Trojan.Siggen23.40731

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\MIME post encoding 71] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\MIME post encoding 71] 'ImagePath' = '%ALLUSERSPROFILE%\MIME post encoding 71\MIME post encoding 71.exe'

Создает следующие сервисы

'MIME post encoding 71' %ALLUSERSPROFILE%\MIME post encoding 71\MIME post encoding 71.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-e1145.tmp\is-kifme.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-gb5qr.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-sp35e.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-1apvl.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-ld8su.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-7dbii.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-krpev.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\lessmsi\is-e29ea.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-9jm16.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-ttcer.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-j2pvd.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-oqofd.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\plugins\internal\is-d7vhn.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\plugins\internal\is-efjof.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-skl2f.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-jogtn.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-biek8.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-sb7c5.tmp
%LOCALAPPDATA%\pci device checker\stuff\is-ga07t.tmp
%LOCALAPPDATA%\pci device checker\stuff\is-pum7v.tmp
%LOCALAPPDATA%\pci device checker\stuff\is-a9cih.tmp
%LOCALAPPDATA%\pci device checker\stuff\is-j1dql.tmp
%LOCALAPPDATA%\pci device checker\is-b1k3g.tmp
%LOCALAPPDATA%\pci device checker\unins000.dat
%LOCALAPPDATA%\pci device checker\bin\x86\is-s9136.tmp
%LOCALAPPDATA%\pci device checker\pcidevicechecker.exe
%LOCALAPPDATA%\pci device checker\bin\x86\is-6o3sm.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-pj4iv.tmp
%TEMP%\is-avqri.tmp\_isetup\_setup64.tmp
%TEMP%\is-avqri.tmp\_isetup\_shfoldr.dll
%TEMP%\is-avqri.tmp\_iscrypt.dll
%LOCALAPPDATA%\pci device checker\is-a4oqo.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-74t2v.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-sv298.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-36jqv.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-du9eo.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-ahipt.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-5irqu.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-0ekec.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-6qgmq.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-3ac57.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-nc42i.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-fecvi.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-abo3m.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-3jgom.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-4bp2t.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-n5bs8.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-jkvq6.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-3opc2.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-isein.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-dnbm7.tmp
%LOCALAPPDATA%\pci device checker\bin\x86\is-nrdr2.tmp
%ALLUSERSPROFILE%\mime post encoding 71\mime post encoding 71.exe

Удаляет следующие файлы

%LOCALAPPDATA%\pci device checker\stuff\date.txt
%LOCALAPPDATA%\pci device checker\stuff\tagsreplace.txt

Перемещает следующие файлы

%LOCALAPPDATA%\pci device checker\is-a4oqo.tmp в %LOCALAPPDATA%\pci device checker\unins000.exe
%LOCALAPPDATA%\pci device checker\bin\x86\is-sp35e.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\da.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-1apvl.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\daiso.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-ld8su.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\dstt.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-7dbii.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\dsd2pcmt.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-krpev.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\pcm2dsd.exe
%LOCALAPPDATA%\pci device checker\bin\x86\lessmsi\is-e29ea.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\lessmsi\lessmsi-v1.6.91.zip
%LOCALAPPDATA%\pci device checker\bin\x86\is-9jm16.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\d_writer.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-s9136.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\dsd2.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-gb5qr.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\lame_enc.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-ttcer.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\libwebp.dll
%LOCALAPPDATA%\pci device checker\bin\x86\plugins\internal\is-d7vhn.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\plugins\internal\peak_scanner_plugin_c.dll
%LOCALAPPDATA%\pci device checker\bin\x86\plugins\internal\is-efjof.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\plugins\internal\raw_decode_plugin_c.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-skl2f.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\copying
%LOCALAPPDATA%\pci device checker\bin\x86\is-jogtn.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\7z.exe
%LOCALAPPDATA%\pci device checker\bin\x86\is-biek8.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\takdec.exe
%LOCALAPPDATA%\pci device checker\bin\x86\is-sb7c5.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\tak_deco_lib.dll
%LOCALAPPDATA%\pci device checker\stuff\is-ga07t.tmp в %LOCALAPPDATA%\pci device checker\stuff\date.txt
%LOCALAPPDATA%\pci device checker\bin\x86\is-j2pvd.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\libwinpthread-1.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-oqofd.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\sd.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-6o3sm.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\libdtsdec.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-nrdr2.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\utils.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-pj4iv.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\uchardet.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-sv298.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\bassflac.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-36jqv.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\bassmix.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-du9eo.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\bassopus.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-ahipt.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\basswma.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-5irqu.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\basswv.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-0ekec.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\bass_fx.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-6qgmq.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\bassmidi.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-3ac57.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\bass_tta.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-74t2v.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\basscd.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-nc42i.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\copying.lgplv2.1
%LOCALAPPDATA%\pci device checker\bin\x86\is-abo3m.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\gain_analysis.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-3jgom.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\libflac_dynamic.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-4bp2t.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\bass_ofr.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-n5bs8.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\optimfrog.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-jkvq6.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\mp3gain.exe
%LOCALAPPDATA%\pci device checker\bin\x86\is-3opc2.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\rg_ebur128.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-isein.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\wavpackdll.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-dnbm7.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\libsoxr.dll
%LOCALAPPDATA%\pci device checker\bin\x86\is-fecvi.tmp в %LOCALAPPDATA%\pci device checker\bin\x86\ff_helper.dll
%LOCALAPPDATA%\pci device checker\stuff\is-pum7v.tmp в %LOCALAPPDATA%\pci device checker\stuff\tagsreplace.txt
%LOCALAPPDATA%\pci device checker\is-b1k3g.tmp в %LOCALAPPDATA%\pci device checker\pcidevicechecker.exe

Подменяет следующие файлы

%LOCALAPPDATA%\pci device checker\stuff\date.txt
%LOCALAPPDATA%\pci device checker\stuff\tagsreplace.txt

Другое

Ищет следующие окна

ClassName: '' WindowName: 'jc73c9_PCIDC1113FlashFixClass_jc73c9'

Создает и запускает на исполнение

'%TEMP%\is-e1145.tmp\is-kifme.tmp' /SL4 $B024C "<Полный путь к файлу>" 3869455 52224
'%LOCALAPPDATA%\pci device checker\pcidevicechecker.exe' -i
'%LOCALAPPDATA%\pci device checker\pcidevicechecker.exe' -s

Запускает на исполнение

'%WINDIR%\syswow64\net.exe' helpmsg 1113
'%WINDIR%\syswow64\net1.exe' helpmsg 1113

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней