Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\WZSE0.TMP\setup.exe'
- '%TEMP%\WZSE0.TMP\s3minset.exe' /fromisx
- '%TEMP%\WZSE0.TMP\setup.exe' -s noreboot
- '%TEMP%\7zS1.tmp\pstubxx.exe' XP.exe
- '%TEMP%\7zS1.tmp\XP.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\WZSE0.TMP\S3Cfg3D.dll
- %TEMP%\WZSE0.TMP\S3CfgChs.hlp
- %TEMP%\WZSE0.TMP\S3CfgCht.hlp
- %TEMP%\WZSE0.TMP\S3Cfg3D.cfg
- %TEMP%\WZSE0.TMP\dc04r.inf
- %TEMP%\WZSE0.TMP\engine32.cab
- %TEMP%\WZSE0.TMP\layout.bin
- %TEMP%\WZSE0.TMP\S3CfgJpn.hlp
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\e03a195e43625e36e96156e99cba6949_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\igd7.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isp6.tmp\temp.000
- %TEMP%\iss2.tmp\setup.ini
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\set4.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isp3.tmp\temp.000
- %TEMP%\WZSE0.TMP\data2.cab
- %TEMP%\WZSE0.TMP\S3TrayP.exe
- %TEMP%\WZSE0.TMP\setup.exe
- %TEMP%\WZSE0.TMP\setup.ibt
- %TEMP%\WZSE0.TMP\S3TrayP.cfg
- %TEMP%\WZSE0.TMP\S3TPWs2.hlp
- %TEMP%\WZSE0.TMP\S3TPWst.hlp
- %TEMP%\WZSE0.TMP\S3TrayP2.cfg
- %TEMP%\WZSE0.TMP\setup.ini
- %TEMP%\WZSE0.TMP\VTROM.bin
- %TEMP%\WZSE0.TMP\data1.cab
- %TEMP%\WZSE0.TMP\data1.hdr
- %TEMP%\WZSE0.TMP\VModes.exe
- %TEMP%\WZSE0.TMP\setup.inx
- %TEMP%\WZSE0.TMP\setup.iss
- %TEMP%\WZSE0.TMP\ucb_xp32.sys
- %TEMP%\_se8.tmp
- %WINDIR%\Chrome9HC.uns
- %WINDIR%\s3iscfg.log
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\layoa29f.rra
- %TEMP%\WZSE0.TMP\setup.log
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\isrt8860.rra
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\defa88cd.rra
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\_IsR88ed.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\dataa2be.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\setup.ibt
- %TEMP%\s3chipid.sys
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\setua3b8.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\dataa2ce.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\setua35a.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\setua389.rra
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\Stri8821.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iscC.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iusD.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\ctoB.tmp
- %TEMP%\isp5.tmp\temp.000
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iKe9.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\DotA.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\read87a4.rra
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\core87d3.rra
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\Font8802.rra
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\lice8785.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\setu8737.rra
- %TEMP%\WZSE0.TMP\S3Gamma2.dll
- %TEMP%\WZSE0.TMP\S3gIGP.dll
- %TEMP%\WZSE0.TMP\s3gIGPgl.dll
- %TEMP%\WZSE0.TMP\S3Gamma2.cfg
- %TEMP%\WZSE0.TMP\S3DspWst.hlp
- %TEMP%\WZSE0.TMP\s3g700.cat
- %TEMP%\WZSE0.TMP\S3Gama_2.cfg
- %TEMP%\WZSE0.TMP\S3gIGPm.sys
- %TEMP%\WZSE0.TMP\S3Gm2Kor.hlp
- %TEMP%\WZSE0.TMP\S3Gm2Tha.hlp
- %TEMP%\WZSE0.TMP\S3Gm2Ws2.hlp
- %TEMP%\WZSE0.TMP\S3Gm2Jpn.hlp
- %TEMP%\WZSE0.TMP\s3ginv.dll
- %TEMP%\WZSE0.TMP\S3Gm2Chs.hlp
- %TEMP%\WZSE0.TMP\S3Gm2Cht.hlp
- %TEMP%\WZSE0.TMP\S3DspWs2.hlp
- %TEMP%\WZSE0.TMP\S3CfgWs2.hlp
- %TEMP%\WZSE0.TMP\S3CfgWst.hlp
- %TEMP%\WZSE0.TMP\S3Displ2.cfg
- %TEMP%\WZSE0.TMP\S3CfgTha.hlp
- %TEMP%\7zS1.tmp\pstubxx.exe
- %TEMP%\7zS1.tmp\XP.exe
- %TEMP%\WZSE0.TMP\S3CfgKor.hlp
- %TEMP%\WZSE0.TMP\S3Displ3.cfg
- %TEMP%\WZSE0.TMP\S3DspJpn.hlp
- %TEMP%\WZSE0.TMP\S3DspKor.hlp
- %TEMP%\WZSE0.TMP\S3DspTha.hlp
- %TEMP%\WZSE0.TMP\S3DspCht.hlp
- %TEMP%\WZSE0.TMP\S3Disply.cfg
- %TEMP%\WZSE0.TMP\S3Disply.dll
- %TEMP%\WZSE0.TMP\S3DspChs.hlp
- %TEMP%\WZSE0.TMP\S3Gm2Wst.hlp
- %TEMP%\WZSE0.TMP\S3OvlWs2.hlp
- %TEMP%\WZSE0.TMP\S3OvlWst.hlp
- %TEMP%\WZSE0.TMP\S3Ovrlay.cfg
- %TEMP%\WZSE0.TMP\S3OvlTha.hlp
- %TEMP%\WZSE0.TMP\S3OvlCht.hlp
- %TEMP%\WZSE0.TMP\S3OvlJpn.hlp
- %TEMP%\WZSE0.TMP\S3OvlKor.hlp
- %TEMP%\WZSE0.TMP\S3Ovrlay.dll
- %TEMP%\WZSE0.TMP\S3TPJpn.hlp
- %TEMP%\WZSE0.TMP\S3TPKor.hlp
- %TEMP%\WZSE0.TMP\S3TPTha.hlp
- %TEMP%\WZSE0.TMP\S3TPCht.hlp
- %TEMP%\WZSE0.TMP\S3Ovrly2.cfg
- %TEMP%\WZSE0.TMP\S3TPChs.hlp
- %TEMP%\WZSE0.TMP\S3TPCht.GID
- %TEMP%\WZSE0.TMP\S3OvlChs.hlp
- %TEMP%\WZSE0.TMP\S3In2Kor.hlp
- %TEMP%\WZSE0.TMP\S3In2Tha.hlp
- %TEMP%\WZSE0.TMP\S3In2Ws2.hlp
- %TEMP%\WZSE0.TMP\S3In2Jpn.hlp
- %TEMP%\WZSE0.TMP\S3HotPlug.dll
- %TEMP%\WZSE0.TMP\S3In2Chs.hlp
- %TEMP%\WZSE0.TMP\S3In2Cht.hlp
- %TEMP%\WZSE0.TMP\S3In2Wst.hlp
- %TEMP%\WZSE0.TMP\S3iset32.txt
- %TEMP%\WZSE0.TMP\s3loadsv.exe
- %TEMP%\WZSE0.TMP\s3minset.exe
- %TEMP%\WZSE0.TMP\s3iset32.dll
- %TEMP%\WZSE0.TMP\S3Info2.cfg
- %TEMP%\WZSE0.TMP\S3Info2.dll
- %TEMP%\WZSE0.TMP\s3iscfg.dat
Удаляет следующие файлы:
- %TEMP%\_se8.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\set4.tmp
- %TEMP%\igd7.tmp
Перемещает следующие файлы:
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\Stri8821.rra в %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\StringTable-0009-English.ips
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\isrt8860.rra в %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\isrt.dll
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\defa88cd.rra в %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\default.pal
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\read87a4.rra в %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\readme.txt
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\core87d3.rra в %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\corecomp.ini
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\Font8802.rra в %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\FontData.ini
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\_IsR88ed.rra в %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\_IsRes.dll
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\setua35a.rra в %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\setup.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\setua389.rra в %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\setup.inx
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\setua3b8.rra в %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\layoa29f.rra в %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\layout.bin
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\dataa2be.rra в %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\data1.hdr
- %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\dataa2ce.rra в %PROGRAM_FILES%\InstallShield Installation Information\{60DCCEF9-731B-41CF-9C33-66AB3900FCDE}\data1.cab
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isp6.tmp\IGdi.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iGdi.dll
- %TEMP%\isp5.tmp\temp.000 в %TEMP%\isp5.tmp\_Setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iKe9.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iKernel.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isp3.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isp3.tmp\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isp3.tmp\setup.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isp6.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\isp6.tmp\IGdi.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\DotA.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\DotNetInstaller.exe
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\setu8737.rra в %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\setup.inx
- %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\lice8785.rra в %TEMP%\{D3546819-7819-4049-AC41-67B4DA0E737D}\{5A118437-3B7B-402B-955C-A74B847CB0DE}\license.txt
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\ctoB.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\ctor.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iscC.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iscript.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iusD.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\00\Intel32\iuser.dll
Другое:
Ищет следующие окна:
- ClassName: 'InstallShield_Win' WindowName: ''
- ClassName: 'S3MinsetCls' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
