Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MAAgent' = '%PROGRAM_FILES%\MarkAny\ContentSAFER\MAAgent.exe'
- [<HKLM>\SOFTWARE\Classes\MarkAny ContentSAFER Client\Shell\Open\Command] '' = '"%PROGRAM_FILES%\MarkAny\ContentSAFER\MaCSMgr.exe" "%1"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{88485281-8b4b-4f8d-9ede-82e29a064277}' = 'MarkAny Contents Safer Manager 1.0'
Вредоносные функции:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
- '%PROGRAM_FILES%\MarkAny\ContentSAFER\MAAgent.exe'
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%TEMP%\pft3~tmp\Disk1\Setup.exe' -s
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\MarkAny\ContentSAFER\Mess255b.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MPXB25aa.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTDE26f2.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MtpA24a0.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\XSYN24cf.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\FE25251d.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS279e.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS27cc.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS27fb.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTTC2711.rra
- <SYSTEM32>\MTTE274f.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTTE277e.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\musi2481.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCS206a.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCS2099.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\maps20d7.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MACL1f51.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MACL1fae.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\mapw203b.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MaUp222f.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAFi226d.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUp2423.rra
- <SYSTEM32>\MASe2154.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUp2193.rra
- <SYSTEM32>\MAUp21b2.rra
- <SYSTEM32>\PDIN2d6a.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MACS2ed1.rra
- %WINDIR%\MASe2f2f.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MPXB2c22.rra
- <SYSTEM32>\MSCL2c9f.rra
- <SYSTEM32>\MSFL2d0c.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaSy3317.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaWA3356.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaWM33b3.rra
- <SYSTEM32>\MTXS2fac.rra
- <SYSTEM32>\msvc30a6.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\Data\mark322d.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\T7302a8c.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS28c6.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS28f5.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS2934.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS282a.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS2869.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS2898.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXU29ef.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\TCC72a1e.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\USBC2a4d.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS2963.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS2992.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS29b1.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objef071.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iusef10d.rra
- %CommonProgramFiles%\InstallShield\IScript\iscrf487.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\coreed25.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctoreda2.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssv33d.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\valu3f9.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssv427.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\setu1e5.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\info2d0.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\lice2ff.rra
- %TEMP%\IEC4.tmp
- %TEMP%\pft3~tmp\Disk1\data1.cab
- %TEMP%\pft3~tmp\Disk1\data1.hdr
- %TEMP%\pft3~tmp\Disk1\data2.cab
- %TEMP%\ext2.tmp
- %TEMP%\plf1.tmp
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\pft3~tmp\Disk1\Setup.ini
- %TEMP%\pft3~tmp\Disk1\setup.inx
- %TEMP%\pft3~tmp\Disk1\setup.iss
- %TEMP%\pft3~tmp\Disk1\ikernel.ex_
- %TEMP%\pft3~tmp\Disk1\layout.bin
- %TEMP%\pft3~tmp\Disk1\Setup.exe
- <SYSTEM32>\MaJU1bb7.rra
- <SYSTEM32>\MaXM1c05.rra
- <SYSTEM32>\MPXB1c43.rra
- <SYSTEM32>\MK_L1adc.rra
- <SYSTEM32>\MACX1b2a.rra
- <SYSTEM32>\MaJG1b78.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAu1ea5.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAWe1ef3.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAg1f22.rra
- <SYSTEM32>\MAMA1c72.rra
- <SYSTEM32>\MaDR1cef.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\User1e57.rra
- %ALLUSERSPROFILE%\Start Menu\Programs\MarkAny\ContentSAFER Client\MPXBOX.lnk
- %TEMP%\pft3~tmp\Disk1\setup.log
- %ALLUSERSPROFILE%\Start Menu\Programs\MarkAny\ContentSAFER Client\ContentSAFER Client »иБ¦.lnk
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\layo17ee.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\isrt4d3.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\defa570.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsR61b.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setu18e8.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\setu1917.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\data181d.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\data183c.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setu18a9.rra
Удаляет следующие файлы:
- %TEMP%\pft3~tmp\Disk1\data2.cab
- %TEMP%\pft3~tmp\Disk1\ikernel.ex_
- %TEMP%\pft3~tmp\Disk1\data1.hdr
- %TEMP%\plf1.tmp
- %TEMP%\pft3~tmp\Disk1\data1.cab
- %TEMP%\pft3~tmp\Disk1\layout.bin
- %TEMP%\pft3~tmp\Disk1\setup.iss
- %TEMP%\pft3~tmp\Disk1\setup.log
- %TEMP%\pft3~tmp\Disk1\setup.inx
- %TEMP%\pft3~tmp\Disk1\Setup.exe
- %TEMP%\pft3~tmp\Disk1\Setup.ini
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\setup.inx
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssver.scc
- <SYSTEM32>\msvc30a6.rra
- %TEMP%\IEC4.tmp
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsRes.dll
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\license.txt
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\infolist.txt
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\value.shl
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\default.pal
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\isrt.dll
Перемещает следующие файлы:
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS279e.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXSYNCMP1.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS27cc.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXSYNCMP2.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTTE277e.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTTELECHIP.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTTC2711.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTTCC720U.dll
- <SYSTEM32>\MTTE274f.rra в <SYSTEM32>\MTTE2740.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS2898.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXSYNCMP6.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS28c6.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXSYNCMP7.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS2869.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXSYNCMP5.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS27fb.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXSYNCMP3.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS282a.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXSYNCMP4.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\musi2481.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\musiccity@musiccity_Install.xml
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MtpA24a0.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MtpAccess.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUp2193.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUpdate.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAFi226d.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAFileUpdate.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUp2423.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUpdateBoot.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MPXB25aa.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MPXBox.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTDE26f2.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTDES.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\Mess255b.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MessageWind.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\XSYN24cf.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\XSYNCClt.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\FE25251d.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\FE250_DEVICE.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS28f5.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXSYNCMP8.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MACS2ed1.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MACSMANAGER.dll
- %WINDIR%\MASe2f2f.rra в %WINDIR%\MASetupCaller.dll
- <SYSTEM32>\PDIN2d6a.rra в <SYSTEM32>\PDINFO.xpd
- <SYSTEM32>\MSCL2c9f.rra в <SYSTEM32>\MSCLib.dll
- <SYSTEM32>\MSFL2d0c.rra в <SYSTEM32>\MSFLib.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaWA3356.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MaWAMP.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaWM33b3.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MaWMP.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaSy3317.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MaSyncP.dll
- <SYSTEM32>\MTXS2fac.rra в <SYSTEM32>\MTXSYNCICON.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\Data\mark322d.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\Data\markany.mp3
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS29b1.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXSYNCMP13.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXU29ef.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXUSB.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS2992.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXSYNCMP12.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS2934.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXSYNCMP9.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXS2963.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MTXSYNCMP11.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MPXB2c22.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MPXBox.chm
- <SYSTEM32>\MTTE2740.rra в <SYSTEM32>\MTTELECHIP.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\T7302a8c.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\T730usb.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\TCC72a1e.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\TCC730USB.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\USBC2a4d.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\USBControl.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MaUp222f.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MaUpdateClient.exe
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\defa570.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\default.pal
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsR61b.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsRes.dll
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\isrt4d3.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\isrt.dll
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\valu3f9.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\value.shl
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssv427.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssver.scc
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setu18a9.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setup.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setu18e8.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\data183c.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\data1.cab
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\layo17ee.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\layout.bin
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\data181d.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\data1.hdr
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objef071.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iusef10d.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctoreda2.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\coreed25.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\lice2ff.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\license.txt
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssv33d.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssver.scc
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\info2d0.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\infolist.txt
- %CommonProgramFiles%\InstallShield\IScript\iscrf487.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\setu1e5.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\setup.inx
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\setu1917.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\setup.inx
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MACL1fae.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MACLICX13.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\mapw203b.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\mapwij10.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MACL1f51.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MACLICX15.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAWe1ef3.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MAWebControl.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAg1f22.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAgent.exe
- <SYSTEM32>\MASe2154.rra в <SYSTEM32>\MASetupCleaner.exe
- <SYSTEM32>\MAUp21b2.rra в <SYSTEM32>\MAUpdate.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\maps20d7.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\mapshapi.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCS206a.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCSMgr.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCS2099.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCSProHook.dll
- <SYSTEM32>\MaJU1bb7.rra в <SYSTEM32>\MaJUtilLib.dll
- <SYSTEM32>\MaXM1c05.rra в <SYSTEM32>\MaXMLProto.dll
- <SYSTEM32>\MaJG1b78.rra в <SYSTEM32>\MaJGUILib.dll
- <SYSTEM32>\MK_L1adc.rra в <SYSTEM32>\MK_Lyric.dll
- <SYSTEM32>\MACX1b2a.rra в <SYSTEM32>\MACXMLProto.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\User1e57.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UserShare.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAu1ea5.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAuthProc.dll
- <SYSTEM32>\MaDR1cef.rra в <SYSTEM32>\MaDRM.dll
- <SYSTEM32>\MPXB1c43.rra в <SYSTEM32>\MPXBox.ico
- <SYSTEM32>\MAMA1c72.rra в <SYSTEM32>\MAMACExtract.dll
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'MaAgent_{9E8B0CC0-AACD-4a03-812B-CB4C6D215209}'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
