Trojan.Siggen22.60651

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\setf3d0.tmp
%WINDIR%\installer\{370c1839-b7d8-425e-8d3f-c79638e7d09c}\arpproducticon.exe
%CommonProgramFiles(x86)%\nokia\fuse\drivers\winusb\nokiacareconnectivity.cat
%CommonProgramFiles(x86)%\nokia\fuse\drivers\nokia.cer
%CommonProgramFiles(x86)%\nokia\fuse\drivers\winusb\amd64\winusbcoinstaller2.dll
%CommonProgramFiles(x86)%\nokia\fuse\drivers\winusb\amd64\wdfcoinstaller01009.dll
%CommonProgramFiles(x86)%\nokia\fuse\drivers\winusb\nokiacareconnectivity.inf
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftbusui.dll
%TEMP%\_ir_sf_temp_0\dpinst64.exe
%TEMP%\_ir_sf_temp_0\dpinst.exe
%TEMP%\_ir_sf_temp_0\winusb\winusb_drivers_x86.msi
%TEMP%\_ir_sf_temp_0\winusb\winusb_drivers_x64.msi
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x86\wudfusbcciddriver.inf
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x86\wudfusbcciddriver.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x86\wudfusbcciddriver.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x86\wudfupdate_01007.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x86\winusbcoinstaller.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x86\wdfcoinstaller01007.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x64\wudfusbcciddriver.inf
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x64\wudfusbcciddriver.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x64\wudfusbcciddriver.cat
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\setf46d.tmp
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\setf672.tmp
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set6ab9.tmp
<DRIVERSTORE>\filerepository\nokiacareconnectivity.inf_amd64_neutral_b90cf77d98215f84\nokiacareconnectivity.pnf
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set69ed.tmp
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set6950.tmp
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set68a3.tmp
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set67d7.tmp
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set670c.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\set442c.tmp
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\set437f.tmp
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\set4294.tmp
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\set41e8.tmp
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\set414b.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\i386\set22e1.tmp
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\set2235.tmp
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\set21a7.tmp
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set208d.tmp
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set1fd1.tmp
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set1f25.tmp
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set1e88.tmp
%WINDIR%\dpinst.log
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x64\wudfupdate_01007.dll
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\setf5c5.tmp
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x64\winusbcoinstaller.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdibus.inf
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftd2xx.h
%TEMP%\_ir_sf_temp_0\ftdi-driver\static\i386\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\ftdi-driver\static\amd64\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftserui2.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftser2k.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftlang.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftdibus.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftd2xx.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftcserco.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftbusui.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftserui2.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftser2k.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftlang.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftdibus.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftd2xx64.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftcserco.dll
%TEMP%\_ir_sf_temp_0\chimera.ico
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\lua5.1.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdibus.cat
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdiport.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\raakcrdmx.inf
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdiport.inf
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\raakcrdmx.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\raakcrdmx.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\raakcrdm.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\win10\raakcrdmx.inf
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\win10\raakcrdmx.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\win10\raakcrdmx.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\win10\raakcrdm.dll
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\usbccid.sys
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\usbccid.inf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\usbccid.cat
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\x86\gemccid.sys
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\x86\gemccid.pnf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\x86\gemccid.inf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\x86\cm_x86.cat
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\usbccid.sys
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\usbccid.inf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\usbccid.cat
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\gemccid.sys
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\gemccid.pnf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\gemccid.inf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\cm_x86.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x64\wdfcoinstaller01007.dll
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem5.cat

Присваивает атрибут 'скрытый' для следующих файлов

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem5.cat

Удаляет следующие файлы

%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftserui2.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftd2xx.h
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdibus.cat
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdibus.inf
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdiport.cat
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdiport.inf
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftbusui.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftcserco.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftd2xx.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftdibus.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftlang.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftser2k.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftlang.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\static\amd64\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\ftdi-driver\static\i386\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\usbccid.cat
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\usbccid.inf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\usbccid.sys
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\cm_x86.cat
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\gemccid.inf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\gemccid.pnf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\gemccid.sys
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\raakcrdm.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftser2k.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftserui2.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftdibus.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftd2xx64.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftd2xx.lib
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\winusbcoinstaller2.dll
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\nokiacareconnectivity.cat
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\nokiacareconnectivity.inf
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftbusui.dll
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftd2xx64.dll
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftdibus.sys
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftlang.dll
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\ftdibus.cat
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\ftdibus.inf
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\i386\ftd2xx.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\ftcserco.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\ftser2k.sys
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\wdfcoinstaller01009.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\ftserui2.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\ftdiport.inf
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wdfcoinstaller01007.dll
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\winusbcoinstaller.dll
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfupdate_01007.dll
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfusbcciddriver.cat
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfusbcciddriver.dll
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfusbcciddriver.inf
%TEMP%\_ir_sf_temp_0\chimera.ico
%TEMP%\_ir_sf_temp_0\dpinst.exe
%TEMP%\_ir_sf_temp_0\dpinst64.exe
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftbusui.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftcserco.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\ftdiport.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\win10\raakcrdm.dll
%TEMP%\_ir_sf_temp_0\lua5.1.dll

Перемещает следующие файлы

%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\setf3d0.tmp в %TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\nokiacareconnectivity.cat
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set6950.tmp в %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfusbcciddriver.inf
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set68a3.tmp в %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfusbcciddriver.dll
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set67d7.tmp в %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfusbcciddriver.cat
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set670c.tmp в %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wdfcoinstaller01007.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\set442c.tmp в %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\ftdiport.inf
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\set437f.tmp в %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\ftdiport.cat
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\set4294.tmp в %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\ftcserco.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\set41e8.tmp в %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\ftserui2.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\set414b.tmp в %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\ftser2k.sys
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\i386\set22e1.tmp в %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\i386\ftd2xx.dll
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\set2235.tmp в %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\ftdibus.inf
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\set21a7.tmp в %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\ftdibus.cat
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set208d.tmp в %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftdibus.sys
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set1fd1.tmp в %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftbusui.dll
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set1f25.tmp в %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftd2xx64.dll
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set1e88.tmp в %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftlang.dll
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\setf672.tmp в %TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\winusbcoinstaller2.dll
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\setf5c5.tmp в %TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\wdfcoinstaller01009.dll
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\setf46d.tmp в %TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\nokiacareconnectivity.inf
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set69ed.tmp в %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\winusbcoinstaller.dll
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set6ab9.tmp в %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfupdate_01007.dll

Другое

Создает и запускает на исполнение

'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1817634 "__IRAFN:<Полный путь к файлу>" "__IRCT:2" "__IRTSS:0" "__IRSID:S-1-5-21-3150914307-1777937420-491476919-1000"
'%WINDIR%\installer\msicee6.tmp' -add "%CommonProgramFiles(x86)%\Nokia\Fuse\drivers\nokia.cer" -c -s -r localMachine TrustedPublisher
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\FTDI-Driver" /SW /F /SA /SE /LM
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\SmartCard\SC_Reader_X64" /SW /F /SA /SE /LM
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\SmartCard\SC_Card" /SW /F /SA /SE /LM
'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\_ir_sf_temp_0\winusb\WinUSB_Drivers_x64.msi" /quiet /qn' (со скрытым окном)
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\FTDI-Driver" /SW /F /SA /SE /LM' (со скрытым окном)
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\SmartCard\SC_Reader_X64" /SW /F /SA /SE /LM' (со скрытым окном)
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\SmartCard\SC_Card" /SW /F /SA /SE /LM' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /D /A /C RMDIR %TEMP%\_ir_sf_temp_0 /S /Q' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\_ir_sf_temp_0\winusb\WinUSB_Drivers_x64.msi" /quiet /qn
'%WINDIR%\syswow64\cmd.exe' /D /A /C RMDIR %TEMP%\_ir_sf_temp_0 /S /Q

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней