Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe' /REGSERVER
- '%TEMP%\pft3~tmp\Setup.exe'
- '%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe' -RegServer
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\licec4bd.rra
- <SYSTEM32>\Vsflc3e2.rra
- <SYSTEM32>\MSWIc385.rra
- C:\ePro\Controls\Actic5e6.rra
- C:\ePro\Controls\Hanfc5a7.rra
- C:\ePro\WSClc559.rra
- <SYSTEM32>\objsc317.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\Setuc1fe.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\Setuc1df.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\datac191.rra
- <SYSTEM32>\VB6Kc2c9.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\Setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\setuc21d.rra
- C:\ePro\Controls\EpSpc8d4.rra
- C:\ePro\Controls\eProc8b5.rra
- C:\ePro\Controls\eProc895.rra
- C:\ePro\Controls\fpSpcaa9.rra
- C:\ePro\Controls\exclca4b.rra
- C:\ePro\Controls\EpSpc9fd.rra
- C:\ePro\Controls\eProc857.rra
- C:\ePro\Controls\EpFlc76d.rra
- C:\ePro\Controls\Cubec71e.rra
- C:\ePro\Controls\arvic6b1.rra
- C:\ePro\Controls\eProc818.rra
- C:\ePro\Controls\eProc7da.rra
- C:\ePro\Controls\eProc7ab.rra
- %TEMP%\pft3~tmp\Setup.ini
- %TEMP%\pft3~tmp\Setup.exe
- %TEMP%\pft3~tmp\layout.bin
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\temp.000
- %TEMP%\pft3~tmp\setup.inx
- %TEMP%\pft3~tmp\ikernel.ex_
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\plf1.tmp
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\data2.cab
- %TEMP%\pft3~tmp\data1.hdr
- %TEMP%\pft3~tmp\data1.cab
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\defab8c7.rra
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\isrtb83a.rra
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\vssvb7ad.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\datac171.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\layoc142.rra
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\_IsRb963.rra
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\valub76f.rra
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\objea9f2.rra
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctora7de.rra
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\corea752.rra
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\setub646.rra
- %CommonProgramFiles%\InstallShield\IScript\IScracef.rra
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuseaa6f.rra
Удаляет следующие файлы:
- %TEMP%\pft3~tmp\data2.cab
- %TEMP%\pft3~tmp\ikernel.ex_
- %TEMP%\pft3~tmp\data1.cab
- %TEMP%\pft3~tmp\data1.hdr
- %TEMP%\pft3~tmp\Setup.ini
- %TEMP%\pft3~tmp\setup.inx
- %TEMP%\pft3~tmp\layout.bin
- %TEMP%\pft3~tmp\Setup.exe
- %TEMP%\plf1.tmp
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\_IsRes.dll
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\default.pal
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\value.shl
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\setup.inx
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\isrt.dll
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\vssver.scc
Перемещает следующие файлы:
- C:\ePro\Controls\arvic6b1.rra в C:\ePro\Controls\arview2.ocx
- C:\ePro\Controls\Actic5e6.rra в C:\ePro\Controls\ActiveCube.ocx
- C:\ePro\Controls\Cubec71e.rra в C:\ePro\Controls\CubeSource.dll
- C:\ePro\Controls\eProc7ab.rra в C:\ePro\Controls\eProBarCodePrinter.ocx
- C:\ePro\Controls\EpFlc76d.rra в C:\ePro\Controls\EpFlexGroup.ocx
- <SYSTEM32>\Vsflc3e2.rra в <SYSTEM32>\Vsflex7L.ocx
- <SYSTEM32>\MSWIc385.rra в <SYSTEM32>\MSWINSCK.OCX
- %WINDIR%\licec4bd.rra в %WINDIR%\license.dat
- C:\ePro\Controls\Hanfc5a7.rra в C:\ePro\Controls\Hanfn16g.txt
- C:\ePro\WSClc559.rra в C:\ePro\WSClient.exe
- C:\ePro\Controls\EpSpc9fd.rra в C:\ePro\Controls\EpSpreadTools.dll
- C:\ePro\Controls\EpSpc8d4.rra в C:\ePro\Controls\EpSpread.ocx
- C:\ePro\Controls\exclca4b.rra в C:\ePro\Controls\exclexpt.dll
- %TEMP%\a185.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\setup.ilg
- C:\ePro\Controls\fpSpcaa9.rra в C:\ePro\Controls\fpSpr60.ocx
- C:\ePro\Controls\eProc818.rra в C:\ePro\Controls\eProComOcx.ocx
- C:\ePro\Controls\eProc7da.rra в C:\ePro\Controls\eProCom.dll
- C:\ePro\Controls\eProc857.rra в C:\ePro\Controls\eProCube.ocx
- C:\ePro\Controls\eProc8b5.rra в C:\ePro\Controls\eProReportDeg.dll
- C:\ePro\Controls\eProc895.rra в C:\ePro\Controls\eProFileDownload.dll
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\setub646.rra в %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\setup.inx
- %CommonProgramFiles%\InstallShield\IScript\IScracef.rra в %CommonProgramFiles%\InstallShield\IScript\IScript.dll
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\valub76f.rra в %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\value.shl
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\isrtb83a.rra в %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\isrt.dll
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\vssvb7ad.rra в %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\vssver.scc
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\corea752.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\corecomp.ini
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctora7de.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor.dll
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuseaa6f.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuser.dll
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\objea9f2.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\objectps.dll
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\Setuc1fe.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\Setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\Setuc1df.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\Setup.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\setuc21d.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\setup.inx
- <SYSTEM32>\objsc317.rra в <SYSTEM32>\objsafe.tlb
- <SYSTEM32>\VB6Kc2c9.rra в <SYSTEM32>\VB6KO.DLL
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\_IsRb963.rra в %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\_IsRes.dll
- %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\defab8c7.rra в %TEMP%\{ceeee952-2e47-4888-aea8-2a152d0596a1}\default.pal
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\layoc142.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\layout.bin
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\datac191.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\data1.cab
- %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\datac171.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CEEEE952-2E47-4888-AEA8-2A152D0596A1}\data1.hdr
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
