Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' -Embedding 76F67DDCCEB6DBA5DBDCA1E9F81557B1
- '<SYSTEM32>\msiexec.exe' /Y "%ProgramFiles%\Paragon\POLARS~1.DLL"
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\TeamNotesFormEditorLibrary121.msi" /qb
- '<SYSTEM32>\msiexec.exe' /V
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1200' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1208' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1001' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1004' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2000' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '120A' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '120B' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1405' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1200' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1208' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1001' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1004' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2000' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120A' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120B' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1405' = '00000000'
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\Paragon\Documentation\Resources\StedmansMedicalDictionary.lex
- %ProgramFiles%\Paragon\Salar.Data.dll
- %ProgramFiles%\Paragon\Code128FontExternalItem.dll
- <SYSTEM32>\wisptis.exe
- %ProgramFiles%\Paragon\ComponentFactory.Krypton.Toolkit.DLL
- %ProgramFiles%\Paragon\Aspose.Pdf.DLL
- %ProgramFiles%\Paragon\Interop.SPELLCHECKERLib.dll
- %ProgramFiles%\Paragon\Nini.dll
- %ProgramFiles%\Paragon\CompliancePlusFormLibrary.dll
- %WINDIR%\assembly\tmp\PQEJTE1L\Microsoft.Ink.resources.dll
- %ProgramFiles%\Paragon\TMGDevelopment.PrintForm.DLL
- <SYSTEM32>\inked.dll
- %CommonProgramFiles%\Microsoft Shared\Ink\InkDiv.dll
- %ProgramFiles%\Paragon\ImageFileUploadHandler.dll
- %ProgramFiles%\Paragon\Salar.Configuration.dll
- %CommonProgramFiles%\Microsoft Shared\Ink\tpcps.dll
- %ProgramFiles%\Paragon\Salar.Printing.DLL
- %ProgramFiles%\Paragon\Documentation\Resources\SpellUS.lex
- %ProgramFiles%\Paragon\SalarFormEditorLibrary.dll
- %ProgramFiles%\Paragon\TMGDevelopment.Shared.dll
- %ProgramFiles%\Paragon\PolarSpellCheckerSmartTagHandler.dll
- %WINDIR%\Installer\$PatchCache$\Managed\E47C5DFC7A6380A4EBACC2751B5E0D05\12.1.0\Global_VC_CPPRT60_f0.51D569E3_8A28_11D2_B962_006097C4DE24
- %CommonProgramFiles%\Microsoft Shared\Ink\inkobj.dll
- %ProgramFiles%\Paragon\TallComponents.PDF.Rasterizer.DLL
- %ProgramFiles%\Paragon\TeamNotesFormPopup.dll
- %WINDIR%\assembly\tmp\PQEJTE1L\__AssemblyInfo__.ini
- %TEMP%\~DF32E0.tmp
- %WINDIR%\assembly\tmp\343QQJB2\__AssemblyInfo__.ini
- %WINDIR%\Installer\$PatchCache$\Managed\E47C5DFC7A6380A4EBACC2751B5E0D05\12.1.0\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24
- %WINDIR%\Installer\218c4.msi
- %ProgramFiles%\Paragon\IDAutomation.LinearBarCode.DLL
- %ProgramFiles%\Paragon\POLARS~1.DLL
- %ProgramFiles%\Paragon\CompliancePlusTypeLibrary.dll
- %ProgramFiles%\Paragon\SelectPagesFormExternalItem.dll
- %ProgramFiles%\Paragon\TallComponents.PDF.Rasterizer.dll.config
- %WINDIR%\assembly\tmp\343QQJB2\Microsoft.Ink.dll
- %ProgramFiles%\Paragon\TeamNotesFormEditor38.dll
- %ProgramFiles%\Paragon\ICSharpCode.SharpZipLib.dll
- %ProgramFiles%\Paragon\Salar.Util.DLL
- %ProgramFiles%\Paragon\AutoHIMContentHandler.dll
- %WINDIR%\Fonts\FREE3OF9.TTF
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- %WINDIR%\Installer\MSI2.tmp
- %TEMP%\CFG3.tmp
- %WINDIR%\Installer\218be.msi
- %TEMP%\aut1.tmp
- %TEMP%\TeamNotesFormEditorLibrary121.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI5.tmp
- C:\Config.Msi\218c1.rbs
- %ProgramFiles%\Paragon\Salar.Core.DLL
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %WINDIR%\Installer\MSI7.tmp
- %ProgramFiles%\Paragon\Salar.Logging.dll
- %ProgramFiles%\Paragon\TeamNotesFormEditor38.tlb
- %WINDIR%\Fonts\FRE3OF9X.TTF
- %ProgramFiles%\Paragon\Microsoft.Ink.dll
- %ProgramFiles%\Paragon\log4net.dll
- %WINDIR%\Installer\218c0.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %TEMP%\~DF9098.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\Config.Msi\218c3.rbf
- C:\Config.Msi\218c2.rbf
Удаляет следующие файлы:
- C:\Config.Msi\218c3.rbf
- C:\Config.Msi\218c2.rbf
- C:\Config.Msi\218c1.rbs
- %WINDIR%\Installer\218c0.ipi
- %WINDIR%\Installer\218be.msi
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI2.tmp
- %TEMP%\aut1.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI5.tmp
Перемещает следующие файлы:
- %ProgramFiles%\Paragon\TeamNotesFormEditor38.tlb в C:\Config.Msi\218c3.rbf
- %ProgramFiles%\Paragon\Microsoft.Ink.dll в C:\Config.Msi\218c2.rbf
Подменяет следующие файлы:
- %ProgramFiles%\Paragon\TeamNotesFormEditor38.tlb
- %ProgramFiles%\Paragon\Microsoft.Ink.dll
Другое:
Ищет следующие окна:
- ClassName: 'BUTTON' WindowName: ''
