Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s ltbar14N.ocx
- '<SYSTEM32>\regsvr32.exe' /s ltdic13n.ocx
- '<SYSTEM32>\regsvr32.exe' /s ltbar13n.ocx
- '<SYSTEM32>\cmd.exe' /c C:\PaceSystem\Engine\Registry.bat
- '<SYSTEM32>\regsvr32.exe' /s DPATwain.ocx
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1208' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120B' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'CurrentLevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1208' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '120B' = '00000000'
Изменения в файловой системе:
Создает следующие файлы:
- C:\PaceSystem\Engine\ltkrn11n.dll
- C:\PaceSystem\Engine\ltkrn13n.dll
- C:\PaceSystem\Engine\ltimg13n.dll
- C:\PaceSystem\Engine\ltimg14N.dll
- C:\PaceSystem\Engine\ltkrn14N.dll
- C:\PaceSystem\Engine\ltocx13n.ocx
- C:\PaceSystem\Engine\ltocx14.lic
- C:\PaceSystem\Engine\lttw213n.dll
- C:\PaceSystem\Engine\ltocx13.lic
- C:\PaceSystem\Engine\LTDIS13n.dll
- C:\PaceSystem\Engine\LTDIS14N.dll
- C:\PaceSystem\Engine\LTDic13n.dll
- C:\PaceSystem\Engine\ltdic13n.ocx
- C:\PaceSystem\Engine\ltefx13n.dll
- C:\PaceSystem\Engine\ltfil13n.DLL
- C:\PaceSystem\Engine\ltfil14N.DLL
- C:\PaceSystem\Engine\ltefx14N.dll
- C:\PaceSystem\Engine\ltfil11n.DLL
- C:\PaceSystem\Engine\ltocx14N.ocx
- C:\PaceSystem\Engine\Mfc42.dll
- C:\PaceSystem\Engine\mfc100u.dll
- C:\PaceSystem\Engine\ecompress.dll
- C:\PaceSystem\Engine\Registry.bat
- C:\PaceSystem\Engine\msvcr100.dll
- <SYSTEM32>\ltocx14.lic
- C:\PaceSystem\KGBInvoiceUninstall.exe
- C:\PaceSystem\Engine\msvcrt.dll
- <SYSTEM32>\ltocx13.lic
- C:\PaceSystem\Engine\NTBarcodeQrcode_D.dll
- C:\PaceSystem\Engine\NTRecogBarCode.dll
- C:\PaceSystem\Engine\lttwn13n.dll
- C:\PaceSystem\Engine\NTBarcodePdf417_D.dll
- C:\PaceSystem\Engine\pace_image.dll
- C:\PaceSystem\Engine\RealEyeViewX.ocx
- C:\PaceSystem\Engine\TiffStream.dll
- C:\PaceSystem\Engine\PaceImageIO.dll
- C:\PaceSystem\Engine\RealEyeBar.ocx
- C:\PaceSystem\Engine\DPABarcodeDatamatrix_D.dll
- C:\PaceSystem\Engine\DPABarcodeEan_D.dll
- C:\PaceSystem\Engine\DPABarcodeCodeone_D.dll
- C:\PaceSystem\Engine\DPABarcodeD2rmatrix_D.dll
- C:\PaceSystem\Engine\DPABarcodeI2of5_D.dll
- C:\PaceSystem\Engine\DPABarcodeUpc_D.dll
- C:\PaceSystem\Engine\DPATwain.ocx
- C:\PaceSystem\Engine\DPABarcodePdf417_D.dll
- C:\PaceSystem\Engine\DPABarcodeQrcode_D.dll
- C:\PaceSystem\Engine\AXBAR32N.DLL
- C:\PaceSystem\Engine\BARCODE.DLL
- %TEMP%\nsz2.tmp
- %TEMP%\nsz3.tmp\System.dll
- C:\PaceSystem\Engine\DPABarcode_D.dll
- C:\PaceSystem\Engine\DPABarcodeCode93_D.dll
- C:\PaceSystem\Engine\DPABarcodeCode128_D.dll
- C:\PaceSystem\Engine\DPABarcodeCodabar_D.dll
- C:\PaceSystem\Engine\DPABarcodeCode39_D.dll
- C:\PaceSystem\Engine\InvoiceRecog.exe
- C:\PaceSystem\Engine\LFTIF14n.DLL
- C:\PaceSystem\Engine\libtiff.dll
- C:\PaceSystem\Engine\LFPCX13N.DLL
- C:\PaceSystem\Engine\lftif13n.dll
- C:\PaceSystem\Engine\KGBConfig.ini
- C:\PaceSystem\Engine\ltbar14n.dll
- C:\PaceSystem\Engine\ltbar14N.ocx
- C:\PaceSystem\Engine\ltbar13n.dll
- C:\PaceSystem\Engine\ltbar13n.ocx
- C:\PaceSystem\Engine\LFCMP13n.DLL
- C:\PaceSystem\Engine\LFCMP14n.DLL
- C:\PaceSystem\Engine\lfbmp13n.dll
- C:\PaceSystem\Engine\LFCMP11n.DLL
- C:\PaceSystem\Engine\lffax13n.dll
- C:\PaceSystem\Engine\lfjbg13n.dll
- C:\PaceSystem\Engine\LFLMB13N.DLL
- C:\PaceSystem\Engine\LFFAX14n.DLL
- C:\PaceSystem\Engine\lfgif13n.dll
Удаляет следующие файлы:
- %TEMP%\nsz3.tmp\System.dll
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
