Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\rhpstartupdownloader
Вредоносные функции
Изменяет следующие настройки браузера Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1001' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2700' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2600' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2402' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2401' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2400' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2301' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2300' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2201' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2200' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2106' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2105' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2104' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2103' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2102' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2101' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2001' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2004' = '00000000'
- [HKCU\Wow6432Node\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2107' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2108' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2704' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '270D' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '270C' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '160B' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '270B' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2302' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '140A' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2703' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2702' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2701' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1812' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2709' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2708' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2100' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2007' = '00002710'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2005' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1601' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1408' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1407' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1405' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1402' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1400' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120B' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120A' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1209' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1208' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1207' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1206' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1201' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1200' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1004' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1409' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1604' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1C00' = '00007530'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1605' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A06' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A05' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A04' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A03' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A02' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A00' = '00010000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1809' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1804' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1803' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1802' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '160A' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1608' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1607' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1606' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2000' = '00000000'
- [HKCU\Wow6432Node\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1409' = '00000003'
Изменения в файловой системе
Создает следующие файлы
- %HOMEPATH%\documents\latest.exe
- %TEMP%\rarsfx1\lang\ru-ru\setupdownloader.dict
- %TEMP%\rarsfx1\lang\ro-ro\setupdownloader.dict
- %TEMP%\rarsfx1\lang\pt-br\setupdownloader.dict
- %TEMP%\rarsfx1\lang\pl-pl\setupdownloader.dict
- %TEMP%\rarsfx1\lang\nl-nl\setupdownloader.dict
- %TEMP%\rarsfx1\lang\ko-kr\setupdownloader.dict
- %TEMP%\rarsfx1\lang\ja-jp\setupdownloader.dict
- %TEMP%\rarsfx1\lang\it-it\setupdownloader.dict
- %TEMP%\rarsfx1\lang\fr-fr\setupdownloader.dict
- %TEMP%\rarsfx1\lang\es-es\setupdownloader.dict
- %TEMP%\rarsfx1\lang\en-us\setupdownloader.dict
- %TEMP%\rarsfx1\lang\tr-tr\setupdownloader.dict
- %TEMP%\rarsfx1\lang\de-de\setupdownloader.dict
- %TEMP%\rarsfx1\kit.cat
- %TEMP%\bdtempdir01\x64\bdch.dll
- %TEMP%\bdtempdir01\x64\kit.cat
- %TEMP%\rarsfx0\tmp.txt
- %TEMP%\bdtempdir01\data.xml
- %TEMP%\bdtempdir01\kit.cat
- %TEMP%\bdtempdir01\latest.dat
- C:\rhpsupport\tools\wi-fi-rhpwifi.xml
- C:\rhpsupport\hosts.txt
- %TEMP%\bdtempdir01\installer.xml
- %ALLUSERSPROFILE%\bdkitinstaller\[7.8.3.261].{297a31b5-602b-4d5b-0750-91cf51007ea2}.setupdownloader.0.bin
- %TEMP%\rarsfx1\lang\cs-cz\setupdownloader.dict
- %TEMP%\rarsfx1\skin\img\status-green.svg
- %TEMP%\rarsfx1\bdnc.client_id
- %TEMP%\rarsfx1\lang\zh-tw\setupdownloader.dict
- %TEMP%\rarsfx1\skin\img\logo-setupdownloader.svg
- %TEMP%\rarsfx1\languagemanager.dll
- %TEMP%\rarsfx1\wslib.dll
- %TEMP%\rarsfx1\skin\styles\style.css
- %TEMP%\rarsfx1\skin\setup_downloader.html
- %TEMP%\rarsfx1\skin\scripts\popup.tis
- %TEMP%\rarsfx1\skin\scripts\movable.tis
- %TEMP%\rarsfx1\skin\scripts\dict.tis
- %TEMP%\rarsfx1\skin\popup.html
- %TEMP%\rarsfx1\skin\img\status-red.svg
- %TEMP%\rarsfx1\skin\img\status-question.svg
- %ALLUSERSPROFILE%\bdkitinstaller\[7.8.3.261].{297a31b5-602b-4d5b-0750-91cf51007ea2}.setupdownloader.988.bin
- %TEMP%\rarsfx1\skin\img\status-info.svg
- %TEMP%\rarsfx1\skin\img\progress-bg.png
- %TEMP%\rarsfx1\skin\img\minimize-installer.svg
- %TEMP%\rarsfx1\skin\img\close.svg
- %TEMP%\rarsfx1\skin\img\close-installer.svg
- %TEMP%\rarsfx1\skin\fonts\montserrat-regular.ttf
- %TEMP%\rarsfx1\skin\fonts\montserrat-medium.ttf
- %TEMP%\rarsfx1\skin\fonts\montserrat-light.ttf
- %TEMP%\rarsfx1\skin\fonts\montserrat-bold.ttf
- %TEMP%\rarsfx1\skin\bdicon.ico
- %TEMP%\rarsfx1\setupdownloader.exe
- %TEMP%\rarsfx1\sciter.dll
- %TEMP%\rarsfx1\lang\vi-vn\setupdownloader.dict
- %TEMP%\rarsfx1\lang\zh-cn\setupdownloader.dict
- %TEMP%\rarsfx0\setupdownloader.xml
- %TEMP%\rarsfx0\lang\vi-vn\setupdownloader.dict
- %TEMP%\rarsfx0\lang\ro-ro\setupdownloader.dict
- %TEMP%\rarsfx0\lang\pt-br\setupdownloader.dict
- %TEMP%\rarsfx0\lang\pl-pl\setupdownloader.dict
- %TEMP%\rarsfx0\lang\nl-nl\setupdownloader.dict
- %TEMP%\rarsfx0\lang\ko-kr\setupdownloader.dict
- %TEMP%\rarsfx0\lang\ja-jp\setupdownloader.dict
- %TEMP%\rarsfx0\lang\it-it\setupdownloader.dict
- %TEMP%\rarsfx0\lang\fr-fr\setupdownloader.dict
- %TEMP%\rarsfx0\lang\es-es\setupdownloader.dict
- %TEMP%\rarsfx0\lang\en-us\setupdownloader.dict
- %TEMP%\rarsfx0\lang\de-de\setupdownloader.dict
- %TEMP%\rarsfx0\lang\ru-ru\setupdownloader.dict
- %TEMP%\rarsfx0\lang\cs-cz\setupdownloader.dict
- C:\rhpsupport\latest.exe
- nul
- C:\rhpsupport\tools\best_downloaderwrapper.msi
- C:\rhpsupport\startup-downloader.exe
- C:\rhpsupport\tools\nircmd.exe
- C:\rhpsupport\tools\nircmd-32.exe
- C:\rhpsupport\tools\nircmd-64.exe
- %HOMEPATH%\documents\rhp-fall-2018-update.exe
- %HOMEPATH%\documents\wide.bmp
- %HOMEPATH%\desktop\snipping tool.lnk
- %HOMEPATH%\desktop\rhp intranet.lnk
- %TEMP%\rarsfx0\kit.cat
- %TEMP%\rarsfx0\skin\img\progress-bg.png
- %TEMP%\rarsfx0\skin\img\logo-setupdownloader.svg
- %TEMP%\rarsfx0\lang\zh-cn\setupdownloader.dict
- %TEMP%\rarsfx0\languagemanager.dll
- %TEMP%\rarsfx0\wslib.dll
- %TEMP%\rarsfx0\skin\styles\style.css
- %TEMP%\rarsfx0\skin\setup_downloader.html
- %TEMP%\rarsfx0\skin\scripts\popup.tis
- %TEMP%\rarsfx0\skin\scripts\movable.tis
- %TEMP%\rarsfx0\skin\scripts\dict.tis
- %TEMP%\rarsfx0\skin\popup.html
- %TEMP%\rarsfx0\skin\img\status-red.svg
- %TEMP%\rarsfx0\skin\img\status-question.svg
- %TEMP%\rarsfx0\skin\img\status-info.svg
- %TEMP%\rarsfx0\bdnc.client_id
- %TEMP%\rarsfx0\skin\img\status-green.svg
- %TEMP%\rarsfx0\skin\img\minimize-installer.svg
- %TEMP%\rarsfx0\skin\img\close.svg
- %TEMP%\rarsfx0\skin\img\close-installer.svg
- %TEMP%\rarsfx0\skin\fonts\montserrat-regular.ttf
- %TEMP%\rarsfx0\skin\fonts\montserrat-medium.ttf
- %TEMP%\rarsfx0\skin\fonts\montserrat-light.ttf
- %TEMP%\rarsfx0\skin\fonts\montserrat-bold.ttf
- %TEMP%\rarsfx0\skin\bdicon.ico
- %TEMP%\rarsfx0\setupdownloader.exe
- %TEMP%\rarsfx0\sciter.dll
- %TEMP%\rarsfx0\lang\zh-tw\setupdownloader.dict
- %TEMP%\rarsfx0\lang\tr-tr\setupdownloader.dict
- %TEMP%\rarsfx1\setupdownloader.xml
Удаляет следующие файлы
- %HOMEPATH%\documents\latest.exe
- %TEMP%\rarsfx1\lang\pt-br\setupdownloader.dict
- %TEMP%\rarsfx1\lang\pl-pl\setupdownloader.dict
- %TEMP%\rarsfx1\lang\nl-nl\setupdownloader.dict
- %TEMP%\rarsfx1\lang\ko-kr\setupdownloader.dict
- %TEMP%\rarsfx1\lang\ja-jp\setupdownloader.dict
- %TEMP%\rarsfx1\lang\it-it\setupdownloader.dict
- %TEMP%\rarsfx1\lang\fr-fr\setupdownloader.dict
- %TEMP%\rarsfx1\lang\es-es\setupdownloader.dict
- %TEMP%\rarsfx1\lang\en-us\setupdownloader.dict
- %TEMP%\rarsfx1\lang\de-de\setupdownloader.dict
- %TEMP%\rarsfx1\lang\cs-cz\setupdownloader.dict
- %TEMP%\rarsfx1\wslib.dll
- %TEMP%\rarsfx1\setupdownloader.xml
- %TEMP%\rarsfx1\setupdownloader.exe
- %TEMP%\rarsfx1\sciter.dll
- %TEMP%\rarsfx1\languagemanager.dll
- %TEMP%\rarsfx1\kit.cat
- %TEMP%\rarsfx1\bdnc.client_id
- %TEMP%\rarsfx0\skin\styles\style.css
- %TEMP%\rarsfx0\skin\scripts\popup.tis
- %TEMP%\rarsfx0\skin\scripts\movable.tis
- %TEMP%\rarsfx0\skin\img\status-red.svg
- %TEMP%\rarsfx0\skin\scripts\dict.tis
- %TEMP%\rarsfx1\lang\ro-ro\setupdownloader.dict
- %TEMP%\rarsfx1\lang\ru-ru\setupdownloader.dict
- %TEMP%\rarsfx1\skin\scripts\movable.tis
- %TEMP%\rarsfx1\skin\scripts\dict.tis
- %TEMP%\rarsfx1\skin\img\status-red.svg
- %TEMP%\rarsfx1\skin\img\status-question.svg
- %TEMP%\rarsfx1\skin\img\status-info.svg
- %TEMP%\rarsfx1\skin\img\status-green.svg
- %TEMP%\rarsfx1\skin\img\progress-bg.png
- %TEMP%\rarsfx1\skin\img\minimize-installer.svg
- %TEMP%\rarsfx1\skin\img\logo-setupdownloader.svg
- %TEMP%\rarsfx1\skin\img\close.svg
- %TEMP%\rarsfx1\skin\fonts\montserrat-regular.ttf
- %TEMP%\rarsfx0\skin\bdicon.ico
- %TEMP%\rarsfx1\skin\fonts\montserrat-medium.ttf
- %TEMP%\rarsfx1\skin\fonts\montserrat-light.ttf
- %TEMP%\rarsfx1\skin\fonts\montserrat-bold.ttf
- %TEMP%\rarsfx1\skin\setup_downloader.html
- %TEMP%\rarsfx1\skin\popup.html
- %TEMP%\rarsfx1\skin\bdicon.ico
- %TEMP%\rarsfx1\lang\zh-tw\setupdownloader.dict
- %TEMP%\rarsfx1\lang\zh-cn\setupdownloader.dict
- %TEMP%\rarsfx1\lang\vi-vn\setupdownloader.dict
- %TEMP%\rarsfx1\lang\tr-tr\setupdownloader.dict
- %TEMP%\rarsfx0\skin\img\status-question.svg
- %TEMP%\rarsfx0\skin\img\status-info.svg
- %TEMP%\rarsfx0\skin\img\status-green.svg
- %TEMP%\rarsfx0\lang\de-de\setupdownloader.dict
- %TEMP%\rarsfx0\lang\cs-cz\setupdownloader.dict
- %TEMP%\rarsfx0\wslib.dll
- %TEMP%\rarsfx0\setupdownloader.xml
- %TEMP%\rarsfx0\setupdownloader.exe
- %TEMP%\rarsfx0\sciter.dll
- %TEMP%\rarsfx0\languagemanager.dll
- %TEMP%\rarsfx0\kit.cat
- %TEMP%\rarsfx0\bdnc.client_id
- %ALLUSERSPROFILE%\bdkitinstaller\[7.8.3.261].{297a31b5-602b-4d5b-0750-91cf51007ea2}.setupdownloader.0.bin
- %ALLUSERSPROFILE%\bdkitinstaller\[7.8.3.261].{297a31b5-602b-4d5b-0750-91cf51007ea2}.setupdownloader.988.bin
- %TEMP%\bdtempdir01\x64\kit.cat1686369121
- %TEMP%\bdtempdir01\x64\bdch.dll1686369121
- %TEMP%\bdtempdir01\kit.cat1686369121
- %TEMP%\bdtempdir01\installer.xml1686369121
- %TEMP%\bdtempdir01\data.xml1686369121
- %TEMP%\rarsfx0\tmp.txt
- C:\rhpsupport\latest.exe
- %TEMP%\bdtempdir01\latest.dat
- C:\rhpsupport\tools\wi-fi-rhpwifi.xml
- %TEMP%\rarsfx0\lang\es-es\setupdownloader.dict
- %TEMP%\rarsfx0\lang\fr-fr\setupdownloader.dict
- %TEMP%\rarsfx0\lang\en-us\setupdownloader.dict
- %TEMP%\rarsfx0\lang\it-it\setupdownloader.dict
- %TEMP%\rarsfx0\skin\img\progress-bg.png
- %TEMP%\rarsfx0\lang\ja-jp\setupdownloader.dict
- %TEMP%\rarsfx0\skin\img\minimize-installer.svg
- %TEMP%\rarsfx0\skin\img\logo-setupdownloader.svg
- %TEMP%\rarsfx0\skin\img\close.svg
- %TEMP%\rarsfx0\skin\img\close-installer.svg
- %TEMP%\rarsfx0\skin\fonts\montserrat-regular.ttf
- %TEMP%\rarsfx0\skin\fonts\montserrat-medium.ttf
- %TEMP%\rarsfx0\skin\fonts\montserrat-light.ttf
- %TEMP%\rarsfx0\skin\fonts\montserrat-bold.ttf
- %TEMP%\rarsfx0\skin\setup_downloader.html
- %TEMP%\rarsfx1\skin\img\close-installer.svg
- %TEMP%\rarsfx1\skin\scripts\popup.tis
- %TEMP%\rarsfx0\lang\zh-tw\setupdownloader.dict
- %TEMP%\rarsfx0\lang\zh-cn\setupdownloader.dict
- %TEMP%\rarsfx0\lang\vi-vn\setupdownloader.dict
- %TEMP%\rarsfx0\lang\tr-tr\setupdownloader.dict
- %TEMP%\rarsfx0\lang\ru-ru\setupdownloader.dict
- %TEMP%\rarsfx0\lang\ro-ro\setupdownloader.dict
- %TEMP%\rarsfx0\lang\pt-br\setupdownloader.dict
- %TEMP%\rarsfx0\lang\pl-pl\setupdownloader.dict
- %TEMP%\rarsfx0\lang\nl-nl\setupdownloader.dict
- %TEMP%\rarsfx0\lang\ko-kr\setupdownloader.dict
- %TEMP%\rarsfx0\skin\popup.html
- %TEMP%\rarsfx1\skin\styles\style.css
Перемещает следующие файлы
- %TEMP%\bdtempdir01\data.xml в %TEMP%\bdtempdir01\data.xml1686369121
- %TEMP%\bdtempdir01\installer.xml в %TEMP%\bdtempdir01\installer.xml1686369121
- %TEMP%\bdtempdir01\kit.cat в %TEMP%\bdtempdir01\kit.cat1686369121
- %TEMP%\bdtempdir01\x64\bdch.dll в %TEMP%\bdtempdir01\x64\bdch.dll1686369121
- %TEMP%\bdtempdir01\x64\kit.cat в %TEMP%\bdtempdir01\x64\kit.cat1686369121
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat
Подменяет следующие файлы
- %TEMP%\bdtempdir01\latest.dat
Изменяет файл HOSTS.
Сетевая активность
Подключается к
- 'pu####.#hp-properties.com':80
- 'localhost':49253
- 'localhost':49250
- 'localhost':49247
- 'localhost':49244
- 'localhost':49241
- 'localhost':49238
- 'localhost':49235
- 'localhost':49232
- 'localhost':49229
- 'localhost':49226
- 'localhost':49223
- 'localhost':49220
- 'localhost':49217
- 'localhost':49212
- 'localhost':49208
- 'cl###.####ityzone.bitdefender.com':443
- 'localhost':49204
- 'cl#######.#ravityzone.bitdefender.com':443
- 'localhost':49201
- 'localhost':49256
- 'localhost':49259
TCP
Запросы HTTP GET
- http://pu####.#hp-properties.com/corporate/support/packages/latest.exe
- http://pu####.#hp-properties.com/corporate/support/packages/RHP-Fall-2018-Update.exe
- http://pu####.#hp-properties.com/corporate/support/packages/Startup-Downloader.exe
- http://pu####.#hp-properties.com/corporate/support/packages/BEST_downloaderWrapper.msi
- http://pu####.#hp-properties.com/corporate/support/packages/hosts.txt
Другие
- '34.##9.100.209':443
- 'localhost':49254
- 'localhost':49251
- 'localhost':49248
- 'localhost':49245
- 'localhost':49242
- 'localhost':49239
- 'localhost':49236
- 'localhost':49233
- 'localhost':49230
- 'localhost':49227
- 'localhost':49224
- 'localhost':49221
- 'localhost':49218
- 'localhost':49213
- 'localhost':49209
- 'cl###.####ityzone.bitdefender.com':443
- 'localhost':49205
- 'cl#######.#ravityzone.bitdefender.com':443
- 'localhost':49202
- 'localhost':49257
- 'localhost':49260
UDP
- DNS ASK pu####.#hp-properties.com
- DNS ASK cl#######.#ravityzone.bitdefender.com
- DNS ASK cl###.####ityzone.bitdefender.com
Другое
Ищет следующие окна
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- '%HOMEPATH%\documents\latest.exe'
- '%HOMEPATH%\documents\rhp-fall-2018-update.exe'
- 'C:\rhpsupport\tools\nircmd.exe' elevate cmd /c schtasks.exe /create /tn "RHPStartupDownloader" /tr "C:\RHPSupport\Startup-Downloader.exe" /rl HIGHEST /sc ONLOGON /DELAY 0000:30 /F /RU "BuiltIn\Users"
- 'C:\rhpsupport\tools\nircmd.exe' elevate cmd /c msiexec /i c:\rhpsupport\tools\BEST_downloaderWrapper.msi /qn GZ_PACKAGE_ID=aHR0cHM6Ly9jbG91ZC1lY3MuZ3Jhdml0eXpvbmUuYml0ZGVmZW5kZXIuY29tL1BhY2thZ2VzL0JTVFdJTi8wL2dJYTVHMy9pbnN0YW...
- 'C:\rhpsupport\latest.exe'
- '%WINDIR%\installer\msi2bd5.tmp' /bdparams /silent /sourceUrlEnc="aHR0cHM6Ly9jbG91ZC1lY3MuZ3Jhdml0eXpvbmUuYml0ZGVmZW5kZXIuY29tL1BhY2thZ2VzL0JTVFdJTi8wL2dJYTVHMy9pbnN0YWxsZXIueG1sP2xhbmc9ZW4tVVM=" /runParams="/silent rebootIfNe...
- '%TEMP%\rarsfx0\setupdownloader.exe'
- '%WINDIR%\installer\msic112.tmp' /bdparams /silent /sourceUrlEnc="aHR0cHM6Ly9jbG91ZC1lY3MuZ3Jhdml0eXpvbmUuYml0ZGVmZW5kZXIuY29tL1BhY2thZ2VzL0JTVFdJTi8wL2dJYTVHMy9pbnN0YWxsZXIueG1sP2xhbmc9ZW4tVVM=" /runParams="/silent rebootIfNe...
- '%TEMP%\rarsfx1\setupdownloader.exe'
- '<SYSTEM32>\cmd.exe' /c "netsh wlan add profile filename="C:\RHPSupport\Tools\Wi-Fi-rhpwifi.xml" user=all"' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c "netsh wlan set profileparameter name="rhpwifi" ConnectionMode="auto""' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c ping -n 3 localhost>nul & Del "%HOMEPATH%\Documents\latest.exe"' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c ipconfig /flushdns>nul' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c ping -n 3 localhost>nul & Del "C:\RHPSupport\latest.exe"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "netsh wlan add profile filename="C:\RHPSupport\Tools\Wi-Fi-rhpwifi.xml" user=all"
- '<SYSTEM32>\netsh.exe' wlan add profile filename="C:\RHPSupport\Tools\Wi-Fi-rhpwifi.xml" user=all
- '<SYSTEM32>\cmd.exe' /c "netsh wlan set profileparameter name="rhpwifi" ConnectionMode="auto""
- '<SYSTEM32>\netsh.exe' wlan set profileparameter name="rhpwifi" ConnectionMode="auto"
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /create /tn "RHPStartupDownloader" /tr "C:\RHPSupport\Startup-Downloader.exe" /rl HIGHEST /sc ONLOGON /DELAY 0000:30 /F /RU "BuiltIn\Users"
- '<SYSTEM32>\schtasks.exe' /create /tn "RHPStartupDownloader" /tr "C:\RHPSupport\Startup-Downloader.exe" /rl HIGHEST /sc ONLOGON /DELAY 0000:30 /F /RU "BuiltIn\Users"
- '<SYSTEM32>\cmd.exe' /c msiexec /i c:\rhpsupport\tools\BEST_downloaderWrapper.msi /qn GZ_PACKAGE_ID=aHR0cHM6Ly9jbG91ZC1lY3MuZ3Jhdml0eXpvbmUuYml0ZGVmZW5kZXIuY29tL1BhY2thZ2VzL0JTVFdJTi8wL2dJYTVHMy9pbnN0YWxsZXIueG1sP2...
- '<SYSTEM32>\msiexec.exe' /i c:\rhpsupport\tools\BEST_downloaderWrapper.msi /qn GZ_PACKAGE_ID=aHR0cHM6Ly9jbG91ZC1lY3MuZ3Jhdml0eXpvbmUuYml0ZGVmZW5kZXIuY29tL1BhY2thZ2VzL0JTVFdJTi8wL2dJYTVHMy9pbnN0YWxsZXIueG1sP2xhbmc9ZW4tV...
- '<SYSTEM32>\cmd.exe' /c ping -n 3 localhost>nul & Del "%HOMEPATH%\Documents\latest.exe"
- '<SYSTEM32>\ping.exe' -n 3 localhost
- '<SYSTEM32>\cmd.exe' /c ipconfig /flushdns>nul
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '<SYSTEM32>\cmd.exe' /c ping -n 3 localhost>nul & Del "C:\RHPSupport\latest.exe"
