Trojan.Siggen22.60651

Technical Information

Modifies file system

Creates the following files

%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\setf3d0.tmp
%WINDIR%\installer\{370c1839-b7d8-425e-8d3f-c79638e7d09c}\arpproducticon.exe
%CommonProgramFiles(x86)%\nokia\fuse\drivers\winusb\nokiacareconnectivity.cat
%CommonProgramFiles(x86)%\nokia\fuse\drivers\nokia.cer
%CommonProgramFiles(x86)%\nokia\fuse\drivers\winusb\amd64\winusbcoinstaller2.dll
%CommonProgramFiles(x86)%\nokia\fuse\drivers\winusb\amd64\wdfcoinstaller01009.dll
%CommonProgramFiles(x86)%\nokia\fuse\drivers\winusb\nokiacareconnectivity.inf
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftbusui.dll
%TEMP%\_ir_sf_temp_0\dpinst64.exe
%TEMP%\_ir_sf_temp_0\dpinst.exe
%TEMP%\_ir_sf_temp_0\winusb\winusb_drivers_x86.msi
%TEMP%\_ir_sf_temp_0\winusb\winusb_drivers_x64.msi
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x86\wudfusbcciddriver.inf
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x86\wudfusbcciddriver.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x86\wudfusbcciddriver.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x86\wudfupdate_01007.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x86\winusbcoinstaller.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x86\wdfcoinstaller01007.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x64\wudfusbcciddriver.inf
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x64\wudfusbcciddriver.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x64\wudfusbcciddriver.cat
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\setf46d.tmp
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\setf672.tmp
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set6ab9.tmp
<DRIVERSTORE>\filerepository\nokiacareconnectivity.inf_amd64_neutral_b90cf77d98215f84\nokiacareconnectivity.pnf
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set69ed.tmp
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set6950.tmp
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set68a3.tmp
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set67d7.tmp
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set670c.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\set442c.tmp
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\set437f.tmp
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\set4294.tmp
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\set41e8.tmp
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\set414b.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\i386\set22e1.tmp
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\set2235.tmp
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\set21a7.tmp
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set208d.tmp
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set1fd1.tmp
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set1f25.tmp
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set1e88.tmp
%WINDIR%\dpinst.log
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x64\wudfupdate_01007.dll
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\setf5c5.tmp
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x64\winusbcoinstaller.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdibus.inf
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftd2xx.h
%TEMP%\_ir_sf_temp_0\ftdi-driver\static\i386\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\ftdi-driver\static\amd64\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftserui2.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftser2k.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftlang.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftdibus.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftd2xx.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftcserco.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftbusui.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftserui2.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftser2k.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftlang.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftdibus.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftd2xx64.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftcserco.dll
%TEMP%\_ir_sf_temp_0\chimera.ico
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\lua5.1.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdibus.cat
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdiport.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\raakcrdmx.inf
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdiport.inf
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\raakcrdmx.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\raakcrdmx.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\raakcrdm.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\win10\raakcrdmx.inf
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\win10\raakcrdmx.dll
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\win10\raakcrdmx.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\win10\raakcrdm.dll
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\usbccid.sys
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\usbccid.inf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\usbccid.cat
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\x86\gemccid.sys
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\x86\gemccid.pnf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\x86\gemccid.inf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win8\x86\cm_x86.cat
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\usbccid.sys
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\usbccid.inf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\usbccid.cat
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\gemccid.sys
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\gemccid.pnf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\gemccid.inf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\cm_x86.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_reader_x64\wdfcoinstaller01007.dll
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem5.cat

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem5.cat

Deletes the following files

%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftserui2.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftd2xx.h
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdibus.cat
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdibus.inf
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdiport.cat
%TEMP%\_ir_sf_temp_0\ftdi-driver\ftdiport.inf
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftbusui.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftcserco.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftd2xx.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftdibus.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftlang.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftser2k.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftlang.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\static\amd64\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\ftdi-driver\static\i386\ftd2xx.lib
%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\usbccid.cat
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\usbccid.inf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\usbccid.sys
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\cm_x86.cat
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\gemccid.inf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\gemccid.pnf
%TEMP%\_ir_sf_temp_0\smartcard\reader_win10\x86\gemccid.sys
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\raakcrdm.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftser2k.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\i386\ftserui2.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftdibus.sys
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftd2xx64.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftd2xx.lib
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\winusbcoinstaller2.dll
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\nokiacareconnectivity.cat
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\nokiacareconnectivity.inf
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftbusui.dll
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftd2xx64.dll
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftdibus.sys
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftlang.dll
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\ftdibus.cat
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\ftdibus.inf
%TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\i386\ftd2xx.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\ftcserco.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\ftser2k.sys
%TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\wdfcoinstaller01009.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\ftserui2.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\ftdiport.inf
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wdfcoinstaller01007.dll
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\winusbcoinstaller.dll
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfupdate_01007.dll
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfusbcciddriver.cat
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfusbcciddriver.dll
%TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfusbcciddriver.inf
%TEMP%\_ir_sf_temp_0\chimera.ico
%TEMP%\_ir_sf_temp_0\dpinst.exe
%TEMP%\_ir_sf_temp_0\dpinst64.exe
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftbusui.dll
%TEMP%\_ir_sf_temp_0\ftdi-driver\amd64\ftcserco.dll
%TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\ftdiport.cat
%TEMP%\_ir_sf_temp_0\smartcard\sc_card\win10\raakcrdm.dll
%TEMP%\_ir_sf_temp_0\lua5.1.dll

Moves the following files

from %TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\setf3d0.tmp to %TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\nokiacareconnectivity.cat
from %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set6950.tmp to %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfusbcciddriver.inf
from %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set68a3.tmp to %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfusbcciddriver.dll
from %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set67d7.tmp to %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfusbcciddriver.cat
from %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set670c.tmp to %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wdfcoinstaller01007.dll
from %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\set442c.tmp to %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\ftdiport.inf
from %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\set437f.tmp to %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\ftdiport.cat
from %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\set4294.tmp to %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\ftcserco.dll
from %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\set41e8.tmp to %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\ftserui2.dll
from %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\set414b.tmp to %TEMP%\{665f9a8c-b0a6-078a-dc2b-ee3d06ed4e34}\amd64\ftser2k.sys
from %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\i386\set22e1.tmp to %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\i386\ftd2xx.dll
from %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\set2235.tmp to %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\ftdibus.inf
from %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\set21a7.tmp to %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\ftdibus.cat
from %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set208d.tmp to %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftdibus.sys
from %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set1fd1.tmp to %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftbusui.dll
from %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set1f25.tmp to %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftd2xx64.dll
from %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\set1e88.tmp to %TEMP%\{038437a3-0018-33e4-408e-171198d77a2c}\amd64\ftlang.dll
from %TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\setf672.tmp to %TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\winusbcoinstaller2.dll
from %TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\setf5c5.tmp to %TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\amd64\wdfcoinstaller01009.dll
from %TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\setf46d.tmp to %TEMP%\{09ac31ec-16eb-169c-0a24-7b6640be1454}\nokiacareconnectivity.inf
from %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set69ed.tmp to %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\winusbcoinstaller.dll
from %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\set6ab9.tmp to %TEMP%\{1df1c985-5acc-0a2d-6601-bc2ce2f0b37b}\wudfupdate_01007.dll

Miscellaneous

Creates and executes the following

'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1817634 "__IRAFN:<Full path to file>" "__IRCT:2" "__IRTSS:0" "__IRSID:S-1-5-21-3150914307-1777937420-491476919-1000"
'%WINDIR%\installer\msicee6.tmp' -add "%CommonProgramFiles(x86)%\Nokia\Fuse\drivers\nokia.cer" -c -s -r localMachine TrustedPublisher
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\FTDI-Driver" /SW /F /SA /SE /LM
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\SmartCard\SC_Reader_X64" /SW /F /SA /SE /LM
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\SmartCard\SC_Card" /SW /F /SA /SE /LM
'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\_ir_sf_temp_0\winusb\WinUSB_Drivers_x64.msi" /quiet /qn' (with hidden window)
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\FTDI-Driver" /SW /F /SA /SE /LM' (with hidden window)
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\SmartCard\SC_Reader_X64" /SW /F /SA /SE /LM' (with hidden window)
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\SmartCard\SC_Card" /SW /F /SA /SE /LM' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /D /A /C RMDIR %TEMP%\_ir_sf_temp_0 /S /Q' (with hidden window)

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\_ir_sf_temp_0\winusb\WinUSB_Drivers_x64.msi" /quiet /qn
'%WINDIR%\syswow64\cmd.exe' /D /A /C RMDIR %TEMP%\_ir_sf_temp_0 /S /Q

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial