Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineCore.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineUA.job
- %WINDIR%\Tasks\55efda46-06eb-4260-be07-285551ed08f4-3.job
- %WINDIR%\Tasks\55efda46-06eb-4260-be07-285551ed08f4-11.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regserver
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjUuMCIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins0NTcyMzY4OC05NTE1LTQxODEtQUY3OS1GOEMwODk4NDc5NUV9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0iezU4QzkwNjAyLTM4NkEtNDQ1Ny05QzYwLUE4RTk0Nzc2MDYzQ30iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI1LjEiIHNwPSJTZXJ2aWNlIFBhY2sgMiIgYXJjaD0ieDg2Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4yNS4wIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /handoff "appguid={d62802fd-4afd-4c3a-aad9-d0d339ddd0d1}&appname=8b3130bc-4f8f-49c5-9596-8b3f5bf2f138&needsadmin=True&lang=en" /installsource otherinstallcmd /sessionid "{45723688-9515-4181-AF79-F8C08984795E}" /silent
- '%PROGRAM_FILES%\Free Video Grabber 6.6\55efda46-06eb-4260-be07-285551ed08f4-11.exe' /XyRGXMs=x0KJFnVfDONNi/LQMfMv8LpX+LHzwOnLmGmCxvT0wwdOaF6tkTNxMUNfvNtog3P3vdegfUA5PKSOg9W+WH/syJhi/0rv7WO96UXmG6z4dvoSbQyd0Hp8Fuy5wyfeyQsESHFbFyycQxwCWDmP2Zwi7Jb7RLuCMMPlVHu9gNxdNlKuesd7sVhqetUqdLzVKelhhWiPEBz8WsS4lUjVrFVkUfU5sfI2coQSv9WaEhSSSCxq1L2BgjBTxZp0A1hKY0I1tr4bHf4CGoWlZDl+cxoUOPM4krRLJUWiTR6z7M43xtnR6LzdNR2LXDbD0hm+F+glnpPIaWLJX8M7FjjmxWkfjG7XWlVvP8R9oPehYMdkHlrkBv9ueB2+imVz3w/djB0kRqhTHIe60t/yoSsACOmkL0+E82Q1//0ivVzDQ50HnexfoR19OsO4i4K+MvpQwK1onA4Ps/3XvLXuT6XdC1QUAzDxfO0M9WT9nk3EHlS9Rc1bRICWyPBhj5ZO8eJq032LCbqfnbqkQu9PBTlNaSdyGz54YDbCwu3dRU6TTiy6a+FrQw9y88n+SVzZzTQgJlXDiTFyCBg3qiwAL7+3UEfQ0dwuVUMGaavDLw+sJwrm6sH/SQXoZLdnJClNiDtSis4YioJh9RIPZ8hGJN8oEE1DB+tuGjc7lAfbEGW2NIa99UgFRIEqk+ip7zGuZNR5wpKLFseJbuJlBe2ljk7PHllFWr2DFoUKsoyNZH0a53xkjB2+t1GodX1kRs1DbAOXViOKJoBw6MxMIdvoYrCyKfy2ga3tGBEtiTx/BUVX85agOOftYM6cNO+Ya59ATtQJfVv0+q9bDVhmx3V66b3g3q5FIg3nLMVFEuAYdAY61VWzNpn+4HqsoiixaFBnUNWDgqWbEDrZWy8mjzL+G+PHdX7pW3/3ggnSOduoRs6T+BsEokZHj/ADsCD6zVhReXRNyxyx5xNr5du3Yb5TgqBmSqL8So4F25k5fW9+qATQAOZi2JC5dh3nqz8yt37uaavDJ+UMGIuyvR5yCVUXYOQfLgpYsBMD5RqrBzCsB0oo2RlF7KtzxwOgjggagajUl3II/F7xt0LzNwwgy4r1jaWUuRG6tNGA5dIaZEtL+liwM+NG/Bfm+QlKKb6TZFCTvRVJfklIat2fQUYFenUW5ZqhHo982l5+biwMsyGWeF9NSp1yyA0m1KOfDeBn7pgXb4v9YuA0ZpzsecvzMr6acoRl2fPlMFv7zbnuoTY4C7bCLKT9GBff7ai0QAOgRIKC9Vi5TRVPZGNOukQfl9E3Eraj+QbUCVc6pDi8Z/lIgYgEgJCM5zhWS0ILyCPEIaieFtzchPzPU8ch5gl2pLa0Mq26YAUP9zwYFcHk1k3OlzDygEO/OG3cGOPrIVzD6kYKiz0T1niMxmkeoJIiLqNKRH7xe0oLTXedBnpFllgfxnK4hAL9PwDM8bcI2by6hPgcT4QOuCh2lCowGErech5XAUvIG/Rpgw/XYTPVcbb14+s1abJPxABUwj0QH9l8RmjCAkII/ljXlqcIrrGvN1CTb053qe4FalbUb6yXrAHVdkibcUMiNfUtrtoMsnBWZg1H2/LbpURcHJivsPrlU2zCYzV9yumphCAm4qpyfY/2QZQ1KpnIvQnZoZ67MBuidKCfSON9Bod0XZ+wrn5Ny98W+yGciwMvv+Tqrq7FH9SUIvi9HoQpq3I=
- '%TEMP%\comh.217623\GoogleUpdate.exe' /silent /install "appguid={d62802fd-4afd-4c3a-aad9-d0d339ddd0d1}&appname=8b3130bc-4f8f-49c5-9596-8b3f5bf2f138&needsadmin=True&lang=en"
- '%PROGRAM_FILES%\Free Video Grabber 6.6\55efda46-06eb-4260-be07-285551ed08f4-3.exe' /XyRGXMs=eSba5htxFZvB5OfkcYPBEtp8Ag+dTQcFZJCW/vuNQH8YL9Y9wB6LpgLq+DTN51qHd7yM2s7rpY6TKwPquL9ZH9epvrTuBXMr/ptAbkw4E1GOCZz2VrzOLV77yu3TjgdSPQoXbQbgWTPXReVRXpofY0Umv8mOh0ujBk1scXJ59peW215RybDmCVmY/hzk+2R3kLWfGc96+zfWlVv/M6MsY4jl9lpYu4iNbNaKyFf/0CJynZKHLk+kbrzXCGNskUP0XzvZQsizsm/vmosqL77DOl/BFrgWfFdXHv8GIoQnIuUmrGlzgEyyf4kAtxXVMPgnN28cGmfxZny/nCKK9qr4zW+kRmKa8yhAqkmzueU8X0qNHKNAIYbPKPLeb0TK8GdLm5daTVI2+chAj/t16+rckkIqGqWYGGZhk5oSlNPnrA5UPIb0AHWmng47KOQvY48iep6qN7+GMO67Ypjo+vLa/UnazeExfqBWMWApRLWqLLObwFVhNOC+5SNp4spdMyS3LGDtBEV29tuwfC5s2vryL8SK6MoDq0chR5eRv7f2OhfCpPcmdaomIY1nzKDuNG49fISNr4I//s93LC+KhSaHN2BcaW4rFJBgsO8JUuoPuo/Ok8Sl9ns1KK1Zo8zZbmCBfXs6vK/AiQO8udkJIvYnlIt7eMh5NQSx+xhQriVfJNNGtpWRbUrLaPDs/14K8AJFRnH+7vYY5uTyCd2x1hCIS8OFS/M+ffigx4bT5IaLm+ukHagB2qyfb2b86GIDUzC2BaIO/qVRZUP6CpSpXdW6/ctQ3ybXHW162FLIh95ooaZ/4INjCxc0KE7mOVsLDQasUxx465yc/Q3nzRxjnLZMGjDrd+CspS5muijOTly7A9fXuYGik27Bj7DX1fzujnWEPFMdG7UMV5NhgVLYx0vx0U+r7JWGxD64KIGKBJcwNDadWg6gEXuroI5WkIfGypcKy8St4qd2EZPRJfK5wuL0zc8A442L7eUfr3R/72bb540iA8KwVq7030x5bY32jFoAVOlA4cLDEMTzSObJ+3DE8qdncnsvuSJsPxJcuo2fbEKsVHK3yMbXp32jZhpbjYpuw4dNXxoCWVpIxDpRkqaJMOWwQlhNsqVY4znqWTkx+RJyqMxqgam1tYPB/0dhkmtFSIkeS5y57sPOog4xuBYHu52FeIn9D8A1USZGAKvTBb+Wpwiusa83UJNvTnep7gVqVtRvrJesAdV2SJtxQyI19S2u2gyycFZmDUfb8tulRFwcmK+w+uVTbMJjNX3K6amEICbiqnJ9j/ZBlDUqmci9CdmhnrswG6J0oJ9I430Gh3Rdn7Cufk3L3xb7IZyLAy+/5OqursUf1JQi+L0ehCmrcg==
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' /V
Завершает или пытается завершить
следующие пользовательские процессы:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %PROGRAM_FILES%\Free Video Grabber 6.6\360-57250.crx
- %PROGRAM_FILES%\Free Video Grabber 6.6\1293297481.mxaddon
- %TEMP%\Cab6.tmp
- %PROGRAM_FILES%\Free Video Grabber 6.6\55efda46-06eb-4260-be07-285551ed08f4-3.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %TEMP%\Cab4.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %TEMP%\Free Video Grabber 6.6Installer_1398208354.log
- %TEMP%\nsm3.tmp\ExecDos.dll
- %PROGRAM_FILES%\Free Video Grabber 6.6\55efda46-06eb-4260-be07-285551ed08f4.crx
- %PROGRAM_FILES%\Free Video Grabber 6.6\55efda46-06eb-4260-be07-285551ed08f4-11.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %WINDIR%\Installer\411cf.msi
- %TEMP%\MSI42aa6.LOG
- C:\Config.Msi\411d2.rbs
- %WINDIR%\Installer\MSIA.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %TEMP%\Cab8.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].json
- %TEMP%\nsm3.tmp\inetc.dll
- %TEMP%\nsm3.tmp\UserInfo.dll
- %TEMP%\nsm3.tmp\update.json
- %TEMP%\nsm3.tmp\88950
- %TEMP%\nsm3.tmp\144191
- %PROGRAM_FILES%\Free Video Grabber 6.6\utils.exe
- %TEMP%\nsm3.tmp\System.dll
- %TEMP%\nsm3.tmp\StdUtils.dll
- %TEMP%\nsw2.tmp
- %TEMP%\nsm3.tmp\InstallerUtils.dll
- %TEMP%\nsm3.tmp\md5dll.dll
- %TEMP%\nsm3.tmp\nsisos.dll
- %TEMP%\nsm3.tmp\InstallerUtils2.dll
- %PROGRAM_FILES%\Free Video Grabber 6.6\Uninstall.exe
- %TEMP%\comh.217623\psuser.dll
- %TEMP%\comh.217623\psmachine.dll
- %TEMP%\comh.217623\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\Free Video Grabber 6.6\57250.crx
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %TEMP%\comh.217623\GoogleUpdateBroker.exe
- %TEMP%\comh.217623\GoogleUpdate.exe
- %TEMP%\comh.217623\GoogleCrashHandler.exe
- %TEMP%\comh.217623\GoogleUpdateHelper.msi
- %TEMP%\comh.217623\goopdateres_en.dll
- %TEMP%\comh.217623\goopdate.dll
- %TEMP%\comh.217623\GoogleUpdateOnDemand.exe
Удаляет следующие файлы:
- %WINDIR%\Installer\MSIA.tmp
- C:\Config.Msi\411d2.rbs
- %WINDIR%\Installer\411cf.msi
- %TEMP%\Cab8.tmp
- %TEMP%\nsm3.tmp\88950
- %TEMP%\Cab4.tmp
- %TEMP%\Cab6.tmp
Сетевая активность:
Подключается к:
- 'www.download.windowsupdate.com':80
- 'cr#.#hawte.com':80
- 'ts####.ws.symantec.com':80
- 'lo##.##tagenserv.com':80
- 'up####.datagenserv.com':80
- 'er####.datagenserv.com':80
- 'st###.#atagenserv.com':80
TCP:
Запросы HTTP GET:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- up####.datagenserv.com/installer_updates/001527/update.json
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK lo##.##tagenserv.com
- DNS ASK up####.datagenserv.com
- DNS ASK er####.datagenserv.com
- DNS ASK st###.#atagenserv.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
