Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\5bad6d22\Ie.exe'
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
- firefox.exe
- chrome.exe
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- <LS_APPDATA>\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- <LS_APPDATA>\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- <LS_APPDATA>\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- <LS_APPDATA>\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- <SYSTEM32>\GroupPolicy\Machine\Registry.pol
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\staged\uoyfft@gaiauu.com\bootstrap.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\staged\uoyfft@gaiauu.com\chrome.manifest
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- <SYSTEM32>\GroupPolicy\gpt.ini
- %PROGRAM_FILES%\CostMin\b.dll
- %PROGRAM_FILES%\CostMin\b.tlb
- %PROGRAM_FILES%\CostMin\b.dat
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\staged\uoyfft@gaiauu.com\content\bg.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\staged\uoyfft@gaiauu.com\install.rdf
- %ALLUSERSPROFILE%\ntuser.pol
- C:\Documents and Settings\Guest\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- %TEMP%\5bad6d22\onoogcoabklcabdafloofalnbgnkbgnb\background.html
- %TEMP%\5bad6d22\onoogcoabklcabdafloofalnbgnkbgnb\OkCFWgop8.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- %TEMP%\5bad6d22\b.tlb
- %TEMP%\5bad6d22\b.dll
- %TEMP%\5bad6d22\uoyfft@gaiauu.com\content\bg.js
- %TEMP%\5bad6d22\Ie.dat
- %TEMP%\5bad6d22\Ie.exe
- %TEMP%\5bad6d22\b.x64.dll
- %TEMP%\5bad6d22\onoogcoabklcabdafloofalnbgnkbgnb\lsdb.js
- %TEMP%\5bad6d22\onoogcoabklcabdafloofalnbgnkbgnb\content.js
- %TEMP%\5bad6d22\onoogcoabklcabdafloofalnbgnkbgnb\manifest.json
- %TEMP%\5bad6d22\uoyfft@gaiauu.com\install.rdf
- %TEMP%\5bad6d22\uoyfft@gaiauu.com\chrome.manifest
- %TEMP%\5bad6d22\uoyfft@gaiauu.com\bootstrap.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- <LS_APPDATA>\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- <LS_APPDATA>\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- <LS_APPDATA>\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- <LS_APPDATA>\Google\Chrome SxS\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- <LS_APPDATA>\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- <LS_APPDATA>\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Torch\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\OkCFWgop8.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- <LS_APPDATA>\Google\Chrome SxS\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- <LS_APPDATA>\Google\Chrome SxS\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- <LS_APPDATA>\Google\Chrome SxS\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\manifest.json
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\content.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\lsdb.js
- <LS_APPDATA>\Google\Chrome SxS\User Data\Default\Extensions\onoogcoabklcabdafloofalnbgnkbgnb\2.2\background.html
Удаляет следующие файлы:
- %TEMP%\5bad6d22\onoogcoabklcabdafloofalnbgnkbgnb\lsdb.js
- %TEMP%\5bad6d22\uoyfft@gaiauu.com\bootstrap.js
- %TEMP%\5bad6d22\uoyfft@gaiauu.com\chrome.manifest
- %TEMP%\5bad6d22\onoogcoabklcabdafloofalnbgnkbgnb\content.js
- %TEMP%\5bad6d22\onoogcoabklcabdafloofalnbgnkbgnb\OkCFWgop8.js
- %TEMP%\5bad6d22\onoogcoabklcabdafloofalnbgnkbgnb\background.html
- %TEMP%\5bad6d22\onoogcoabklcabdafloofalnbgnkbgnb\manifest.json
- %TEMP%\5bad6d22\b.x64.dll
- %TEMP%\5bad6d22\Ie.exe
- %TEMP%\5bad6d22\Ie.dat
- %TEMP%\5bad6d22\b.tlb
- %TEMP%\5bad6d22\uoyfft@gaiauu.com\install.rdf
- %TEMP%\5bad6d22\uoyfft@gaiauu.com\content\bg.js
- %TEMP%\5bad6d22\b.dll
