Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\WebFontManager.lnk
Вредоносные функции:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
- '%PROGRAM_FILES%\WebFontManager\WebFontManager.exe'
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%TEMP%\pft3~tmp\Disk1\Setup.exe'
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\_IsRe98b.rra
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\defae90e.rra
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\isrte891.rra
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\valufd23.rra
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\setufc38.rra
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\_IsRfb3e.rra
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\valuda68.rra
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\_IsRd73b.rra
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\defad661.rra
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\defad632.rra
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\valuda39.rra
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\setud92f.rra
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\_IsRd7c8.rra
- %PROGRAM_FILES%\WebFontManager\Fonts\IsiW2d0c.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\Setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\setu2bd4.rra
- <SYSTEM32>\VB5D3190.rra
- %PROGRAM_FILES%\WebFontManager\WebF30c5.rra
- %WINDIR%\Webbin\stdi2d5a.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\Setu2ba5.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\layo2a8c.rra
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\_IsRdfb.rra
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\valufd61.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\Setu2b76.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\data2af9.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\data2aba.rra
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\isrtd5b5.rra
- %TEMP%\pft3~tmp\Disk1\layout.bin
- %TEMP%\pft3~tmp\Disk1\ikernel.ex_
- %TEMP%\pft3~tmp\Disk1\data2.cab
- %TEMP%\pft3~tmp\Disk1\setup.inx
- %TEMP%\pft3~tmp\Disk1\Setup.ini
- %TEMP%\pft3~tmp\Disk1\Setup.exe
- %TEMP%\pft3~tmp\Disk1\data1.hdr
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\plf1.tmp
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\Disk1\data1.cab
- %TEMP%\pft3~tmp\Disk1\Control.ico
- %TEMP%\pft3~tmp\Disk1\Autorun.inf
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\INFOd3ff.rra
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\setud382.rra
- %CommonProgramFiles%\InstallShield\IScript\iscrc857.rra
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\isrtd519.rra
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\valud49c.rra
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\LICEd41f.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iusec4fc.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
- %TEMP%\IEC4.tmp
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objec46f.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctorc20e.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corec1b0.rra
Удаляет следующие файлы:
- %TEMP%\plf1.tmp
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\setup.inx
- %TEMP%\pft3~tmp\Disk1\Control.ico
- %TEMP%\pft3~tmp\Disk1\Autorun.inf
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\INFOLIST.TXT
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\LICENSE.TXT
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\setup.inx
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\setup.inx
- %TEMP%\pft3~tmp\Disk1\Setup.exe
- %TEMP%\pft3~tmp\Disk1\layout.bin
- %TEMP%\pft3~tmp\Disk1\setup.inx
- %TEMP%\pft3~tmp\Disk1\Setup.ini
- %TEMP%\pft3~tmp\Disk1\data1.hdr
- %TEMP%\pft3~tmp\Disk1\data1.cab
- %TEMP%\pft3~tmp\Disk1\ikernel.ex_
- %TEMP%\pft3~tmp\Disk1\data2.cab
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\value.shl
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\valufd13.rra
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\_IsRes.dll
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\_IsRes.dll
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\_IsRes.dll
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\ext2.tmp
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\valuda29.rra
- %TEMP%\IEC4.tmp
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\isrt.dll
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\default.pal
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\value.shl
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\value.shl
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\isrt.dll
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\default.pal
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\isrt.dll
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\default.pal
Перемещает следующие файлы:
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\_IsRdfb.rra в %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\_IsRes.dll
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\defad632.rra в %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\default.pal
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\layo2a8c.rra в %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\layout.bin
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\_IsRd72c.rra в %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\_IsRes.dll
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\isrtd519.rra в %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\isrt.dll
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\setufc38.rra в %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\setup.inx
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\_IsRfb3e.rra в %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\_IsRes.dll
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\valufd61.rra в %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\value.shl
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\valufd23.rra в %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\valufd13.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\data2aba.rra в %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\data1.hdr
- %PROGRAM_FILES%\WebFontManager\WebF30c5.rra в %PROGRAM_FILES%\WebFontManager\WebFontManager.exe
- %WINDIR%\Webbin\stdi2d5a.rra в %WINDIR%\Webbin\stdisiaio.dll
- %TEMP%\bc70.rra в %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\setup.ilg
- <SYSTEM32>\VB5D3190.rra в <SYSTEM32>\VB5DB.DLL
- %PROGRAM_FILES%\WebFontManager\Fonts\IsiW2d0c.rra в %PROGRAM_FILES%\WebFontManager\Fonts\IsiWMalithi.ttf
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\Setu2b76.rra в %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\Setup.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\data2af9.rra в %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\data1.cab
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\setu2bd4.rra в %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\setup.inx
- %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\Setu2ba5.rra в %PROGRAM_FILES%\InstallShield Installation Information\{0BDF6341-C29E-402B-8214-03C5DAF45006}\Setup.ini
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\_IsRe98b.rra в %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\_IsRes.dll
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\setud382.rra в %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\setup.inx
- %CommonProgramFiles%\InstallShield\IScript\iscrc857.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\LICEd41f.rra в %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\LICENSE.TXT
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\INFOd3ff.rra в %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\INFOLIST.TXT
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iusec4fc.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corec1b0.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objec46f.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctorc20e.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\valud49c.rra в %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\value.shl
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\valuda68.rra в %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\value.shl
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\valuda39.rra в %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\valuda29.rra
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\defae90e.rra в %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\default.pal
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\isrte891.rra в %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\isrt.dll
- %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\setud92f.rra в %TEMP%\{592bb081-af9b-4c5e-b1c2-c30b98916f83}\setup.inx
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\defad661.rra в %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\default.pal
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\isrtd5b5.rra в %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\isrt.dll
- %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\_IsRd7c8.rra в %TEMP%\{0bdf6341-c29e-402b-8214-03c5daf45006}\_IsRes.dll
- %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\_IsRd73b.rra в %TEMP%\{c61304ad-1401-4ffe-a22e-c5754f1cc577}\_IsRd72c.rra
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'IsiWebFontManager'
- ClassName: 'Shell_TrayWnd' WindowName: ''
