Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\Classes\PROTOCOLS\Handler\touchenex] 'CLSID' = '{df95e974-a757-11ed-a31f-000c2936bd4f}'
- [\REGISTRY\USER\S-1-5-21-1238866942-1249195528-555854008-1000\Software\Microsoft\Windows\CurrentVersion\Run] 'CrossEXService' = 'C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.ex...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'CrossEXService' = 'C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe'
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\CrossEX Live Checker] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\CrossEX Live Checker] 'ImagePath' = '"C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe"'
Создает следующие сервисы
- 'CrossEX Live Checker' "C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe"
Изменения в файловой системе
Создает следующие файлы
- D:\windows\system32\config\software.log1
- D:\users\user\appdata\local\temp\ffcert_raon\bin\msvcr100.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\libplds4.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\libplc4.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\libnspr4.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\freebl3.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\certutil.exe
- D:\users\user\appdata\local\temp\ffcert_raon\firefox_certutil.exe
- D:\system volume information\syscache.hve
- D:\system volume information\syscache.hve.log1
- D:\windows\system32\config\system
- D:\windows\system32\config\system.log1
- D:\users\user\appdata\local\temp\nsn4e30.tmp\nsexec.dll
- D:\users\user\appdata\local\temp\nsn4e30.tmp\system.dll
- D:\program files (x86)\iniline\crossex\crossex\rootca.crt
- D:\program files (x86)\iniline\crossex\crossex\crossexservice.exe.sig
- D:\program files (x86)\iniline\crossex\crossex\crossexservice.exe
- D:\program files (x86)\iniline\crossex\crossex\obcrossexservice.exe
- D:\program files (x86)\iniline\crossex\crossex\uninstallcrossexlocal.exe
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\temp\nsx48a4.tmp\system.dll
- D:\program files (x86)\raonsecure\bridge\crossex\touchenex\uninstallcrossex.exe
- D:\program files (x86)\raonsecure\bridge\crossex\touchenex\1.0.1.1545\kr.co.raon.touchenex.firefox.json
- D:\program files (x86)\raonsecure\bridge\crossex\touchenex\1.0.1.1545\kr.co.raon.touchenex.json
- D:\program files (x86)\raonsecure\bridge\crossex\touchenex\1.0.1.1545\crossex.sig
- D:\users\user\appdata\local\temp\ffcert_raon\bin\nss3.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\nssdbm3.dll
- D:\windows\system32\winevt\logs\application.evtx
- D:\users\user\appdata\local\temp\ffcert_raon\bin\nssutil3.dll
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\config\default
- D:\windows\system32\config\default.log1
- D:\program files (x86)\raonsecure\keysharp nxwireless cert\kscertrelaymain.dll
- D:\users\user\appdata\local\temp\etilqs_pdaoyq3yjlt4twnz21c0
- D:\users\user\appdata\local\temp\etilqs_jfokjmll1gvpxaig1iyx
- D:\users\user\appdata\local\temp\etilqs_x5canlc7oqdzlekokvrh
- D:\users\user\appdata\local\temp\etilqs_lrp09dqruavx2otib6zc
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db
- D:\users\user\appdata\local\temp\etilqs_lndiu4cfagap17ut5dcm
- D:\users\user\appdata\local\temp\etilqs_0xoyycqdxcqzce6buqi6
- D:\users\user\appdata\local\temp\etilqs_2kokqvvyih8bjd9l61ay
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db-journal
- D:\users\user\appdata\local\temp\etilqs_rkag670grxydmstfbjsi
- D:\users\user\appdata\local\temp\etilqs_8tzl9lqpgqg9l2cebg05
- D:\users\user\appdata\local\temp\etilqs_uaeeocpduqohbgka8zjo
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db-journal
- D:\users\user\appdata\local\temp\ffcert_raon\bin\ssl3.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\sqlite3.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\softokn3.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\smime3.dll
- D:\program files (x86)\raonsecure\bridge\crossex\touchenex\1.0.1.1545\npraontouchenex.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\nssckbi.dll
- D:\program files (x86)\raonsecure\bridge\crossex\touchenex\1.0.1.1545\crossexfirefox.dll
- D:\program files (x86)\keysharp\certutil.exe
- D:\program files (x86)\keysharp\ca.der
- D:\program files (x86)\keysharp\qrcodeencodedll.dll
- D:\program files (x86)\keysharp\keysharpcrypto.dll
- D:\program files (x86)\keysharp\setupprogram.exe
- D:\program files (x86)\keysharp\kscertrelayqr.exe
- D:\program files (x86)\keysharp\touchenkeycs.dll
- D:\program files (x86)\keysharp\cksetup32.exe
- D:\program files (x86)\keysharp\kscrc2activex.dll
- D:\program files (x86)\keysharp\kscertrelay.exe
- D:\program files (x86)\raonsecure\keysharp nxwireless cert\crossexclient_32.sig
- D:\program files (x86)\raonsecure\keysharp nxwireless cert\ffcert.exe
- D:\program files (x86)\raonsecure\keysharp nxwireless cert\crossex_localservice_install.exe
- D:\program files (x86)\raonsecure\keysharp nxwireless cert\raon_touchenex_install.exe
- D:\program files (x86)\raonsecure\keysharp nxwireless cert\kscertrelay_installer_32bit.exe
- D:\windows\appcompat\programs\recentfilecache.bcf
- D:\program files (x86)\keysharp\ffcert.exe
- D:\program files (x86)\keysharp\crossex_localservice_install.exe
- D:\program files (x86)\keysharp\kscertrelay_nxinstaller.exe
- D:\program files (x86)\keysharp\raon_touchenex_install.exe
- D:\users\user\ntuser.dat
- D:\program files (x86)\keysharp\kscertrelay_installer_32bit.exe
- D:\users\user\ntuser.dat.log1
- D:\program files (x86)\keysharp\kscertrelaymain.dll
- D:\program files (x86)\keysharp\crossexclient_32.sig
- D:\windows\system32\config\software
- D:\program files (x86)\keysharp\certadm.dll
- D:\program files (x86)\keysharp\npkscertrelay.dll
- D:\program files (x86)\raonsecure\bridge\crossex\touchenex\1.0.1.1545\crossexprotocol.dll
- D:\program files (x86)\keysharp\crc2string_eng.dll
- D:\program files (x86)\raonsecure\bridge\crossex\touchenex\1.0.1.1545\digicert_root_g4.cer
- D:\program files (x86)\keysharp\kscertrelay\kscertrelaydll.dll
- D:\program files (x86)\keysharp\kscertrelay\crc2string_kor.dll
- D:\program files (x86)\keysharp\kscertrelay\crc2string_eng.dll
- D:\program files (x86)\keysharp\kscertrelay\npkscertrelay.dll
- D:\program files (x86)\keysharp\kscertrelay\certutil.exe
- D:\program files (x86)\keysharp\kscertrelay\certadm.dll
- D:\program files (x86)\keysharp\kscertrelay\ca.der
- D:\program files (x86)\keysharp\kscertrelay\qrcodeencodedll.dll
- D:\program files (x86)\keysharp\kscertrelay\kscertrelayqr.exe
- D:\program files (x86)\keysharp\kscertrelay\keysharpcrypto.dll
- D:\program files (x86)\keysharp\kscertrelay\touchenkeycs.dll
- D:\program files (x86)\keysharp\kscertrelay\cksetup32.exe
- D:\program files (x86)\keysharp\kscertrelay\setupprogram.exe
- D:\program files (x86)\keysharp\kscertrelay\kscrc2activex.dll
- D:\program files (x86)\keysharp\kscertrelay\kscertrelay.exe
- D:\program files (x86)\keysharp\_rca_digicert_root_g4.cer
- D:\program files (x86)\keysharp\_rca_digicert_root.cer
- D:\program files (x86)\keysharp\_rca_verisign_root.cer
- D:\program files (x86)\keysharp\_rca_verisign_class.cer
- D:\program files (x86)\keysharp\_rca_thawte_time.cer
- D:\program files (x86)\keysharp\_rca_thawte_root.cer
- D:\program files (x86)\keysharp\_rca_globalsign_root.cer
- D:\program files (x86)\keysharp\kscertrelaydll.dll
- D:\program files (x86)\keysharp\crc2string_kor.dll
- D:\program files (x86)\raonsecure\bridge\crossex\touchenex\1.0.1.1545\crossexchrome.exe
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
Удаляет следующие файлы
- D:\program files (x86)\keysharp\kscertrelay\ca.der
- D:\users\user\appdata\local\temp\nsn4e30.tmp\nsexec.dll
- D:\users\user\appdata\local\temp\nsn4e30.tmp\system.dll
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db-journal
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db-journal
- D:\users\user\appdata\local\temp\ffcert_raon\bin\certutil.exe
- D:\users\user\appdata\local\temp\ffcert_raon\bin\freebl3.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\libnspr4.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\libplc4.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\libplds4.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\msvcr100.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\nssckbi.dll
- D:\program files (x86)\raonsecure\keysharp nxwireless cert\crossexclient_32.sig
- D:\users\user\appdata\local\temp\ffcert_raon\bin\nssdbm3.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\nssutil3.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\smime3.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\softokn3.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\sqlite3.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\ssl3.dll
- D:\users\user\appdata\local\temp\ffcert_raon\firefox_certutil.exe
- D:\program files (x86)\raonsecure\keysharp nxwireless cert\raon_touchenex_install.exe
- D:\program files (x86)\raonsecure\keysharp nxwireless cert\kscertrelay_installer_32bit.exe
- D:\program files (x86)\raonsecure\keysharp nxwireless cert\crossex_localservice_install.exe
- D:\users\user\appdata\local\temp\nsx48a4.tmp\system.dll
- D:\users\user\appdata\local\temp\ffcert_raon\bin\nss3.dll
- D:\program files (x86)\raonsecure\bridge\crossex\touchenex\1.0.1.1545\digicert_root_g4.cer
- D:\program files (x86)\keysharp\ca.der
- D:\program files (x86)\keysharp\kscertrelay\certutil.exe
- D:\program files (x86)\keysharp\kscertrelay\certadm.dll
- D:\program files (x86)\keysharp\kscertrelay.exe
- D:\program files (x86)\keysharp\kscrc2activex.dll
- D:\program files (x86)\keysharp\cksetup32.exe
- D:\program files (x86)\keysharp\touchenkeycs.dll
- D:\program files (x86)\keysharp\kscertrelayqr.exe
- D:\program files (x86)\keysharp\setupprogram.exe
- D:\program files (x86)\keysharp\keysharpcrypto.dll
- D:\program files (x86)\keysharp\qrcodeencodedll.dll
- D:\program files (x86)\keysharp\certadm.dll
- D:\program files (x86)\keysharp\_rca_digicert_root.cer
- D:\program files (x86)\keysharp\certutil.exe
- D:\program files (x86)\keysharp\npkscertrelay.dll
- D:\program files (x86)\keysharp\crc2string_eng.dll
- D:\program files (x86)\keysharp\crc2string_kor.dll
- D:\program files (x86)\keysharp\kscertrelaydll.dll
- D:\program files (x86)\keysharp\_rca_globalsign_root.cer
- D:\program files (x86)\keysharp\_rca_thawte_root.cer
- D:\program files (x86)\keysharp\_rca_thawte_time.cer
- D:\program files (x86)\keysharp\_rca_verisign_class.cer
- D:\program files (x86)\keysharp\_rca_verisign_root.cer
- D:\program files (x86)\keysharp\_rca_digicert_root_g4.cer
- D:\program files (x86)\raonsecure\keysharp nxwireless cert\ffcert.exe
Подменяет следующие файлы
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db-journal
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db-journal
Сетевая активность
TCP
Другие
- 'localhost':49158
- '34.##1.73.144':443
Другое
Добавляет корневой сертификат
Ищет следующие окна
- ClassName: 'SystemTray_Main' WindowName: ''
Создает и запускает на исполнение
- 'D:\program files (x86)\keysharp\kscertrelay_nxinstaller.exe' -i c"
- 'D:\program files (x86)\raonsecure\keysharp nxwireless cert\kscertrelay_installer_32bit.exe' /s
- 'D:\program files (x86)\keysharp\setupprogram.exe' -i c u
- 'D:\program files (x86)\raonsecure\keysharp nxwireless cert\raon_touchenex_install.exe' /S
- 'D:\program files (x86)\raonsecure\keysharp nxwireless cert\crossex_localservice_install.exe' /S
- 'D:\program files (x86)\iniline\crossex\crossex\crossexservice.exe'
- 'D:\program files (x86)\iniline\crossex\crossex\obcrossexservice.exe'
- 'D:\program files (x86)\raonsecure\keysharp nxwireless cert\ffcert.exe' -title="nxKeySharp CertRelay" -noces
- 'D:\users\user\appdata\local\temp\ffcert_raon\firefox_certutil.exe' "C:\Program Files (x86)\Raonsecure\KeySharp nxWireless Cert\FFCert.exe" -title="nxKeySharp CertRelay" -noces
- 'D:\users\user\appdata\local\temp\ffcert_raon\bin\certutil.exe' -A -d sql:"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0j9e9tku.default-release" -i "C:\Program Files (X86)\iniLINE\CrossEX\crossex\rootCA.crt" -n "iniLINE CrossEX RootCA2" -t "CT,C,...
- 'D:\users\user\appdata\local\temp\ffcert_raon\bin\certutil.exe' -L -d sql:"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0j9e9tku.default-release"
- 'D:\windows\syswow64\sc.exe' create "CrossEX Live Checker" binpath= "\"C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe\"" start= auto' (со скрытым окном)
- 'D:\windows\syswow64\sc.exe' description "CrossEX Live Checker" "checking live status of CrossEXService"' (со скрытым окном)
- 'D:\windows\syswow64\sc.exe' start "CrossEX Live Checker"' (со скрытым окном)
