i.tmp
- %WINDIR%\syswow64\is-16sjv.tmp
- C:\users\public\desktop\driver magician.lnk
- %WINDIR%\syswow64\is-i0kqq.tmp
- %WINDIR%\syswow64\is-3h919.tmp
- %WINDIR%\syswow64\is-hvtmp.tmp
- %WINDIR%\syswow64\is-5frch.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\driver magician\driver magician.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\driver magician\help.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\driver magician\readme.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\driver magician\homepage.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\driver magician\uninstall driver magician.lnk
- %ProgramFiles(x86)%\driver magician\language\is-nqcvf.tmp
- %WINDIR%\syswow64\is-1c078.tmp
- %ProgramFiles(x86)%\driver magician\language\is-5ivlt.tmp
- %ProgramFiles(x86)%\driver magician\is-s1d8v.tmp
- %TEMP%\rarsfx0\cybermania.url
- %TEMP%\rarsfx0\register.reg
- %TEMP%\is-eib98.tmp\drivermagician.tmp
- %TEMP%\is-e4mrf.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\driver magician\is-tfgcj.tmp
- %ProgramFiles(x86)%\driver magician\is-rgknc.tmp
- %ProgramFiles(x86)%\driver magician\is-mb9nh.tmp
- %ProgramFiles(x86)%\driver magician\is-1bnbk.tmp
- %ProgramFiles(x86)%\driver magician\is-sgqga.tmp
- %ProgramFiles(x86)%\driver magician\is-8h2af.tmp
- %ProgramFiles(x86)%\driver magician\language\is-ckilq.tmp
- %ProgramFiles(x86)%\driver magician\is-it7hb.tmp
- %ProgramFiles(x86)%\driver magician\is-hmlft.tmp
- %ProgramFiles(x86)%\driver magician\is-m96m0.tmp
- %ProgramFiles(x86)%\driver magician\language\is-ertmm.tmp
- %ProgramFiles(x86)%\driver magician\language\is-phu5d.tmp
- %ProgramFiles(x86)%\driver magician\language\is-adb75.tmp
- %ProgramFiles(x86)%\driver magician\language\is-epa98.tmp
- %ProgramFiles(x86)%\driver magician\language\is-052ht.tmp
- %ProgramFiles(x86)%\driver magician\language\is-vlkkh.tmp
- %ProgramFiles(x86)%\driver magician\language\is-m831e.tmp
- %ProgramFiles(x86)%\driver magician\unins000.dat
Удаляет следующие файлы
- %TEMP%\is-e4mrf.tmp\_isetup\_setup64.tmp
- %TEMP%\is-eib98.tmp\drivermagician.tmp
- %TEMP%\rarsfx0\cybermania.url
- %TEMP%\rarsfx0\drivermagician.exe
- %TEMP%\rarsfx0\register.reg
Перемещает следующие файлы
- %ProgramFiles(x86)%\driver magician\is-tfgcj.tmp в %ProgramFiles(x86)%\driver magician\unins000.exe
- %ProgramFiles(x86)%\driver magician\language\is-nqcvf.tmp в %ProgramFiles(x86)%\driver magician\language\polish.ini
- %ProgramFiles(x86)%\driver magician\language\is-3vdvj.tmp в %ProgramFiles(x86)%\driver magician\language\portuguese.ini
- %ProgramFiles(x86)%\driver magician\language\is-8gjhb.tmp в %ProgramFiles(x86)%\driver magician\language\spanish.ini
- %ProgramFiles(x86)%\driver magician\language\is-bnq0d.tmp в %ProgramFiles(x86)%\driver magician\language\turkish.ini
- %ProgramFiles(x86)%\driver magician\language\is-vgnr0.tmp в %ProgramFiles(x86)%\driver magician\language\ukrainian.ini
- %ProgramFiles(x86)%\driver magician\is-ld8c8.tmp в %ProgramFiles(x86)%\driver magician\autointall.dll
- %ProgramFiles(x86)%\driver magician\is-t0qj6.tmp в %ProgramFiles(x86)%\driver magician\sortascending.ico
- %WINDIR%\syswow64\is-hvtmp.tmp в %WINDIR%\syswow64\xcdsfx32.bin
- %APPDATA%\driver magician\is-hkqfs.tmp в %APPDATA%\driver magician\hiddenupdate.txt
- %WINDIR%\syswow64\is-1bk7i.tmp в %WINDIR%\syswow64\comdlg32.ocx
- %WINDIR%\syswow64\is-1c078.tmp в %WINDIR%\syswow64\msinet.ocx
- %WINDIR%\syswow64\is-16sjv.tmp в %WINDIR%\syswow64\mscomctl.ocx
- %WINDIR%\syswow64\is-i0kqq.tmp в %WINDIR%\syswow64\xceedzip.dll
- %WINDIR%\syswow64\is-3h919.tmp в %WINDIR%\syswow64\xceedcry.dll
- %ProgramFiles(x86)%\driver magician\language\is-5ivlt.tmp в %ProgramFiles(x86)%\driver magician\language\korean.ini
- %ProgramFiles(x86)%\driver magician\is-dfbvm.tmp в %ProgramFiles(x86)%\driver magician\sortdescending.ico
- %ProgramFiles(x86)%\driver magician\language\is-m831e.tmp в %ProgramFiles(x86)%\driver magician\language\italian.ini
- %ProgramFiles(x86)%\driver magician\is-it7hb.tmp в %ProgramFiles(x86)%\driver magician\icon.ico
- %ProgramFiles(x86)%\driver magician\is-rgknc.tmp в %ProgramFiles(x86)%\driver magician\driver magician.exe
- %ProgramFiles(x86)%\driver magician\is-mb9nh.tmp в %ProgramFiles(x86)%\driver magician\readme.txt
- %ProgramFiles(x86)%\driver magician\is-1bnbk.tmp в %ProgramFiles(x86)%\driver magician\pcidevs.txt
- %ProgramFiles(x86)%\driver magician\is-sgqga.tmp в %ProgramFiles(x86)%\driver magician\help.chm
- %ProgramFiles(x86)%\driver magician\is-s1d8v.tmp в %ProgramFiles(x86)%\driver magician\dutchhelp.chm
- %ProgramFiles(x86)%\driver magician\is-8h2af.tmp в %ProgramFiles(x86)%\driver magician\homepage.url
- %ProgramFiles(x86)%\driver magician\is-hmlft.tmp в %ProgramFiles(x86)%\driver magician\driverdb.dat
- %ProgramFiles(x86)%\driver magician\language\is-vlkkh.tmp в %ProgramFiles(x86)%\driver magician\language\hebrew.ini
- %ProgramFiles(x86)%\driver magician\is-m96m0.tmp в %ProgramFiles(x86)%\driver magician\public.key
- %ProgramFiles(x86)%\driver magician\language\is-ertmm.tmp в %ProgramFiles(x86)%\driver magician\language\arabic.ini
- %ProgramFiles(x86)%\driver magician\language\is-phu5d.tmp в %ProgramFiles(x86)%\driver magician\language\dutch.ini
- %ProgramFiles(x86)%\driver magician\language\is-adb75.tmp в %ProgramFiles(x86)%\driver magician\language\english.ini
- %ProgramFiles(x86)%\driver magician\language\is-epa98.tmp в %ProgramFiles(x86)%\driver magician\language\french.ini
- %ProgramFiles(x86)%\driver magician\language\is-052ht.tmp в %ProgramFiles(x86)%\driver magician\language\german.ini
- %ProgramFiles(x86)%\driver magician\language\is-ckilq.tmp в %ProgramFiles(x86)%\driver magician\language\hungarian.ini
- %WINDIR%\syswow64\is-5frch.tmp в %WINDIR%\syswow64\codejock.controls.v15.0.1.ocx
Сетевая активность
UDP
- DNS ASK cy###mania.ws
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\rarsfx0\drivermagician.exe' /silent
- '%TEMP%\is-eib98.tmp\drivermagician.tmp' /SL5="$A0232,5207288,780800,%TEMP%\RarSFX0\DriverMagician.exe" /silent
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\Comdlg32.ocx"
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\Msinet.ocx"
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\Mscomctl.ocx"
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\XCEEDZIP.DLL"
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\XceedCry.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\Codejock.Controls.v15.0.1.ocx"
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Driver Magician" /v "serialnumber" /t REG_SZ /d "C2L54dEf14-289F3" /f
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Driver Magician" /v "username" /t REG_SZ /d "CyberMania" /f
