Trojan.Siggen14.60211

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\V82.InfoBaseList\shell\Open\command] '' = '"%ProgramFiles(x86)%\1cv8\common\1cestart.exe" /RunShortcut "%1"'
[<HKLM>\Software\Classes\V82.InfoBaseListLink\shell\Open\command] '' = '"%ProgramFiles(x86)%\1cv8\common\1cestart.exe" /RunShortcut "%1"'

Modifies file system

Creates the following files

%TEMP%\1c 8.3.9.1850\data1.cab
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\map.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\moxel.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\pack.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\plnnr.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\plnnrcmn.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\txtedt.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\vrscore.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\ws.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\bsl_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\chart_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\dbgbase_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\dbgtgt_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\dcscore_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\enums_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\ext_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\fmtd_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\fmtdcmn_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\grphcs_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\help_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\html_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\image_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\map_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\moxel_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\image.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\pack_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\html.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\grphcs.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\rscalls_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\rclient.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\rclient_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\rserver.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\rserver_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\dbeng8.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\dbeng8_root.res
%ProgramFiles(x86)%\1cv8\common\1ceunt.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\conf\conf.cfg
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\1cv8c.exe
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\mngcln.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\1cv8c_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\mngcln_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\bsl.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\cacert.pem
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\chart.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\dbgbase.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\dbgtgt.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\dcscore.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\enums.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\ext.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\fmtd.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\fmtdcmn.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\help.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\plnnr_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\plnnrcmn_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\txtedt_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\mngui_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\moxelui_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\plnnrui_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\schemui_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\test_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\testbase_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\testmc_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\txtedui_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\1cv8s.exe
%ProgramFiles(x86)%\1cv8\common\1cestart.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\1c enterprise 8\~c enterprise.tmp
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\1cv8s_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\msvcp110.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\version32.txt
%WINDIR%\installer\{a02eb108-418c-4eca-bb08-43a7fa798d93}\arpproducticon.exe
%WINDIR%\installer\{a02eb108-418c-4eca-bb08-43a7fa798d93}\_2b2f6f1e_c4e2_4eb4_9c46_dc0b34ea2f86
%WINDIR%\installer\{a02eb108-418c-4eca-bb08-43a7fa798d93}\_4d4a2089_5a01_4c52_8926_e79477e8b198
%WINDIR%\installer\{a02eb108-418c-4eca-bb08-43a7fa798d93}\shortcut_enterprst_2a5c6dcb39b64d1eb6762c6fa47a7631.exe
%WINDIR%\installer\{a02eb108-418c-4eca-bb08-43a7fa798d93}\shortcut_thinstarter.exe
C:\users\public\desktop\1c enterprise.lnk
C:\users\public\desktop\~c enterprise.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\1c enterprise 8\1c enterprise.lnk
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\imageui_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\mapui_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\htmlui_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\helpui_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\fmtdui_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\ws_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\frame.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\chartui.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\dbgmc.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\extui.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\fmtdui.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\helpui.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\htmlui.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\imageui.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\mapui.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\rtrsrvc_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\moxelui.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\mngui.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\schemui.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\test.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\testbase.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\testmc.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\txtedui.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\wbase83.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\win7spt.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\frame_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\chartui_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\extui_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\vrscore_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\plnnrui.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\msvcr110.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\rscalls.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\xdto.dll
%TEMP%\1c 8.3.9.1850\adminstallrelogon.mst
%TEMP%\1c 8.3.9.1850\adminstallrestart.mst
%TEMP%\1c 8.3.9.1850\instmsi30.exe
%TEMP%\1c 8.3.9.1850\setup.exe
%TEMP%\1c 8.3.9.1850\setup.ini
%WINDIR%\installer\1156c7.mst
%APPDATA%\1c\1cestart\1cestart.cfg
%ALLUSERSPROFILE%\1c\1cestart\1cestart.cfg
%ProgramFiles(x86)%\1cv8\conf\conf.cfg
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\icu.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\apache-2.0.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\boost.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\curl.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\jsoncpp.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\libpng.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\libtiff.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\libxml2.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\libxslt.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\openssl.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\postgresql.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\proj4.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\sqlite.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\stlport.txt
%TEMP%\1c 8.3.9.1850\2052.mst
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\ziparchive.html
%TEMP%\1c 8.3.9.1850\1063.mst
%TEMP%\1c 8.3.9.1850\1058.mst
%TEMP%\1c 8.3.9.1850\0x040c.ini
%TEMP%\1c 8.3.9.1850\0x040e.ini
%TEMP%\1c 8.3.9.1850\0x041f.ini
%TEMP%\1c 8.3.9.1850\0x0402.ini
%TEMP%\1c 8.3.9.1850\0x0407.ini
%TEMP%\1c 8.3.9.1850\0x0409.ini
%TEMP%\1c 8.3.9.1850\0x0415.ini
%TEMP%\1c 8.3.9.1850\0x0418.ini
%TEMP%\1c 8.3.9.1850\0x0419.ini
%TEMP%\1c 8.3.9.1850\0x0422.ini
%TEMP%\1c 8.3.9.1850\0x0426.ini
%TEMP%\1c 8.3.9.1850\0x0427.ini
%TEMP%\1c 8.3.9.1850\0x0804.ini
%TEMP%\1c 8.3.9.1850\1centerprise 8 thin client.msi
%TEMP%\1c 8.3.9.1850\1026.mst
%TEMP%\1c 8.3.9.1850\1031.mst
%TEMP%\1c 8.3.9.1850\1033.mst
%TEMP%\1c 8.3.9.1850\1036.mst
%TEMP%\1c 8.3.9.1850\1038.mst
%TEMP%\1c 8.3.9.1850\1045.mst
%TEMP%\1c 8.3.9.1850\1048.mst
%TEMP%\1c 8.3.9.1850\1049.mst
%TEMP%\1c 8.3.9.1850\1055.mst
%TEMP%\1c 8.3.9.1850\1062.mst
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\3rd_party\zlib.txt
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\1centerprise_en.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\licenses\1centerprise_ru.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\dumper.exe
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\icudt46.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\icuin46.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\icuuc46.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\inet.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\json.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\mngcore.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\nuke83.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\scheme.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\stl83.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\xml2_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\techsys.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\xml2.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\core83_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\backbas_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\dumper_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\inet_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\json_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\mngcore_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\scheme_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\techsys_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\xdto_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\core83.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\backbas.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\addncpp_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\addncom_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\addin_root.res
%ProgramFiles(x86)%\1cv8\8.3.9.1850\docs\ru\v8update.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_az.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_bg.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_de.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_en.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_fr.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_hu.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_ka.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_kk.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\rtrsrvc.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_lv.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_lt.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_ro.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_ru.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_tr.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_uk.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_vi.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_zh.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\addin.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\addncom.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\addncpp.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\bin\addnmrs.dll
%ProgramFiles(x86)%\1cv8\8.3.9.1850\docs\en\v8update.htm
%ProgramFiles(x86)%\1cv8\8.3.9.1850\readme\readme_pl.htm
%WINDIR%\installer\{a02eb108-418c-4eca-bb08-43a7fa798d93}\1033.mst

Deletes the following files

C:\users\public\desktop\1c enterprise.lnk~rf11c8e9.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\1c enterprise 8\1c enterprise.lnk~rf11c957.tmp
%WINDIR%\installer\1156c7.mst

Moves the following files

from C:\users\public\desktop\1c enterprise.lnk to C:\users\public\desktop\1c enterprise.lnk~rf11c8e9.tmp
from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\1c enterprise 8\1c enterprise.lnk to %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\1c enterprise 8\1c enterprise.lnk~rf11c957.tmp

Substitutes the following files

C:\users\public\desktop\1c enterprise.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\1c enterprise 8\1c enterprise.lnk

Network activity

Connects to

'microsoft.com':80

UDP

DNS ASK microsoft.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%TEMP%\1c 8.3.9.1850\setup.exe' /s

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial