Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] ' ISSetupPrerequisistes' = '"%TEMP%\ACDSee Ultimate 9.exe"'
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = '<SYSTEM32>\napinsp.dll'
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002] 'LibraryPath' = '<SYSTEM32>\pnrpnsp.dll'
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = '<SYSTEM32>\pnrpnsp.dll'
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004] 'LibraryPath' = '<SYSTEM32>\wshbth.dll'
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005] 'LibraryPath' = '<SYSTEM32>\NLAapi.dll'
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006] 'LibraryPath' = '<SYSTEM32>\mswsock.dll'
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000007] 'LibraryPath' = '<SYSTEM32>\winrnr.dll'
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000008] 'LibraryPath' = '%ProgramFiles(x86)%\Bonjour\mdnsNSP.dll'
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\Bonjour Service] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Bonjour Service] 'ImagePath' = '"%ProgramFiles%\Bonjour\mDNSResponder.exe"'
Создает следующие сервисы
- 'Bonjour Service' %ProgramFiles%\Bonjour\mDNSResponder.exe
Вредоносные функции
Изменяет следующие настройки браузера Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '*.local'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\acdwiclient.exe
- %TEMP%\acdwebinstaller.xml
- %TEMP%\acdwebinstallerstring.ini
- %TEMP%\cancel_d.jpg
- %TEMP%\cancel_h.jpg
- %TEMP%\cancel_n.jpg
- %TEMP%\checkd.jpg
- %TEMP%\close_h.jpg
- %TEMP%\close_n.jpg
- %TEMP%\mainwndbkg.jpg
- %TEMP%\min_h.jpg
- %TEMP%\min_n.jpg
- %TEMP%\statusbkg.jpg
- %TEMP%\acdsee ultimate 9.exe
- %TEMP%\{873b832e-840c-4777-b26c-f72ad4115a85}\setup.ini
- %TEMP%\{873b832e-840c-4777-b26c-f72ad4115a85}\_ismsidel.ini
- %TEMP%\{873b832e-840c-4777-b26c-f72ad4115a85}\0x0409.ini
- %TEMP%\~3f13.tmp
- %TEMP%\~3f33.tmp
- %TEMP%\{873b832e-840c-4777-b26c-f72ad4115a85}\microsoft visual c++ 2019 redistributable package (x64) 14.24.28127.4.prq
- %TEMP%\{873b832e-840c-4777-b26c-f72ad4115a85}\bonjour64.prq
- %TEMP%\{873b832e-840c-4777-b26c-f72ad4115a85}\{fbf70175-bb86-496a-900a-c5b9cebcb13c}\vc_redist.x64.exe
- %WINDIR%\temp\{ca1fc258-aa99-439c-9109-5dc3618bb0c7}\.cr\vc_redist.x64.exe
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\wixstdba.dll
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\thm.xml
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\logo.png
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1028\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1028\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1029\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1029\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1031\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1031\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1036\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1036\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1040\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1040\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1041\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1041\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1042\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1042\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1045\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1045\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1046\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1046\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1049\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1049\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1055\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1055\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\2052\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\2052\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\3082\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\3082\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\bootstrapperapplicationdata.xml
- %TEMP%\{873b832e-840c-4777-b26c-f72ad4115a85}\{fbf70175-bb86-496a-900a-c5b9cebcb13c}\rdlog.txt
- %TEMP%\{873b832e-840c-4777-b26c-f72ad4115a85}\{6e3610b2-430d-4eb0-81e3-2b57e8b9df9e}\bonjour64.msi
- %WINDIR%\temp\~df12df568119d053e2.tmp
- %WINDIR%\installer\sourcehash{6e3610b2-430d-4eb0-81e3-2b57e8b9de8d}
- %WINDIR%\temp\~dfc869cef4979cba6e.tmp
- %WINDIR%\temp\~dfd062ca436dadf978.tmp
- %WINDIR%\temp\~df8c28c503bfc9a354.tmp
- %ALLUSERSPROFILE%\apple\installer cache\bonjour 3.0.0.10\bonjour64.msi
- %ProgramFiles(x86)%\bonjour\bonjour.resources\da.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\de.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\en.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\en_gb.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\es.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\fi.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\fr.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\it.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\ja.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\ko.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\nb.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\nl.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\pl.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\pt.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\pt_pt.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\ru.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\sv.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\zh_cn.lproj\about bonjour.rtf
- %ProgramFiles(x86)%\bonjour\bonjour.resources\zh_tw.lproj\about bonjour.rtf
- %WINDIR%\syswow64\dns-sd.exe
- %ProgramFiles(x86)%\bonjour\dns_sd.jar
- <SYSTEM32>\dns-sd.exe
- %ProgramFiles%\bonjour\dns_sd.jar
- %WINDIR%\syswow64\dnssd.dll
- <SYSTEM32>\dnssd.dll
- %WINDIR%\syswow64\dnssdx.dll
- <SYSTEM32>\dnssdx.dll
- %WINDIR%\syswow64\jdns_sd.dll
- <SYSTEM32>\jdns_sd.dll
- %ProgramFiles(x86)%\bonjour\mdnsnsp.dll
- %ProgramFiles%\bonjour\mdnsnsp.dll
- %ProgramFiles(x86)%\bonjour\mdnsresponder.exe
- %ProgramFiles%\bonjour\mdnsresponder.exe
- %ProgramFiles%\java\jre1.8.0_77\lib\ext\dns_sd.jar
- %WINDIR%\installer\{6e3610b2-430d-4eb0-81e3-2b57e8b9de8d}\bonjour.ico
- %WINDIR%\installer\{6e3610b2-430d-4eb0-81e3-2b57e8b9de8d}\richtext.ico
- %ProgramFiles%\bonjour\about bonjour.lnk
- %ProgramFiles(x86)%\bonjour\about bonjour.lnk
- %WINDIR%\temp\~df5e117984ced14327.tmp
- %WINDIR%\temp\~dfb0951be0f4670974.tmp
- %WINDIR%\temp\~df5b9fe87683fba7d7.tmp
- %WINDIR%\temp\~df3c0f00888c522508.tmp
- %WINDIR%\temp\~dfc5575b5f40b1923b.tmp
- %WINDIR%\temp\~dfe8a324b3f4023ce9.tmp
- %WINDIR%\temp\~df87a71d676355fbc8.tmp
- %WINDIR%\temp\~df60e13ff7fe584230.tmp
- %TEMP%\{873b832e-840c-4777-b26c-f72ad4115a85}\acdsee photo studio ultimate 2021.msi
- %LOCALAPPDATA%\downloaded installations\{99a326a5-da94-4090-82c4-e7f2de56e2bb}\acdsee photo studio ultimate 2021.msi
- %TEMP%\~84b9.tmp
- %TEMP%\msi8cd5.tmp
- %TEMP%\content\3716-2360-msiexec.exe-00-35-45-901.dump
- %TEMP%\55e26479-b953-402c-83c4-71f0ade3046b\getwinver.ps1
- %TEMP%\content\3716-2360-msiexec.exe-00-35-46-012.dump
- %TEMP%\__psscriptpolicytest_wvukupt0.jfj.ps1
- %TEMP%\__psscriptpolicytest_2h3wddi1.kqu.psm1
- %TEMP%\content\3716-1304-msiexec.exe-00-35-47-689.dump
Удаляет файлы, которые сам же создал
- %TEMP%\acdwiclient.exe
- %TEMP%\acdwebinstaller.xml
- %TEMP%\acdwebinstallerstring.ini
- %TEMP%\cancel_d.jpg
- %TEMP%\cancel_h.jpg
- %TEMP%\cancel_n.jpg
- %TEMP%\checkd.jpg
- %TEMP%\close_h.jpg
- %TEMP%\close_n.jpg
- %TEMP%\mainwndbkg.jpg
- %TEMP%\min_h.jpg
- %TEMP%\min_n.jpg
- %TEMP%\statusbkg.jpg
- %TEMP%\~3f13.tmp
- %TEMP%\~3f33.tmp
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1028\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1028\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1029\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1029\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1031\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1031\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1036\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1036\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1040\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1040\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1041\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1041\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1042\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1042\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1045\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1045\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1046\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1046\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1049\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1049\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1055\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\1055\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\2052\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\2052\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\3082\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\3082\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\bootstrapperapplicationdata.xml
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\license.rtf
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\logo.png
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\thm.wxl
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\thm.xml
- %WINDIR%\temp\{fd98dc1b-eee8-4ff7-8a3a-47158c2ddf70}\.ba\wixstdba.dll
- %WINDIR%\temp\{ca1fc258-aa99-439c-9109-5dc3618bb0c7}\.cr\vc_redist.x64.exe
- %TEMP%\~84b9.tmp
- %TEMP%\__psscriptpolicytest_wvukupt0.jfj.ps1
- %TEMP%\__psscriptpolicytest_2h3wddi1.kqu.psm1
- %TEMP%\55e26479-b953-402c-83c4-71f0ade3046b\getwinver.ps1
- %TEMP%\msi8cd5.tmp
Перемещает следующие файлы
- %ProgramFiles%\java\jre1.8.0_77\lib\ext\dns_sd.jar в C:\config.msi\f4e2a.rbf
Подменяет следующие файлы
- %ProgramFiles%\java\jre1.8.0_77\lib\ext\dns_sd.jar
Сетевая активность
Подключается к
- 'r.###see.com':80
- 'r.###see.com':443
- 'oc##.#ectigo.com':80
- 'pa#.##dsystems.com':80
TCP
Запросы HTTP GET
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?10##############
- http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCALOo0IbwgcZIG3lgoGLJP
Другие
- 'r.###see.com':443
UDP
- DNS ASK r.###see.com
- DNS ASK oc##.#ectigo.com
- DNS ASK pa#.##dsystems.com
- '22#.0.0.251':5353
- 'ff##::fb':5353
Другое
Создает и запускает на исполнение
- '%TEMP%\acdwiclient.exe'
- '%TEMP%\acdsee ultimate 9.exe'
- '%TEMP%\{873b832e-840c-4777-b26c-f72ad4115a85}\{fbf70175-bb86-496a-900a-c5b9cebcb13c}\vc_redist.x64.exe' /install /quiet /norestart /log rdlog.txt
- '%WINDIR%\temp\{ca1fc258-aa99-439c-9109-5dc3618bb0c7}\.cr\vc_redist.x64.exe' -burn.clean.room="%TEMP%\{873B832E-840C-4777-B26C-F72AD4115A85}\{FBF70175-BB86-496A-900A-C5B9CEBCB13C}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=648 /install /quiet...
- '%ProgramFiles%\bonjour\mdnsresponder.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\{873B832E-840C-4777-B26C-F72AD4115A85}\{6E3610B2-430D-4EB0-81E3-2B57E8B9DF9E}\Bonjour64.msi" /quiet
- '<SYSTEM32>\msiexec.exe' /Y "%ProgramFiles%\Bonjour\mdnsNSP.dll"
- '%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Bonjour\mdnsNSP.dll"
- '<SYSTEM32>\msiexec.exe' /i "%LOCALAPPDATA%\Downloaded Installations\{99A326A5-DA94-4090-82C4-E7F2DE56E2BB}\ACDSee Photo Studio Ultimate 2021.msi" SETUPEXEDIR="%LOCALAPPDATA%\Temp" SETUPEXENAME="ACDSee Ultimate 9.exe"
- '%TEMP%\acdsee ultimate 9.exe' (со скрытым окном)
