Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\rarsfx0\setups.ini
- %WINDIR%\syswow64\set450f.tmp
- %WINDIR%\syswow64\set4520.tmp
- %WINDIR%\syswow64\set4530.tmp
- %WINDIR%\syswow64\set4550.tmp
- %WINDIR%\syswow64\set459f.tmp
- %WINDIR%\syswow64\set4452.tmp
- %WINDIR%\syswow64\set44a1.tmp
- %WINDIR%\syswow64\set45c0.tmp
- %WINDIR%\syswow64\set464f.tmp
- %WINDIR%\syswow64\set4660.tmp
- %WINDIR%\syswow64\set4680.tmp
- %WINDIR%\syswow64\set46a0.tmp
- %WINDIR%\syswow64\set46ff.tmp
- %WINDIR%\syswow64\set460f.tmp
- %WINDIR%\syswow64\set463e.tmp
- %WINDIR%\syswow64\set43f3.tmp
- %WINDIR%\syswow64\set43b4.tmp
- %WINDIR%\syswow64\set4394.tmp
- %WINDIR%\system\set41a2.tmp
- %WINDIR%\system\set41c2.tmp
- %WINDIR%\system\set41f2.tmp
- %WINDIR%\system\set4212.tmp
- %WINDIR%\system\set4232.tmp
- %WINDIR%\syswow64\set4243.tmp
- %WINDIR%\system\set4172.tmp
- %WINDIR%\syswow64\set4263.tmp
- %WINDIR%\syswow64\set4284.tmp
- %WINDIR%\syswow64\set4295.tmp
- %WINDIR%\syswow64\set42c5.tmp
- %WINDIR%\syswow64\set42e5.tmp
- %WINDIR%\syswow64\set4305.tmp
- %WINDIR%\syswow64\set4383.tmp
- %WINDIR%\syswow64\set4274.tmp
- %WINDIR%\syswow64\set472e.tmp
- %WINDIR%\syswow64\set474f.tmp
- %WINDIR%\syswow64\set477e.tmp
- %WINDIR%\syswow64\set479f.tmp
- %WINDIR%\syswow64\set4a61.tmp
- %WINDIR%\syswow64\set4a81.tmp
- %WINDIR%\syswow64\set4aa1.tmp
- %WINDIR%\syswow64\set4ac2.tmp
- %WINDIR%\syswow64\set4b01.tmp
- %WINDIR%\syswow64\set4b31.tmp
- %WINDIR%\syswow64\set4b51.tmp
- %WINDIR%\syswow64\set4b71.tmp
- %WINDIR%\syswow64\set4b91.tmp
- %WINDIR%\syswow64\set4bb2.tmp
- %WINDIR%\syswow64\set4be1.tmp
- %WINDIR%\syswow64\set4c02.tmp
- %WINDIR%\syswow64\set4c31.tmp
- %WINDIR%\syswow64\set4c42.tmp
- %WINDIR%\syswow64\set4c72.tmp
- %WINDIR%\syswow64\set4a31.tmp
- %WINDIR%\syswow64\set49f1.tmp
- %WINDIR%\syswow64\set4a11.tmp
- %WINDIR%\syswow64\set49e0.tmp
- %WINDIR%\syswow64\set47af.tmp
- %WINDIR%\syswow64\set47c0.tmp
- %WINDIR%\syswow64\set47e0.tmp
- %WINDIR%\syswow64\set4810.tmp
- %WINDIR%\syswow64\set4830.tmp
- %WINDIR%\syswow64\set4850.tmp
- %WINDIR%\syswow64\set4861.tmp
- %WINDIR%\syswow64\set4881.tmp
- %WINDIR%\syswow64\set48a1.tmp
- %WINDIR%\syswow64\set490f.tmp
- %WINDIR%\syswow64\set493f.tmp
- %WINDIR%\syswow64\set495f.tmp
- %WINDIR%\syswow64\set4980.tmp
- %WINDIR%\syswow64\set49a0.tmp
- %WINDIR%\syswow64\set49c0.tmp
- %WINDIR%\syswow64\set4c92.tmp
- %TEMP%\rarsfx0\i386\tabctl32.ocx
- %TEMP%\rarsfx0\i386\sysinfo.ocx
- %TEMP%\rarsfx0\i386\richtx32.ocx
- %TEMP%\rarsfx0\i386\mfc70ita.dll
- %TEMP%\rarsfx0\i386\mfc70jpn.dll
- %TEMP%\rarsfx0\i386\mfc70kor.dll
- %TEMP%\rarsfx0\i386\mfc70u.dll
- %TEMP%\rarsfx0\i386\mfc71.dll
- %TEMP%\rarsfx0\i386\mfc70esp.dll
- %TEMP%\rarsfx0\i386\mfc70fra.dll
- %TEMP%\rarsfx0\i386\mfc71chs.dll
- %TEMP%\rarsfx0\i386\mfc71enu.dll
- %TEMP%\rarsfx0\i386\mfc71esp.dll
- %TEMP%\rarsfx0\i386\mfc71fra.dll
- %TEMP%\rarsfx0\i386\mfc71ita.dll
- %TEMP%\rarsfx0\i386\mfc71jpn.dll
- %TEMP%\rarsfx0\i386\mfc71cht.dll
- %TEMP%\rarsfx0\i386\mfc71deu.dll
- %TEMP%\rarsfx0\i386\mfc70enu.dll
- %TEMP%\rarsfx0\i386\mfc70deu.dll
- %TEMP%\rarsfx0\i386\mfc70cht.dll
- %TEMP%\rarsfx0\setups.exe
- %TEMP%\rarsfx0\i386\atl70.dll
- %TEMP%\rarsfx0\i386\atl71.dll
- %TEMP%\rarsfx0\i386\autoitx3.dll
- %TEMP%\rarsfx0\i386\cygwin1.dll
- %TEMP%\rarsfx0\i386\cygwinb19.dll
- %TEMP%\rarsfx0\runtimes.inf
- %TEMP%\rarsfx0\i386\libeay32.dll
- %TEMP%\rarsfx0\i386\libintl3.dll
- %TEMP%\rarsfx0\i386\libmmd.dll
- %TEMP%\rarsfx0\i386\libpng13.dll
- %TEMP%\rarsfx0\i386\libssl32.dll
- %TEMP%\rarsfx0\i386\mfc70.dll
- %TEMP%\rarsfx0\i386\mfc70chs.dll
- %TEMP%\rarsfx0\i386\libiconv2.dll
- %TEMP%\rarsfx0\i386\mfc71kor.dll
- %TEMP%\rarsfx0\i386\mfc71u.dll
- %TEMP%\rarsfx0\i386\msstdfmt.dll
- %TEMP%\rarsfx0\i386\msstkprp.dll
- %TEMP%\rarsfx0\i386\comctl32.ocx
- %TEMP%\rarsfx0\i386\comdlg32.ocx
- %TEMP%\rarsfx0\i386\dblist32.ocx
- %TEMP%\rarsfx0\i386\mci32.ocx
- %TEMP%\rarsfx0\i386\mscomct2.ocx
- %TEMP%\rarsfx0\i386\mscomctl.ocx
- %TEMP%\rarsfx0\i386\mscomctl32.ocx
- %TEMP%\rarsfx0\i386\mscomm32.ocx
- %TEMP%\rarsfx0\i386\msdatgrd.ocx
- %TEMP%\rarsfx0\i386\msdatlst.ocx
- %TEMP%\rarsfx0\i386\msflxgrd.ocx
- %TEMP%\rarsfx0\i386\mshflxgd.ocx
- %TEMP%\rarsfx0\i386\msinet.ocx
- %TEMP%\rarsfx0\i386\msmask32.ocx
- %TEMP%\rarsfx0\i386\mswinsck.ocx
- %TEMP%\rarsfx0\i386\comct332.ocx
- %TEMP%\rarsfx0\icon.ico
- %TEMP%\rarsfx0\i386\comct232.ocx
- %TEMP%\rarsfx0\i386\zlib1.dll
- %TEMP%\rarsfx0\i386\msvci70.dll
- %TEMP%\rarsfx0\i386\msvcp70.dll
- %TEMP%\rarsfx0\i386\msvcp71.dll
- %TEMP%\rarsfx0\i386\msvcr70.dll
- %TEMP%\rarsfx0\i386\msvcr71.dll
- %TEMP%\rarsfx0\i386\msvcrt10.dll
- %TEMP%\rarsfx0\i386\openal32.dll
- %TEMP%\rarsfx0\i386\plugin.dll
- %TEMP%\rarsfx0\i386\ssleay32.dll
- %TEMP%\rarsfx0\i386\vb40016.dll
- %TEMP%\rarsfx0\i386\vb40032.dll
- %TEMP%\rarsfx0\i386\vbrun100.dll
- %TEMP%\rarsfx0\i386\vbrun200.dll
- %TEMP%\rarsfx0\i386\vbrun300.dll
- %TEMP%\rarsfx0\i386\wrap_oal.dll
- %TEMP%\rarsfx0\i386\picclp32.ocx
- %TEMP%\setups.reg
Удаляет следующие файлы
- %TEMP%\rarsfx0\icon.ico
- %TEMP%\rarsfx0\i386\msvci70.dll
- %TEMP%\rarsfx0\i386\msstkprp.dll
- %TEMP%\rarsfx0\i386\msstdfmt.dll
- %TEMP%\rarsfx0\i386\msmask32.ocx
- %TEMP%\rarsfx0\i386\msinet.ocx
- %TEMP%\rarsfx0\i386\mshflxgd.ocx
- %TEMP%\rarsfx0\i386\msflxgrd.ocx
- %TEMP%\rarsfx0\i386\msdatlst.ocx
- %TEMP%\rarsfx0\i386\msdatgrd.ocx
- %TEMP%\rarsfx0\i386\mscomm32.ocx
- %TEMP%\rarsfx0\i386\mscomctl32.ocx
- %TEMP%\rarsfx0\i386\mscomctl.ocx
- %TEMP%\rarsfx0\i386\mscomct2.ocx
- %TEMP%\rarsfx0\i386\mfc71u.dll
- %TEMP%\rarsfx0\i386\mfc71kor.dll
- %TEMP%\rarsfx0\i386\mfc71ita.dll
- %TEMP%\rarsfx0\i386\mfc71jpn.dll
- %TEMP%\rarsfx0\i386\msvcp70.dll
- %TEMP%\rarsfx0\i386\msvcp71.dll
- %TEMP%\rarsfx0\i386\vbrun300.dll
- %TEMP%\rarsfx0\i386\vbrun200.dll
- %TEMP%\rarsfx0\i386\vbrun100.dll
- %TEMP%\rarsfx0\i386\vb40032.dll
- %TEMP%\rarsfx0\i386\vb40016.dll
- %TEMP%\rarsfx0\i386\tabctl32.ocx
- %TEMP%\rarsfx0\i386\sysinfo.ocx
- %TEMP%\rarsfx0\i386\richtx32.ocx
- %TEMP%\rarsfx0\i386\mfc70fra.dll
- %TEMP%\rarsfx0\i386\plugin.dll
- %TEMP%\rarsfx0\i386\picclp32.ocx
- %TEMP%\rarsfx0\i386\openal32.dll
- %TEMP%\rarsfx0\i386\mswinsck.ocx
- %TEMP%\rarsfx0\i386\msvcrt10.dll
- %TEMP%\rarsfx0\i386\msvcr71.dll
- %TEMP%\rarsfx0\i386\msvcr70.dll
- %TEMP%\rarsfx0\i386\mfc71fra.dll
- %TEMP%\rarsfx0\i386\mfc71esp.dll
- %TEMP%\rarsfx0\i386\mfc71enu.dll
- %TEMP%\rarsfx0\i386\libeay32.dll
- %TEMP%\rarsfx0\i386\dblist32.ocx
- %TEMP%\rarsfx0\i386\cygwinb19.dll
- %TEMP%\rarsfx0\i386\cygwin1.dll
- %TEMP%\rarsfx0\i386\comdlg32.ocx
- %TEMP%\rarsfx0\i386\comctl32.ocx
- %TEMP%\rarsfx0\i386\comct332.ocx
- %TEMP%\rarsfx0\i386\comct232.ocx
- %TEMP%\rarsfx0\i386\autoitx3.dll
- %TEMP%\rarsfx0\i386\atl71.dll
- %TEMP%\rarsfx0\i386\atl70.dll
- %TEMP%\rarsfx0\setups.ini
- %TEMP%\rarsfx0\setups.exe
- %TEMP%\rarsfx0\runtimes.inf
- %TEMP%\rarsfx0\i386\libintl3.dll
- %TEMP%\rarsfx0\i386\libmmd.dll
- %TEMP%\rarsfx0\i386\libiconv2.dll
- %TEMP%\rarsfx0\i386\libpng13.dll
- %TEMP%\rarsfx0\i386\mfc71deu.dll
- %TEMP%\rarsfx0\i386\libssl32.dll
- %TEMP%\rarsfx0\i386\mfc71cht.dll
- %TEMP%\rarsfx0\i386\mfc71chs.dll
- %TEMP%\rarsfx0\i386\mfc71.dll
- %TEMP%\rarsfx0\i386\mfc70u.dll
- %TEMP%\rarsfx0\i386\mfc70kor.dll
- %TEMP%\rarsfx0\i386\mfc70jpn.dll
- %TEMP%\rarsfx0\i386\ssleay32.dll
- %TEMP%\rarsfx0\i386\wrap_oal.dll
- %TEMP%\rarsfx0\i386\mfc70esp.dll
- %TEMP%\rarsfx0\i386\mfc70enu.dll
- %TEMP%\rarsfx0\i386\mfc70deu.dll
- %TEMP%\rarsfx0\i386\mfc70cht.dll
- %TEMP%\rarsfx0\i386\mfc70chs.dll
- %TEMP%\rarsfx0\i386\mfc70.dll
- %TEMP%\rarsfx0\i386\mci32.ocx
- %TEMP%\rarsfx0\i386\mfc70ita.dll
- %TEMP%\rarsfx0\i386\zlib1.dll
Перемещает следующие файлы
- %WINDIR%\system\set4172.tmp в %WINDIR%\system\msvcrt10.dll
- %WINDIR%\syswow64\set49e0.tmp в %WINDIR%\syswow64\mshflxgd.ocx
- %WINDIR%\syswow64\set49c0.tmp в %WINDIR%\syswow64\msflxgrd.ocx
- %WINDIR%\syswow64\set49a0.tmp в %WINDIR%\syswow64\msdatlst.ocx
- %WINDIR%\syswow64\set4980.tmp в %WINDIR%\syswow64\msdatgrd.ocx
- %WINDIR%\syswow64\set495f.tmp в %WINDIR%\syswow64\mscomm32.ocx
- %WINDIR%\syswow64\set493f.tmp в %WINDIR%\syswow64\mscomctl32.ocx
- %WINDIR%\syswow64\set47af.tmp в %WINDIR%\syswow64\mfc71deu.dll
- %WINDIR%\syswow64\set490f.tmp в %WINDIR%\syswow64\mscomctl.ocx
- %WINDIR%\syswow64\set4881.tmp в %WINDIR%\syswow64\mfc71u.dll
- %WINDIR%\syswow64\set4861.tmp в %WINDIR%\syswow64\mfc71kor.dll
- %WINDIR%\syswow64\set4850.tmp в %WINDIR%\syswow64\mfc71jpn.dll
- %WINDIR%\syswow64\set4830.tmp в %WINDIR%\syswow64\mfc71ita.dll
- %WINDIR%\syswow64\set4810.tmp в %WINDIR%\syswow64\mfc71fra.dll
- %WINDIR%\syswow64\set47e0.tmp в %WINDIR%\syswow64\mfc71esp.dll
- %WINDIR%\syswow64\set48a1.tmp в %WINDIR%\syswow64\mscomct2.ocx
- %WINDIR%\syswow64\set47c0.tmp в %WINDIR%\syswow64\mfc71enu.dll
- %WINDIR%\syswow64\set49f1.tmp в %WINDIR%\syswow64\msinet.ocx
- %WINDIR%\syswow64\set4b51.tmp в %WINDIR%\syswow64\mswinsck.ocx
- %WINDIR%\syswow64\set4c42.tmp в %WINDIR%\syswow64\vb40032.dll
- %WINDIR%\syswow64\set4c31.tmp в %WINDIR%\syswow64\tabctl32.ocx
- %WINDIR%\syswow64\set4c02.tmp в %WINDIR%\syswow64\sysinfo.ocx
- %WINDIR%\syswow64\set4be1.tmp в %WINDIR%\syswow64\ssleay32.dll
- %WINDIR%\syswow64\set4bb2.tmp в %WINDIR%\syswow64\richtx32.ocx
- %WINDIR%\syswow64\set4b91.tmp в %WINDIR%\syswow64\picclp32.ocx
- %WINDIR%\syswow64\set4a31.tmp в %WINDIR%\syswow64\msstdfmt.dll
- %WINDIR%\syswow64\set4a11.tmp в %WINDIR%\syswow64\msmask32.ocx
- %WINDIR%\syswow64\set4b31.tmp в %WINDIR%\syswow64\msvcr71.dll
- %WINDIR%\syswow64\set4b01.tmp в %WINDIR%\syswow64\msvcr70.dll
- %WINDIR%\syswow64\set4ac2.tmp в %WINDIR%\syswow64\msvcp71.dll
- %WINDIR%\syswow64\set4aa1.tmp в %WINDIR%\syswow64\msvcp70.dll
- %WINDIR%\syswow64\set4a81.tmp в %WINDIR%\syswow64\msvci70.dll
- %WINDIR%\syswow64\set4a61.tmp в %WINDIR%\syswow64\msstkprp.dll
- %WINDIR%\syswow64\set4b71.tmp в %WINDIR%\syswow64\openal32.dll
- %WINDIR%\syswow64\set479f.tmp в %WINDIR%\syswow64\mfc71cht.dll
- %WINDIR%\syswow64\set477e.tmp в %WINDIR%\syswow64\mfc71chs.dll
- %WINDIR%\syswow64\set474f.tmp в %WINDIR%\syswow64\mfc71.dll
- %WINDIR%\syswow64\set4305.tmp в %WINDIR%\syswow64\cygwin1.dll
- %WINDIR%\syswow64\set42e5.tmp в %WINDIR%\syswow64\comdlg32.ocx
- %WINDIR%\syswow64\set42c5.tmp в %WINDIR%\syswow64\comctl32.ocx
- %WINDIR%\syswow64\set4295.tmp в %WINDIR%\syswow64\comct332.ocx
- %WINDIR%\syswow64\set4284.tmp в %WINDIR%\syswow64\comct232.ocx
- %WINDIR%\syswow64\set4394.tmp в %WINDIR%\syswow64\dblist32.ocx
- %WINDIR%\syswow64\set4274.tmp в %WINDIR%\syswow64\autoitx3.dll
- %WINDIR%\syswow64\set4243.tmp в %WINDIR%\syswow64\atl70.dll
- %WINDIR%\system\set4232.tmp в %WINDIR%\system\vbrun300.dll
- %WINDIR%\system\set4212.tmp в %WINDIR%\system\vbrun200.dll
- %WINDIR%\system\set41f2.tmp в %WINDIR%\system\vbrun100.dll
- %WINDIR%\system\set41c2.tmp в %WINDIR%\system\vb40016.dll
- %WINDIR%\system\set41a2.tmp в %WINDIR%\system\plugin.dll
- %WINDIR%\syswow64\set4263.tmp в %WINDIR%\syswow64\atl71.dll
- %WINDIR%\syswow64\set43b4.tmp в %WINDIR%\syswow64\libeay32.dll
- %WINDIR%\syswow64\set4383.tmp в %WINDIR%\syswow64\cygwinb19.dll
- %WINDIR%\syswow64\set43f3.tmp в %WINDIR%\syswow64\libiconv2.dll
- %WINDIR%\syswow64\set472e.tmp в %WINDIR%\syswow64\mfc70u.dll
- %WINDIR%\syswow64\set460f.tmp в %WINDIR%\syswow64\mfc70deu.dll
- %WINDIR%\syswow64\set46ff.tmp в %WINDIR%\syswow64\mfc70kor.dll
- %WINDIR%\syswow64\set46a0.tmp в %WINDIR%\syswow64\mfc70jpn.dll
- %WINDIR%\syswow64\set4680.tmp в %WINDIR%\syswow64\mfc70ita.dll
- %WINDIR%\syswow64\set4660.tmp в %WINDIR%\syswow64\mfc70fra.dll
- %WINDIR%\syswow64\set464f.tmp в %WINDIR%\syswow64\mfc70esp.dll
- %WINDIR%\syswow64\set463e.tmp в %WINDIR%\syswow64\mfc70enu.dll
- %WINDIR%\syswow64\set45c0.tmp в %WINDIR%\syswow64\mfc70cht.dll
- %WINDIR%\syswow64\set4452.tmp в %WINDIR%\syswow64\libintl3.dll
- %WINDIR%\syswow64\set459f.tmp в %WINDIR%\syswow64\mfc70chs.dll
- %WINDIR%\syswow64\set4550.tmp в %WINDIR%\syswow64\mfc70.dll
- %WINDIR%\syswow64\set4530.tmp в %WINDIR%\syswow64\mci32.ocx
- %WINDIR%\syswow64\set4520.tmp в %WINDIR%\syswow64\libssl32.dll
- %WINDIR%\syswow64\set450f.tmp в %WINDIR%\syswow64\libpng13.dll
- %WINDIR%\syswow64\set44a1.tmp в %WINDIR%\syswow64\libmmd.dll
- %WINDIR%\syswow64\set4c72.tmp в %WINDIR%\syswow64\wrap_oal.dll
- %WINDIR%\syswow64\set4c92.tmp в %WINDIR%\syswow64\zlib1.dll
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\rarsfx0\setups.exe'
- '%WINDIR%\syswow64\reg.exe' import %TEMP%\SetupS.reg' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\rundll32.exe' syssetup,SetupInfObjectInstallAction DefaultInstall 128 %TEMP%\RarSFX0\Runtimes.inf
- '%WINDIR%\syswow64\runonce.exe' -r
- '%WINDIR%\syswow64\grpconv.exe' -o
- '%WINDIR%\syswow64\reg.exe' import %TEMP%\SetupS.reg
