Trojan.Siggen21.11140

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Classes\Fixlet.EnterpriseFixletMasthead\shell\open\command] '' = '%ProgramFiles(x86)%\BigFix Enterprise\BES Console\BESConsole.exe /dde "%1"'
[HKLM\SOFTWARE\Classes\besfile\shell\open\command] '' = '%ProgramFiles(x86)%\BigFix Enterprise\BES Console\BESConsole.exe /dde "%1"'
[HKLM\SOFTWARE\Classes\besrpfile\shell\open\command] '' = '%ProgramFiles(x86)%\BigFix Enterprise\BES Console\BESConsole.exe /dde "%1"'

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\IDriverT] 'ImagePath' = '"%CommonProgramFiles(x86)%\InstallShield\Driver\11\Intel 32\IDriverT.exe"'

Создает следующие сервисы

'IDriverT' "%CommonProgramFiles(x86)%\InstallShield\Driver\11\Intel 32\IDriverT.exe"
'IDriverT' %CommonProgramFiles(x86)%\InstallShield\Driver\11\Intel 32\IDriverT.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ext8d42.tmp
%WINDIR%\syswow64\msxml4r.dll
%WINDIR%\installer\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\arpproducticon.exe
%WINDIR%\installer\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\newshortcut3_3c840fbf3eac41a7ad6847fb04b8e917.exe
%WINDIR%\installer\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\newshortcut3_6db23cc150794fb2a5f35aae3013f5a5.exe
C:\users\public\desktop\bes console.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bigfix enterprise\bes console.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bigfix enterprise\bes relevance debugger.lnk
%WINDIR%\odbcinst.ini
%WINDIR%\odbc.ini
%WINDIR%\installer\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\1033.mst
%TEMP%\ixp000.tmp\dasetup.exe
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\sort_asc.gif
%TEMP%\ixp000.tmp\dasetup.ini
%TEMP%\ixp000.tmp\odbcconf.exe
%TEMP%\ixp000.tmp\odbcconf.dll
%TEMP%\ixp000.tmp\mdaceula.rtf
%TEMP%\ixp000.tmp\redist.rsp
%TEMP%\ixp000.tmp\mdaccore.rsp
%TEMP%\ixp000.tmp\sqlclnt.rsp
%TEMP%\ixp000.tmp\rspfiles.inf
%TEMP%\ixp000.tmp\msxmlx.cab
%TEMP%\ixp000.tmp\msxml.inf
%TEMP%\ixp000.tmp\sqlxmlxp.cab
%TEMP%\ixp000.tmp\sqlxmlx.inf
%ProgramFiles(x86)%\bigfix enterprise\bes console\localization\jpn\beshelpjpn.chm
%WINDIR%\syswow64\msxml4.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\localization\jpn\besconsolejpn.xlat
%ProgramFiles(x86)%\bigfix enterprise\bes console\localization\jpn\besconsolejpn.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\localization\chs\beshelpchs.chm
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\movedowngroupdisabled.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\movegroupup.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\movegroupupdisabled.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\moveup.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\moveupdisabled.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\offer.css
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\ou.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\presentationtest.ojo
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\qnawizard.ojo
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\removeindent.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\sectionheaderbg.gif
%TEMP%\ixp000.tmp\wdsetup.cab
%TEMP%\ixp000.tmp\dasetupr.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\sectionheaderbgnav.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\spacer.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\wizards.css
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\wizards.js
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\wiz_24.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\qna\beslib\engine.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\qna\beslib\inspectors\client.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\qna\beslib\inspectors\core.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\qna\beslib\inspectors\regexp.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\qna\relevancedebugger.exe
%ProgramFiles(x86)%\bigfix enterprise\bes console\localization\chs\besconsolechs.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\localization\chs\besconsolechs.xlat
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\movedowngroup.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\sort_desc.gif
%TEMP%\ixp000.tmp\msxmlx.cat
%ProgramFiles(x86)%\installshield installation information\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\setu24ed.rra
%TEMP%\ixp000.tmp\sqloldb.cab
%TEMP%\ixp000.tmp\wdset_dl.inf
%TEMP%\ixp000.tmp\wdsetupm.cat
%TEMP%\ixp000.tmp\sqloldbm.inf
%TEMP%\ixp000.tmp\sqlol_dl.inf
%TEMP%\ixp000.tmp\sqloldbm.cat
%TEMP%\ixp000.tmp\sqlodbcm.inf
%TEMP%\ixp000.tmp\sqlod_dl.inf
%TEMP%\ixp000.tmp\sqlodbcm.cat
%TEMP%\ixp000.tmp\sqlnetm.inf
%TEMP%\ixp000.tmp\sqlnetdl.inf
%TEMP%\ixp000.tmp\sqlnetm.cat
%TEMP%\ixp000.tmp\wdsetup.inf
%TEMP%\ixp000.tmp\mdacxpkm.inf
%TEMP%\ixp000.tmp\mdacxpkm.cat
%TEMP%\ixp000.tmp\w95inf16.dll
%TEMP%\ixp000.tmp\w95inf32.dll
%TEMP%\ixp000.tmp\msdamg9x.dll
%TEMP%\ixp000.tmp\setupapi.cab
%TEMP%\ixp000.tmp\dasetupd.inf
%TEMP%\ixp000.tmp\rspfiled.inf
%TEMP%\ixp000.tmp\setupapi.inf
%TEMP%\ixp000.tmp\mtxfiles.cab
%TEMP%\ixp000.tmp\mtxfiles.inf
%TEMP%\ixp000.tmp\msvcrt.cab
%TEMP%\ixp000.tmp\psapi.dll
%TEMP%\ixp000.tmp\wdsetupm.inf
%TEMP%\ixp000.tmp\muisetup.exe
%TEMP%\ixp000.tmp\newmui.inf
%TEMP%\ixp000.tmp\cabinet.dll
%TEMP%\ixp000.tmp\sqloldb.cat
%TEMP%\ixp000.tmp\sqlodbc.cab
%TEMP%\ixp000.tmp\sqlodbc.inf
%TEMP%\ixp000.tmp\sqlodbc.cat
%TEMP%\ixp000.tmp\sqlnet.cab
%TEMP%\ixp000.tmp\sqlnet.inf
%TEMP%\ixp000.tmp\sqlnet.cat
%TEMP%\ixp000.tmp\mdacxpak.cab
%TEMP%\ixp000.tmp\mdacxpak.inf
%TEMP%\ixp000.tmp\mdacxpak.cat
%TEMP%\ixp000.tmp\dasetup.inf
%TEMP%\ixp000.tmp\wdsetup.cat
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\movedowndisabled.gif
%TEMP%\ixp000.tmp\noop.inf
%TEMP%\ixp000.tmp\sqlxmlxp.inf
%TEMP%\ixp000.tmp\sqlxmlxp.cat
%TEMP%\ixp000.tmp\dasetup.cat
%TEMP%\ixp000.tmp\rspfiles.cat
%TEMP%\ixp000.tmp\dasetup.cab
%TEMP%\ixp000.tmp\rspfiles.cab
%TEMP%\ixp000.tmp\msvcrt.inf
%TEMP%\ixp000.tmp\jetfiles.cab
%TEMP%\ixp000.tmp\jetfiles.inf
%TEMP%\ixp000.tmp\advpack.dll
%TEMP%\ixp000.tmp\setup.exe
%TEMP%\ixp000.tmp\sqloldb.inf
%TEMP%\ixp000.tmp\msxmlx.inf
%TEMP%\ixp000.tmp\mdacxpdl.inf
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\movedown.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\dc.gif
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\_isres.dll
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\_isuser.dll
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\string1033.txt
%TEMP%\msib96f.tmp
%TEMP%\msibc3d.tmp
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\license.txt
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\bigfixlogo.bmp
%TEMP%\msid135.tmp
%TEMP%\msid184.tmp
%TEMP%\d548.rra
%WINDIR%\syswow64\config\systemprofile\searches\desktop.ini
%TEMP%\pft8e8a.tmp\isscript11.msi
%WINDIR%\syswow64\config\systemprofile\music\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\~usic.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\burn\burn\desktop.ini
%WINDIR%\syswow64\config\systemprofile\videos\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows sidebar\gadgets\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\videos.library-ms
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\~ideos.tmp
%WINDIR%\syswow64\config\systemprofile\pictures\desktop.ini
%WINDIR%\syswow64\config\systemprofile\desktop\desktop.ini
%WINDIR%\syswow64\config\systemprofile\contacts\desktop.ini
%WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\isrt.dll
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\isconfig.ini
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\setup.inx
%CommonProgramFiles(x86)%\installshield\driver\11\intel 32\idriver2.exe
%CommonProgramFiles(x86)%\installshield\driver\11\intel 32\isbew64.exe
%TEMP%\pft8e8a.tmp\pftw1.pkg
%TEMP%\pft8e8a.tmp\0x0409.ini
%TEMP%\pft8e8a.tmp\0x0411.ini
%TEMP%\pft8e8a.tmp\0x0412.ini
%TEMP%\pft8e8a.tmp\0x0804.ini
%TEMP%\pft8e8a.tmp\1033.mst
%TEMP%\pft8e8a.tmp\1041.mst
%TEMP%\pft8e8a.tmp\1042.mst
%TEMP%\pft8e8a.tmp\2052.mst
%TEMP%\pft8e8a.tmp\bigfix enterprise console.msi
%TEMP%\pft8e8a.tmp\data1.cab
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\music.library-ms
%TEMP%\pft8e8a.tmp\instmsiw.exe
%TEMP%\pft8e8a.tmp\setup.ini
%WINDIR%\installer\c9c3f.mst
%CommonProgramFiles(x86)%\installshield\driver\11\intel 32\idrivert.exe
%CommonProgramFiles(x86)%\installshield\driver\11\intel 32\isrt.dll
%CommonProgramFiles(x86)%\installshield\driver\11\intel 32\_isres1033.dll
%CommonProgramFiles(x86)%\installshield\driver\11\intel 32\idriver.exe
%CommonProgramFiles(x86)%\installshield\driver\11\intel 32\igdicnv.dll
%CommonProgramFiles(x86)%\installshield\driver\11\intel 32\iusercnv.dll
%CommonProgramFiles(x86)%\installshield\driver\11\intel 32\iscrcnv.dll
%CommonProgramFiles(x86)%\installshield\driver\11\intel 32\objpscnv.dll
%CommonProgramFiles(x86)%\installshield\driver\11\intel 32\isbew64.tlb
%TEMP%\plf8d41.tmp
%TEMP%\pft8e8a.tmp\setup.exe
%ProgramFiles(x86)%\bigfix enterprise\bes console\beshelp.chm
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\icon2.ico
%WINDIR%\syswow64\config\systemprofile\documents\desktop.ini
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\bodybg.jpg
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\bodybgnav.jpg
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\bodyheaderbg.jpg
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\bullet.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\close.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\cn.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\collapse.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\common.css
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\common.js
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\commonblue.css
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\commonbluenav.css
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\commonwhite.css
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\defaultaction.bes
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\defaultanalysis.bes
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\defaultbaseline.bes
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\defaultcomputergroup.bes
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\defaultfixlet.bes
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\defaulttask.bes
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\enterprise.ico
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\expand.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\filterexample.ojo
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\fixlet.css
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\hist_24.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\besactiontarget.xsd
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\besojo.xsd
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\besactionsettings.xsd
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\bes.xsd
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\baselineremove.gif
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\~ocuments.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\recent\desktop.ini
%WINDIR%\syswow64\config\systemprofile\pictures\slide shows\desktop.ini
%WINDIR%\syswow64\config\systemprofile\downloads\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\pictures.library-ms
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\~ictures.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini
%WINDIR%\syswow64\config\systemprofile\music\playlists\desktop.ini
%WINDIR%\syswow64\config\systemprofile\links\desktop.ini
%WINDIR%\syswow64\config\systemprofile\saved games\desktop.ini
%WINDIR%\installer\c9c45.mst
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\desktop.ini
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\makeindent.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\besconsole.exe
%ProgramFiles(x86)%\bigfix enterprise\bes console\h3lib.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\beslib\engine.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\beslib\inspectors\bessessioninspect.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\beslib\inspectors\core.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\beslib\inspectors\regexp.dll
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\about.css
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\aboutbodybg.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\aboutheaderbg.gif
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\analysis.css
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\analysis.js
%ProgramFiles(x86)%\bigfix enterprise\bes console\reference\applicationusage.htm
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\documents.library-ms
%ProgramFiles(x86)%\bigfix enterprise\bes console\dbghelp.dll
%TEMP%\pft8e8a.tmp\setup.log

Удаляет следующие файлы

%TEMP%\ext8d42.tmp
%TEMP%\ixp000.tmp\dasetupr.dll
%TEMP%\ixp000.tmp\odbcconf.exe
%TEMP%\ixp000.tmp\odbcconf.dll
%TEMP%\ixp000.tmp\mdaceula.rtf
%TEMP%\ixp000.tmp\redist.rsp
%TEMP%\ixp000.tmp\mdaccore.rsp
%TEMP%\ixp000.tmp\sqlclnt.rsp
%TEMP%\ixp000.tmp\rspfiles.inf
%TEMP%\ixp000.tmp\msxmlx.cab
%TEMP%\ixp000.tmp\msxml.inf
%TEMP%\ixp000.tmp\sqlxmlxp.cab
%TEMP%\ixp000.tmp\mdacxpak.inf
%TEMP%\ixp000.tmp\sqlxmlx.inf
%TEMP%\ixp000.tmp\wdsetup.inf
%TEMP%\ixp000.tmp\wdsetup.cat
%TEMP%\ixp000.tmp\sqloldb.cab
%TEMP%\ixp000.tmp\sqloldb.inf
%TEMP%\ixp000.tmp\sqloldb.cat
%TEMP%\ixp000.tmp\sqlodbc.cab
%TEMP%\ixp000.tmp\sqlodbc.inf
%TEMP%\ixp000.tmp\sqlodbc.cat
%TEMP%\ixp000.tmp\sqlnet.cab
%TEMP%\ixp000.tmp\sqlnet.inf
%TEMP%\ixp000.tmp\sqlnet.cat
%TEMP%\ixp000.tmp\wdsetup.cab
%TEMP%\ixp000.tmp\mdacxpak.cab
%TEMP%\ixp000.tmp\dasetup.ini
%TEMP%\pft8e8a.tmp\0x0409.ini
%TEMP%\pft8e8a.tmp\setup.exe
%TEMP%\pft8e8a.tmp\isscript11.msi
%TEMP%\pft8e8a.tmp\instmsiw.exe
%TEMP%\pft8e8a.tmp\data1.cab
%TEMP%\pft8e8a.tmp\bigfix enterprise console.msi
%TEMP%\pft8e8a.tmp\2052.mst
%TEMP%\pft8e8a.tmp\1042.mst
%TEMP%\pft8e8a.tmp\1041.mst
%TEMP%\pft8e8a.tmp\1033.mst
%TEMP%\pft8e8a.tmp\0x0804.ini
%TEMP%\pft8e8a.tmp\0x0412.ini
%WINDIR%\installer\c9c45.mst
%TEMP%\ixp000.tmp\dasetup.exe
%TEMP%\plf8d41.tmp
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\_isuser.dll
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\_isres.dll
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\string1033.txt
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\setup.inx
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\msxml6_x86.msi
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\msxml6_x64.msi
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\license.txt
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\isrt.dll
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\isconfig.ini
%TEMP%\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\bigfixlogo.bmp
%TEMP%\pft8e8a.tmp\0x0411.ini
%TEMP%\ixp000.tmp\mdacxpak.cat
%TEMP%\ixp000.tmp\dasetup.inf
%TEMP%\ixp000.tmp\noop.inf
%TEMP%\ixp000.tmp\mdacxpdl.inf
%TEMP%\ixp000.tmp\mdacxpkm.cat
%TEMP%\ixp000.tmp\w95inf16.dll
%TEMP%\ixp000.tmp\w95inf32.dll
%TEMP%\ixp000.tmp\msdamg9x.dll
%TEMP%\ixp000.tmp\setupapi.cab
%TEMP%\ixp000.tmp\dasetupd.inf
%TEMP%\ixp000.tmp\rspfiled.inf
%TEMP%\ixp000.tmp\setupapi.inf
%TEMP%\ixp000.tmp\mtxfiles.cab
%TEMP%\ixp000.tmp\sqlnetm.cat
%TEMP%\ixp000.tmp\mtxfiles.inf
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\pictures.library-ms~rfce040.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\documents.library-ms~rfcdf95.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\videos.library-ms~rfcde4d.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows sidebar\gadgets\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\music.library-ms~rfcddc1.tmp
%TEMP%\msid184.tmp
%TEMP%\msid135.tmp
%TEMP%\msibc3d.tmp
%TEMP%\msib96f.tmp
%WINDIR%\installer\c9c3f.mst
%TEMP%\pft8e8a.tmp\pftw1.pkg
%TEMP%\ixp000.tmp\msvcrt.cab
%TEMP%\ixp000.tmp\sqlnetdl.inf
%TEMP%\ixp000.tmp\mdacxpkm.inf
%TEMP%\ixp000.tmp\sqlnetm.inf
%TEMP%\ixp000.tmp\msxmlx.cat
%TEMP%\ixp000.tmp\setup.exe
%TEMP%\ixp000.tmp\msxmlx.inf
%TEMP%\ixp000.tmp\sqlxmlxp.inf
%TEMP%\ixp000.tmp\sqlxmlxp.cat
%TEMP%\ixp000.tmp\dasetup.cat
%TEMP%\ixp000.tmp\rspfiles.cat
%TEMP%\ixp000.tmp\dasetup.cab
%TEMP%\ixp000.tmp\rspfiles.cab
%TEMP%\ixp000.tmp\msvcrt.inf
%TEMP%\ixp000.tmp\jetfiles.cab
%TEMP%\ixp000.tmp\jetfiles.inf
%TEMP%\ixp000.tmp\advpack.dll
%TEMP%\ixp000.tmp\cabinet.dll
%TEMP%\ixp000.tmp\sqlodbcm.cat
%TEMP%\ixp000.tmp\newmui.inf
%TEMP%\ixp000.tmp\muisetup.exe
%TEMP%\ixp000.tmp\psapi.dll
%TEMP%\ixp000.tmp\wdsetupm.inf
%TEMP%\ixp000.tmp\wdset_dl.inf
%TEMP%\ixp000.tmp\wdsetupm.cat
%TEMP%\ixp000.tmp\sqloldbm.inf
%TEMP%\ixp000.tmp\sqlol_dl.inf
%TEMP%\ixp000.tmp\sqloldbm.cat
%TEMP%\ixp000.tmp\sqlodbcm.inf
%TEMP%\ixp000.tmp\sqlod_dl.inf
%TEMP%\pft8e8a.tmp\setup.ini
%TEMP%\pft8e8a.tmp\setup.log

Перемещает следующие файлы

%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\music.library-ms в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\music.library-ms~rfcddc1.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\videos.library-ms в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\videos.library-ms~rfcde4d.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\documents.library-ms в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\documents.library-ms~rfcdf95.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\pictures.library-ms в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\pictures.library-ms~rfce040.tmp
%ProgramFiles(x86)%\installshield installation information\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\setu24ed.rra в %ProgramFiles(x86)%\installshield installation information\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\setup.inx
%TEMP%\d548.rra в %ProgramFiles(x86)%\installshield installation information\{eb98b9bf-86d4-48cf-9b54-b46a4a9fc695}\setup.ilg

Подменяет следующие файлы

%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\music.library-ms
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows sidebar\gadgets\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\videos.library-ms
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\documents.library-ms
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\libraries\pictures.library-ms

Сетевая активность

Подключается к

'cr#.#hawte.com':80
'oc##.thawte.com':80

TCP

Запросы HTTP GET

http://cr#.#hawte.com/ThawtePremiumServerCA.crl
http://oc##.thawte.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSDXMN22sHhCJ%2BQ8WDKToovi3RuCgQUxe2TXys4R35Y01fH%2F0XFREHhX78CAz7%2FJA%3D%3D
http://cr#.#hawte.com/ThawteCodeSigningCA.crl

UDP

DNS ASK cr#.#hawte.com
DNS ASK oc##.thawte.com

Другое

Создает и запускает на исполнение

'%TEMP%\pft8e8a.tmp\setup.exe' /v"REBOOT=R" /S
'%CommonProgramFiles(x86)%\installshield\driver\11\intel 32\idrivert.exe'
'%WINDIR%\installer\msi8d3.tmp' /q:a /c:"setup /qn1"
'%TEMP%\ixp000.tmp\setup.exe' /qn1
'%TEMP%\ixp000.tmp\dasetup.exe' /Q /N
'%TEMP%\pft8e8a.tmp\setup.exe' /v"REBOOT=R" /S' (со скрытым окном)
'%WINDIR%\syswow64\msiexec.exe' /i %TEMP%\{EB98B9BF-86D4-48CF-9B54-B46A4A9FC695}\msxml6_x64.msi /qn /norestart' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i %TEMP%\{EB98B9BF-86D4-48CF-9B54-B46A4A9FC695}\msxml6_x64.msi /qn /norestart

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней