Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\MAPDFFile\Shell\Open\Command] '' = '"%PROGRAM_FILES%\MarkAny\ContentSAFER\ePapyrus\ePapyrus Reader 2.0.exe" "%1"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MAAgent' = '%PROGRAM_FILES%\MarkAny\ContentSAFER\MAAgent.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{88485281-8b4b-4f8d-9ede-82e29a064277}' = 'MarkAny Contents Safer Manager 1.0'
- [<HKLM>\SOFTWARE\Classes\MarkAny ContentSAFER Client\Shell\Open\Command] '' = '"%PROGRAM_FILES%\MarkAny\ContentSAFER\MaCSMgr.exe" "%1"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
- '%TEMP%\pft3~tmp\Disk1\Setup.exe' -s
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\MACX6fe6.rra
- %ALLUSERSPROFILE%\Desktop\ePapyrus Reader 2.0.lnk
- %ALLUSERSPROFILE%\Desktop\MPXBox.lnk
- <SYSTEM32>\MaJG7006.rra
- <SYSTEM32>\MK_L7092.rra
- <SYSTEM32>\MaXM7063.rra
- <SYSTEM32>\MaJU7034.rra
- %ALLUSERSPROFILE%\Start Menu\Programs\MarkAny\ContentSAFER Client\MPXBox.lnk
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\data6df2.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\data6dc3.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\layo6da4.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setu6e40.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\setu6e8f.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setu6e6f.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUp7526.rra
- <SYSTEM32>\MASe747a.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\maps73ce.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUp7555.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\ePapyrus\Marc77b6.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MACS766e.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAFi7584.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCS7390.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAu7228.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\User71fa.rra
- <SYSTEM32>\MaDR713e.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAWe7257.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCS7371.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\mapw7342.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAg7286.rra
- %ALLUSERSPROFILE%\Start Menu\Programs\MarkAny\ContentSAFER Client\ContentSAFER Client »иБ¦.lnk
- %TEMP%\pft3~tmp\Disk1\setup.inx
- %TEMP%\pft3~tmp\Disk1\Setup.ini
- %TEMP%\pft3~tmp\Disk1\Setup.exe
- %TEMP%\pft3~tmp\Disk1\setup.iss
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
- %TEMP%\IEC4.tmp
- %TEMP%\pft3~tmp\Disk1\layout.bin
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\plf1.tmp
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\Disk1\data1.cab
- %TEMP%\pft3~tmp\Disk1\ikernel.ex_
- %TEMP%\pft3~tmp\Disk1\data2.cab
- %TEMP%\pft3~tmp\Disk1\data1.hdr
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssv5e62.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\valu5e33.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssv5da6.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\isrt5eef.rra
- %TEMP%\pft3~tmp\Disk1\setup.log
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsR5fe9.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\defa5f6c.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\lice5d87.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje527b.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor50e5.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core5068.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse52d9.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\info5d58.rra
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\setu5ccc.rra
- %CommonProgramFiles%\InstallShield\IScript\iscr552b.rra
Удаляет следующие файлы:
- %TEMP%\pft3~tmp\Disk1\data2.cab
- %TEMP%\pft3~tmp\Disk1\ikernel.ex_
- %TEMP%\pft3~tmp\Disk1\data1.hdr
- %TEMP%\plf1.tmp
- %TEMP%\pft3~tmp\Disk1\data1.cab
- %TEMP%\pft3~tmp\Disk1\layout.bin
- %TEMP%\pft3~tmp\Disk1\setup.iss
- %TEMP%\pft3~tmp\Disk1\setup.log
- %TEMP%\pft3~tmp\Disk1\setup.inx
- %TEMP%\pft3~tmp\Disk1\Setup.exe
- %TEMP%\pft3~tmp\Disk1\Setup.ini
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssver.scc
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsRes.dll
- %TEMP%\IEC4.tmp
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\default.pal
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\infolist.txt
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\setup.inx
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\license.txt
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\isrt.dll
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\value.shl
Перемещает следующие файлы:
- %PROGRAM_FILES%\MarkAny\ContentSAFER\User71fa.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UserShare.dll
- <SYSTEM32>\MaDR713e.rra в <SYSTEM32>\MaDRM.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAu7228.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAuthProc.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAg7286.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAgent.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAWe7257.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MAWebControl.exe
- <SYSTEM32>\MaJG7006.rra в <SYSTEM32>\MaJGUILib.dll
- <SYSTEM32>\MACX6fe6.rra в <SYSTEM32>\MACXMLProto.dll
- <SYSTEM32>\MaJU7034.rra в <SYSTEM32>\MaJUtilLib.dll
- <SYSTEM32>\MK_L7092.rra в <SYSTEM32>\MK_Lyric.dll
- <SYSTEM32>\MaXM7063.rra в <SYSTEM32>\MaXMLProto.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\mapw7342.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\mapwij10.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAFi7584.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAFileUpdate.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUp7555.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUpdateClient.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MACS766e.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MACSMANAGER.dll
- %TEMP%\4934.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\setup.ilg
- %PROGRAM_FILES%\MarkAny\ContentSAFER\ePapyrus\Marc77b6.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\ePapyrus\MarcoPoloDoc.ico
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCS7390.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCSProHook.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCS7371.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCSMgr.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\maps73ce.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\mapshapi.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUp7526.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUpdateBoot.exe
- <SYSTEM32>\MASe747a.rra в <SYSTEM32>\MASetupCleaner.exe
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\setu5ccc.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\setup.inx
- %CommonProgramFiles%\InstallShield\IScript\iscr552b.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\info5d58.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\infolist.txt
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssv5da6.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssver.scc
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\lice5d87.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\license.txt
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core5068.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor50e5.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse52d9.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje527b.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\valu5e33.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\value.shl
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\data6df2.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\data1.cab
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\data6dc3.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\data1.hdr
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setu6e40.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setup.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\setu6e8f.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\setup.inx
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setu6e6f.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setup.ini
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\isrt5eef.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\isrt.dll
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssv5e62.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssver.scc
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\defa5f6c.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\default.pal
- %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\layo6da4.rra в %PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\layout.bin
- %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsR5fe9.rra в %TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsRes.dll
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'MaAgent_{9E8B0CC0-AACD-4a03-812B-CB4C6D215209}'
- ClassName: 'Shell_TrayWnd' WindowName: ''
