Technical Information
Modifies file system:
Creates the following files:
- %TEMP%\nsc2.tmp\UserInfo.dll
- %HOMEPATH%\My Documents\__MACOSX\help\doc\._js.md
- %HOMEPATH%\My Documents\__MACOSX\help\._doc
- %HOMEPATH%\My Documents\help\robots.txt
- %HOMEPATH%\My Documents\__MACOSX\help\._robots.txt
- %HOMEPATH%\My Documents\help\fonts\roboto.css
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\._roboto.css
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._RobotoCondensed-Bold-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._Roboto-BoldItalic-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\RobotoCondensed-Light-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._RobotoCondensed-Light-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\Roboto-MediumItalic-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._Roboto-MediumItalic-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\RobotoCondensed-LightItalic-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._RobotoCondensed-LightItalic-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\RobotoCondensed-Bold-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\Roboto-BoldItalic-webfont.woff
- %HOMEPATH%\My Documents\help\doc\html.md
- %HOMEPATH%\My Documents\__MACOSX\help\doc\._extend.md
- %HOMEPATH%\My Documents\help\doc\extend.md
- %HOMEPATH%\My Documents\__MACOSX\help\doc\._misc.md
- %HOMEPATH%\My Documents\help\doc\misc.md
- %HOMEPATH%\My Documents\__MACOSX\help\doc\._TOC.md
- %HOMEPATH%\My Documents\help\doc\TOC.md
- %HOMEPATH%\My Documents\__MACOSX\help\doc\._faq.md
- %HOMEPATH%\My Documents\help\doc\faq.md
- %HOMEPATH%\My Documents\__MACOSX\help\doc\._usage.md
- %HOMEPATH%\My Documents\help\doc\usage.md
- %HOMEPATH%\My Documents\__MACOSX\help\doc\._css.md
- %HOMEPATH%\My Documents\help\doc\css.md
- %HOMEPATH%\My Documents\__MACOSX\help\._.gitattributes
- %HOMEPATH%\My Documents\help\doc\js.md
- %HOMEPATH%\My Documents\help\js\plugins.js
- %HOMEPATH%\My Documents\help\fonts\Roboto\Roboto-Thin-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\._help
- %HOMEPATH%\My Documents\help\fonts\Roboto\Roboto-Italic-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._Roboto-Italic-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\Roboto-LightItalic-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._Roboto-LightItalic-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\Roboto-Medium-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._Roboto-Medium-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._Roboto-BlackItalic-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._Roboto-Thin-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\._Roboto
- %HOMEPATH%\My Documents\__MACOSX\help\._fonts
- %HOMEPATH%\My Documents\help\browserconfig.xml
- %HOMEPATH%\My Documents\__MACOSX\help\._browserconfig.xml
- %HOMEPATH%\My Documents\help\.htaccess
- %HOMEPATH%\My Documents\__MACOSX\help\._.htaccess
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._RobotoCondensed-BoldItalic-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\RobotoCondensed-BoldItalic-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\Roboto-Black-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._Roboto-Regular-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._Roboto-ThinItalic-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\Roboto-ThinItalic-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._RobotoCondensed-Italic-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\RobotoCondensed-Italic-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._RobotoCondensed-Regular-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\doc\._html.md
- %HOMEPATH%\My Documents\help\fonts\Roboto\RobotoCondensed-Regular-webfont.woff
- %HOMEPATH%\My Documents\help\.gitattributes
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._Roboto-Bold-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\Roboto-Bold-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._Roboto-Light-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\Roboto-Light-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\fonts\Roboto\._Roboto-Black-webfont.woff
- %HOMEPATH%\My Documents\help\fonts\Roboto\Roboto-Regular-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\._.gitignore
- %HOMEPATH%\My Documents\help\.gitignore
- %HOMEPATH%\My Documents\__MACOSX\help\._img
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- %TEMP%\band\help.zip
- %WINDIR%\Installer\1fba5.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %ALLUSERSPROFILE%\Application Data\Package Cache\{37ea5771-3352-4a52-9fac-9297331daebd}\RDPWInst.exe
- C:\Config.Msi\1fba4.rbs
- %WINDIR%\Installer\MSI3.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %WINDIR%\Installer\1fba3.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- %ALLUSERSPROFILE%\Desktop\Help.lnk
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\1fba1.msi
- %TEMP%\band\RDPWInst-v1.6.2.msi
- %HOMEPATH%\My Documents\help\favicon.ico
- %HOMEPATH%\My Documents\help\fonts\Roboto\Roboto-BlackItalic-webfont.woff
- %HOMEPATH%\My Documents\__MACOSX\help\._favicon.ico
- %HOMEPATH%\My Documents\__MACOSX\help\js\vendor\._modernizr-3.5.0.min.js
- %HOMEPATH%\My Documents\__MACOSX\help\img\._ss1.png
- %HOMEPATH%\My Documents\__MACOSX\help\._404.html
- %HOMEPATH%\My Documents\help\.editorconfig
- %HOMEPATH%\My Documents\__MACOSX\help\._.editorconfig
- %HOMEPATH%\My Documents\help\img\.DS_Store
- %HOMEPATH%\My Documents\__MACOSX\help\img\._.DS_Store
- %HOMEPATH%\My Documents\help\img\ss1.png
- %HOMEPATH%\My Documents\help\img\ss2.png
- %TEMP%\nsc2.tmp\nsisunz.dll
- %HOMEPATH%\My Documents\__MACOSX\help\img\._ss2.png
- %HOMEPATH%\My Documents\help\img\ss3.png
- %HOMEPATH%\My Documents\__MACOSX\help\img\._ss3.png
- %HOMEPATH%\My Documents\__MACOSX\help\img\._.gitignore
- %HOMEPATH%\My Documents\help\img\logo.png
- %HOMEPATH%\My Documents\__MACOSX\help\img\._logo.png
- %HOMEPATH%\My Documents\help\404.html
- %HOMEPATH%\My Documents\__MACOSX\help\._js
- %HOMEPATH%\My Documents\help\js\vendor\modernizr-3.5.0.min.js
- %HOMEPATH%\My Documents\__MACOSX\help\js\vendor\._jquery-3.2.1.min.js
- %HOMEPATH%\My Documents\help\js\vendor\jquery-3.2.1.min.js
- %HOMEPATH%\My Documents\__MACOSX\help\js\._main.js
- %HOMEPATH%\My Documents\__MACOSX\help\js\._plugins.js
- %HOMEPATH%\My Documents\__MACOSX\help\._css
- %HOMEPATH%\My Documents\__MACOSX\help\._index.html
- %HOMEPATH%\My Documents\help\index.html
- %HOMEPATH%\My Documents\help\css\normalize.css
- %HOMEPATH%\My Documents\__MACOSX\help\css\._main.css
- %HOMEPATH%\My Documents\help\css\main.css
- %HOMEPATH%\My Documents\__MACOSX\help\._.DS_Store
- %HOMEPATH%\My Documents\help\.DS_Store
- %HOMEPATH%\My Documents\__MACOSX\help\js\._vendor
- %HOMEPATH%\My Documents\__MACOSX\help\css\._normalize.css
- %ALLUSERSPROFILE%\Desktop\Open This.lnk
Deletes the following files:
- %WINDIR%\Installer\MSI3.tmp
- C:\Config.Msi\1fba4.rbs
- %WINDIR%\Installer\1fba1.msi
- %WINDIR%\Installer\1fba3.ipi
Network activity:
Connects to:
- 'localhost':1036
- 'bu###emark.com':80
TCP:
HTTP GET requests:
- http://bu###emark.com/silverlight2.html
UDP:
- DNS ASK bu###emark.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%ALLUSERSPROFILE%\Application Data\Package Cache\{37ea5771-3352-4a52-9fac-9297331daebd}\RDPWInst.exe' -i -o
Executes the following:
- '<SYSTEM32>\msiexec.exe' /package "%TEMP%\band\RDPWinst-v1.6.2.msi" /passive /norestart
- '<SYSTEM32>\msiexec.exe' /V
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' "http://bu###emark.com/silverlight2.html"
