Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IDriver.exe' -Embedding
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' -Embedding 71F4A481179FDFD754C0C1C18C8F74A7 C
- '<SYSTEM32>\msiexec.exe' /V
Изменения в файловой системе:
Создает следующие файлы:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\Config.Msi\2b242.rbs
- %WINDIR%\Installer\MSI3.tmp
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IUser8.dll
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\objps8.dll
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IDriver.exe
- %WINDIR%\Installer\2b23f.msi
- %TEMP%\_is2\_ISMSIDEL.INI
- %TEMP%\_is2\Setup.INI
- %TEMP%\~1.tmp
- %TEMP%\_is2\ISScript8.Msi
- %TEMP%\_is2\Xelerator 2.0.msi
- %TEMP%\_is2\0x0409.ini
- %TEMP%\{68D3EB18-6708-486D-B58E-A97B92713B71}\_ISRES.DLL
- %TEMP%\{68D3EB18-6708-486D-B58E-A97B92713B71}\IsConfig.INI
- %TEMP%\{68D3EB18-6708-486D-B58E-A97B92713B71}\ISRT.DLL
- %TEMP%\MSI6.tmp
- %TEMP%\{68D3EB18-6708-486D-B58E-A97B92713B71}\IGdi.dll
- %TEMP%\{68D3EB18-6708-486D-B58E-A97B92713B71}\String1033.txt
- %TEMP%\{68D3EB18-6708-486D-B58E-A97B92713B71}\setup.inx
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\_ISRES1033.dll
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\ISRT.dll
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IScript8.dll
- %WINDIR%\Downloaded Installations\{87377A22-3DAD-4238-9039-445C721F6E23}\0x0409.ini
- %WINDIR%\Downloaded Installations\{87377A22-3DAD-4238-9039-445C721F6E23}\Xelerator 2.0.msi
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IDriver2.exe
Удаляет следующие файлы:
- %WINDIR%\Installer\2b23f.msi
- %WINDIR%\Installer\2b241.ipi
- %TEMP%\MSI6.tmp
- %TEMP%\~1.tmp
- %WINDIR%\Installer\MSI3.tmp
- C:\Config.Msi\2b242.rbs
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
