Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AnyClickUP' = '"%ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyclickUP.exe"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\RarSFX0\AnyClickSetup.exe' /i
- '%TEMP%\RarSFX0\AnyclickUP.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnySens.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyReg.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyPwdpl.ini
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnySet.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyText.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnySVC.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyShMem.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyPro1.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\anyLogTi.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyInteroID.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyHelp.chm
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyMes0.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyPro0.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyMgm.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyMes1.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyTray.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\EULA_eng.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\daff0655.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\ccf40bff.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\EULA_kor.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\GN_1XSC_eng.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\GN_1XFD_kor.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\GN_1XFD_eng.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\CAcert.pem
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AUS_peap.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AUS_lang.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyUpdat.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AUS_res.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\c60fcdef.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AUS_ttls.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AUS_tls.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\8c602d2d.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\6913a74c.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\635067f0.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\8ee774c9.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\acsSet_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\acsSet_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\acsSetUP_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\48478734.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\172e3ab5.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\163f5fc1.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\01be08fb.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\2cf181f1.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\4479e138.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\3fbda7ab.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\2e8714cb.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\acsUnUP_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyclickUP.ini
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyclickUP.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyClickSetup8.ini
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyDPCDrv.sys
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyGina.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyDrive.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyDPCMan.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyClickSetup7.ini
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyACLMain.info
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyACLInit.info
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\adb96894.0
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\anycli.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyClickSetup.ini
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyClickSetup.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\AnyClick.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Setup_kor.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Setup_eng.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\setLogo.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\smc_cli.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Un1-1_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\systmon.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\ssleay32.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\setAstbg.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set4-2_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set4-2_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set4-1_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set5-1_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set6-1_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set6-1_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set5-1_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Un1-1_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\unetpkt.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\UNETCert2IE.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\unetadpt.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\upf.sys
- <SYSTEM32>\AnyInstall.log
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Version.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\upf_mgm.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Un4-1_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Un2-2_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Un2-1_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Un2-1_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Un2-2_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Un4-1_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Un3-1_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Un3-1_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\hash.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\hash.sig
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\GN_HELP_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\HYU-Wlan.wcf
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\mgmWired.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\mgmTitle.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\mfc80.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\GN_HELP_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\GN_CNG1X_kor.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\GN_CNG1X_eng.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\GN_1XSC_kor.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\GN_CRE1X_eng.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\GN_DEFAU_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\GN_DEFAU_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\GN_CRE1X_kor.txt
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\mgmWless.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set3-1_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set2-1_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set2-1_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set3-1_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set4-1_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set3-2_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set3-2_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set1-1_kor.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\msvcp80.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Microsoft.VC80.MFC.manifest
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Microsoft.VC80.CRT.manifest
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\msvcr80.dll
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\Set1-1_eng.bmp
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\sc.exe
- %ALLUSERSPROFILE%\Application Data\AnyClickUP\nxc1xu32.dll
- %TEMP%\RarSFX0\3fbda7ab.0
- %TEMP%\RarSFX0\2e8714cb.0
- %TEMP%\RarSFX0\2cf181f1.0
- %TEMP%\RarSFX0\4479e138.0
- %TEMP%\RarSFX0\6913a74c.0
- %TEMP%\RarSFX0\635067f0.0
- %TEMP%\RarSFX0\48478734.0
- %TEMP%\RarSFX0\172e3ab5.0
- %TEMP%\RarSFX0\AnyACLMain.info
- %TEMP%\RarSFX0\AnyPwdpl.ini
- %TEMP%\RarSFX0\GN_1XFD_kor.txt
- %TEMP%\RarSFX0\AnyACLInit.info
- %TEMP%\RarSFX0\163f5fc1.0
- %TEMP%\RarSFX0\01be08fb.0
- %TEMP%\RarSFX0\Version.txt
- %TEMP%\RarSFX0\8c602d2d.0
- %TEMP%\RarSFX0\setLogo.bmp
- %TEMP%\RarSFX0\setAstbg.bmp
- %TEMP%\RarSFX0\mgmWless.bmp
- %TEMP%\RarSFX0\GN_DEFAU_eng.bmp
- %TEMP%\RarSFX0\GN_HELP_kor.bmp
- %TEMP%\RarSFX0\GN_HELP_eng.bmp
- %TEMP%\RarSFX0\GN_DEFAU_kor.bmp
- %TEMP%\RarSFX0\mgmWired.bmp
- %TEMP%\RarSFX0\c60fcdef.0
- %TEMP%\RarSFX0\adb96894.0
- %TEMP%\RarSFX0\8ee774c9.0
- %TEMP%\RarSFX0\ccf40bff.0
- %TEMP%\RarSFX0\mgmTitle.bmp
- %TEMP%\RarSFX0\anyLogTi.bmp
- %TEMP%\RarSFX0\daff0655.0
- %TEMP%\RarSFX0\anycli.dll
- %TEMP%\RarSFX0\systmon.exe
- %TEMP%\RarSFX0\AnyUpdat.exe
- %TEMP%\RarSFX0\AnyReg.dll
- %TEMP%\RarSFX0\nxc1xu32.dll
- %TEMP%\RarSFX0\AnyText.dll
- %TEMP%\RarSFX0\AnyShMem.dll
- %TEMP%\RarSFX0\upf_mgm.exe
- %TEMP%\RarSFX0\AnySens.exe
- %TEMP%\RarSFX0\AnyMgm.exe
- %TEMP%\RarSFX0\AnyClick.exe
- %TEMP%\RarSFX0\AnySet.exe
- %TEMP%\RarSFX0\smc_cli.exe
- %TEMP%\RarSFX0\AnyTray.exe
- %TEMP%\RarSFX0\AnySVC.exe
- %TEMP%\RarSFX0\ssleay32.dll
- %TEMP%\RarSFX0\GN_1XSC_eng.txt
- %TEMP%\RarSFX0\GN_CNG1X_eng.txt
- %TEMP%\RarSFX0\GN_CRE1X_eng.txt
- %TEMP%\RarSFX0\GN_1XFD_eng.txt
- %TEMP%\RarSFX0\GN_1XSC_kor.txt
- %TEMP%\RarSFX0\GN_CNG1X_kor.txt
- %TEMP%\RarSFX0\GN_CRE1X_kor.txt
- %TEMP%\RarSFX0\AnyPro1.txt
- %TEMP%\RarSFX0\AnyDrive.dll
- %TEMP%\RarSFX0\unetpkt.dll
- %TEMP%\RarSFX0\unetadpt.dll
- %TEMP%\RarSFX0\AnyGina.dll
- %TEMP%\RarSFX0\AnyMes1.txt
- %TEMP%\RarSFX0\AnyPro0.txt
- %TEMP%\RarSFX0\AnyMes0.txt
- %TEMP%\RarSFX0\sc.exe
- %TEMP%\RarSFX0\Un4-1_eng.bmp
- %TEMP%\RarSFX0\Un3-1_eng.bmp
- %TEMP%\RarSFX0\AUS_lang.dll
- %TEMP%\RarSFX0\AUS_ttls.dll
- %TEMP%\RarSFX0\AUS_res.dll
- %TEMP%\RarSFX0\AUS_peap.dll
- %TEMP%\RarSFX0\Un2-2_eng.bmp
- %TEMP%\RarSFX0\Set4-2_eng.bmp
- %TEMP%\RarSFX0\Set4-1_eng.bmp
- %TEMP%\RarSFX0\Set3-2_eng.bmp
- %TEMP%\RarSFX0\Set5-1_eng.bmp
- %TEMP%\RarSFX0\Un2-1_eng.bmp
- %TEMP%\RarSFX0\Un1-1_eng.bmp
- %TEMP%\RarSFX0\Set6-1_eng.bmp
- %TEMP%\RarSFX0\AUS_tls.dll
- %TEMP%\RarSFX0\hash.txt
- %TEMP%\RarSFX0\hash.sig
- %TEMP%\RarSFX0\UNETCert2IE.dll
- %TEMP%\RarSFX0\AnyclickUP.ini
- %WINDIR%\AnyclickUP.log
- %TEMP%\RarSFX0\HYU-Wlan.wcf
- %TEMP%\RarSFX0\AnyclickUP.exe
- %TEMP%\RarSFX0\AnyDPCMan.exe
- %TEMP%\RarSFX0\msvcr80.dll
- %TEMP%\RarSFX0\mfc80.dll
- %TEMP%\RarSFX0\AnyInteroID.dll
- %TEMP%\RarSFX0\msvcp80.dll
- %TEMP%\RarSFX0\AnyDPCDrv.sys
- %TEMP%\RarSFX0\Microsoft.VC80.MFC.manifest
- %TEMP%\RarSFX0\Microsoft.VC80.CRT.manifest
- %TEMP%\RarSFX0\AnyClickSetup8.ini
- %TEMP%\RarSFX0\AnyClickSetup7.ini
- %TEMP%\RarSFX0\AnyClickSetup.ini
- %TEMP%\RarSFX0\acsSet_kor.bmp
- %TEMP%\RarSFX0\Set1-1_kor.bmp
- %TEMP%\RarSFX0\acsUnUP_kor.bmp
- %TEMP%\RarSFX0\acsSetUP_kor.bmp
- %TEMP%\RarSFX0\Setup_eng.txt
- %TEMP%\RarSFX0\CAcert.pem
- %TEMP%\RarSFX0\AnyHelp.chm
- %TEMP%\RarSFX0\upf.sys
- %TEMP%\RarSFX0\AnyClickSetup.exe
- %TEMP%\RarSFX0\Setup_kor.txt
- %TEMP%\RarSFX0\EULA_eng.txt
- %TEMP%\RarSFX0\EULA_kor.txt
- %TEMP%\RarSFX0\Set2-1_kor.bmp
- %TEMP%\RarSFX0\Un4-1_kor.bmp
- %TEMP%\RarSFX0\Un3-1_kor.bmp
- %TEMP%\RarSFX0\Un2-2_kor.bmp
- %TEMP%\RarSFX0\acsSet_eng.bmp
- %TEMP%\RarSFX0\Set3-1_eng.bmp
- %TEMP%\RarSFX0\Set2-1_eng.bmp
- %TEMP%\RarSFX0\Set1-1_eng.bmp
- %TEMP%\RarSFX0\Un2-1_kor.bmp
- %TEMP%\RarSFX0\Set4-1_kor.bmp
- %TEMP%\RarSFX0\Set3-2_kor.bmp
- %TEMP%\RarSFX0\Set3-1_kor.bmp
- %TEMP%\RarSFX0\Set4-2_kor.bmp
- %TEMP%\RarSFX0\Un1-1_kor.bmp
- %TEMP%\RarSFX0\Set6-1_kor.bmp
- %TEMP%\RarSFX0\Set5-1_kor.bmp
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
