Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MBAMService] 'ImagePath' = '"%ProgramFiles%\Malwarebytes Anti-Malware\mbamservice.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\MBAMService] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\MBAMProtector] 'ImagePath' = '<DRIVERS>\mbam.sys'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\setup2.exe' /VERYSILENT /NORESTART
- '%TEMP%\is-MDFMP.tmp\setup2.tmp' /SL5="$200E2,5463017,57856,%TEMP%\setup2.exe" /VERYSILENT /NORESTART
- '%TEMP%\setup.exe' /VERYSILENT /NORESTART
- '%TEMP%\is-2TR2J.tmp\setup.tmp' /SL5="$100E2,22449202,56832,%TEMP%\setup.exe" /VERYSILENT /NORESTART
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Malwarebytes Anti-Malware\mbamext.dll"
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-82DH6.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-LC3EB.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-7J03E.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-P35DM.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-TLPTP.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-B70GL.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-S8TFK.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-R5AHH.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-DDTKE.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-KAN92.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-HBJ8M.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-E7VCO.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-AV3AA.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-Q02RK.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-TRHUJ.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-DVCML.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-IAO03.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-ON8JT.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-6T6LL.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-I3OBH.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-LO1FM.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-A260E.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-M1G2N.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-G5C5V.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-1C6OI.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-HDKEQ.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Plugins\is-7NCQ5.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-EBABK.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-FUAJG.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-QLRTD.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-5DALH.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\imageformats\is-U9BJF.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\imageformats\is-RKN5L.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-G7JBG.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\platforms\is-VMSTO.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-P7J67.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-0932M.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-8O8KU.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-EEAH7.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-QMANI.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-AM8VR.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-AMDIJ.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-JVMCE.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-OHAMD.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-UCH7R.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-0QCS9.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-D8NOQ.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-KVTA4.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-NLQMS.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-PI1LJ.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-I1183.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-IMJCV.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-QFTMF.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-BMA1C.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\unins000.dat
- %ALLUSERSPROFILE%\Desktop\Malwarebytes Anti-Malware.lnk
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\net.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\build.conf
- %ALLUSERSPROFILE%\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware.lnk
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-TR37P.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Malwarebytes Anti-Malware\Uninstall Malwarebytes Anti-Malware.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Malwarebytes Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\settings.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-L182V.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-46BT8.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-EPRAC.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-JM3AR.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-P96CD.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-JHA1B.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-FPFFO.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-B912T.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-DA0HG.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-0CFE0.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-7CSEN.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-J7NP5.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-F8VAV.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-8GB63.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-O77TI.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-0TLTH.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-GGE6Q.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-C9C8V.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-2KF6L.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-LETU2.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-TTQRP.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-0RDR2.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-U7ISF.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-6OQS8.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-TPEF7.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-22UIV.tmp
- %TEMP%\ma.exe
- %TEMP%\aut3.tmp
- <DRIVERS>\is-4DCIJ.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-KC2Q7.tmp
- %TEMP%\setup.exe
- %TEMP%\aut1.tmp
- %TEMP%\setup2.exe
- %TEMP%\aut2.tmp
- <DRIVERS>\is-LNBIN.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-7957B.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-KBIQ7.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-A7M6D.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-S6A25.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-93QDV.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-A8LII.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-GIQM2.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-F6P49.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-A6NUP.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-U9D5Q.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-I506K.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-9V7OQ.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-6TQSU.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\is-H3A51.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\is-LPH0A.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-2NFN8.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\is-U046Q.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-4UPDE.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-22304.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-QOMJK.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-0G2PL.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-89CUR.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-6B1L4.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-L8G2R.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-E9T86.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-L12KO.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\is-6VJM1.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-CAFG5.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-ANHJR.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-E7CNU.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-496PT.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-C5F55.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-16NCL.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-0JF7K.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-SKJ01.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-DA9GA.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-IT789.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-5QQ1Q.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-5UT41.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-4D9DS.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-ENL7D.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-GUSLE.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-VK7NP.tmp
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-ICJQD.tmp
Удаляет следующие файлы:
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\net.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\license.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\database.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\build.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\gatekeeper.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\statistics.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\settings.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\notifications.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\manifest.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\license.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\notifications.conf
- %ProgramFiles%\Malwarebytes Anti-Malware\mbam.exe
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\settings.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\scheduler.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\marketing.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\gatekeeper.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\statistics.conf
- %TEMP%\is-KTGF7.tmp\mbamsrv.dll
- %TEMP%\is-KTGF7.tmp\mbam.dll
- %TEMP%\is-KTGF7.tmp\msvcr100.dll
- %TEMP%\is-KTGF7.tmp\msvcp100.dll
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\is-KTGF7.tmp\master.conf
- %TEMP%\aut3.tmp
- %TEMP%\is-KTGF7.tmp\Qt5Core.dll
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\manifest.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\database.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\scheduler.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\marketing.conf
- %TEMP%\is-2TR2J.tmp\setup.tmp
- %TEMP%\is-KTGF7.tmp\_isetup\_shfoldr.dll
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\build.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\net.conf
Перемещает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-I3OBH.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\gatekeeper.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-6T6LL.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\notifications.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-A260E.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\license.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-M1G2N.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\marketing.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-HDKEQ.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\scheduler.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-1C6OI.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\statistics.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-LO1FM.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\settings.conf
- %ProgramFiles%\Malwarebytes Anti-Malware\platforms\is-VMSTO.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\platforms\qwindows.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-G7JBG.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\7z.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-FUAJG.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\msvcp100.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\Plugins\is-7NCQ5.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Plugins\fixdamage.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\imageformats\is-RKN5L.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\imageformats\qgif.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\imageformats\is-U9BJF.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\imageformats\qico.dll
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-4UPDE.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\scheduler.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-L8G2R.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\statistics.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-6B1L4.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\gatekeeper.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-U9D5Q.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\database.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-6TQSU.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\manifest.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-9V7OQ.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\marketing.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-L12KO.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\notifications.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-89CUR.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\build.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-0G2PL.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\database.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-G5C5V.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\manifest.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-E9T86.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\settings.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-QOMJK.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\license.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\is-22304.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\net.conf
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-DVCML.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\firefox.com
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-HBJ8M.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\firefox.pif
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-KAN92.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\firefox.scr
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-TRHUJ.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\mbam-chameleon.scr
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-Q02RK.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\svchost.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-IAO03.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\firefox.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-AV3AA.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\iexplore.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\is-0QCS9.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\QtCore4.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-NLQMS.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\QtGui4.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-KVTA4.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\QtNetwork4.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-E7VCO.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\winlogon.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-P7J67.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\rundll32.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-TR37P.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\windows.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\is-ON8JT.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Qt5Network.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-B70GL.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Qt5Widgets.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-TLPTP.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\cloud.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-EBABK.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\msvcr100.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-5DALH.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Qt5Core.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-QLRTD.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Qt5Gui.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-R5AHH.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\cloud-enumeration.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-P35DM.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\mbam-chameleon.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-7J03E.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\mbam-chameleon.com
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-DDTKE.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\mbam-chameleon.pif
- %ProgramFiles%\Malwarebytes Anti-Malware\is-S8TFK.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\mbamresearch.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-LC3EB.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\chameleon.chm
- %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\is-82DH6.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Chameleon\Windows\mbam-killer.exe
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-I506K.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\build.conf
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-0CFE0.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_ca.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-DA0HG.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_cs.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-J7NP5.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_da.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\is-F8VAV.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\changes.txt
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-0TLTH.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_ar.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-O77TI.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_bg.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-7CSEN.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_de.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-TPEF7.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_et.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-6OQS8.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_fi.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-2KF6L.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_fr.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-GGE6Q.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_el.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-U7ISF.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_en.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-0RDR2.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_es.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\is-A8LII.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\mbamext.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-93QDV.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\mbam.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-F6P49.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\mbamcore.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-KC2Q7.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\unins000.exe
- <DRIVERS>\is-4DCIJ.tmp в <DRIVERS>\mbam.sys
- <DRIVERS>\is-LNBIN.tmp в <DRIVERS>\mbamchameleon.sys
- %ProgramFiles%\Malwarebytes Anti-Malware\is-GIQM2.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\mbamsrv.dll
- %ProgramFiles%\Malwarebytes Anti-Malware\is-A7M6D.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\mbampt.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\is-22UIV.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\mbamdor.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\is-8GB63.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\license.rtf
- %ProgramFiles%\Malwarebytes Anti-Malware\is-KBIQ7.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\mbam.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\is-7957B.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\mbamservice.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\is-S6A25.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\mbamscheduler.exe
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-VK7NP.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_sl.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-5QQ1Q.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_sv.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-IT789.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_tr.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-GUSLE.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_ro.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-ENL7D.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_ru.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-ICJQD.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_sk.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-4D9DS.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_vi.qm
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\is-H3A51.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\swissarmy.ref
- %ProgramFiles%\Malwarebytes Anti-Malware\is-U046Q.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\master.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\is-2NFN8.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\net.conf
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-5UT41.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_zh_TW.qm
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\is-6VJM1.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\rules.ref
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\is-LPH0A.tmp в %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\actions.ref
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-A6NUP.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_it.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-16NCL.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_ja.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-C5F55.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_ko.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-C9C8V.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_he.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-TTQRP.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_hu.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-LETU2.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_id.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-SKJ01.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_lt.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-496PT.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_pl.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-E7CNU.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_pt_BR.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-DA9GA.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_pt_PT.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-0JF7K.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_lv.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-ANHJR.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_nl.qm
- %ProgramFiles%\Malwarebytes Anti-Malware\Languages\is-CAFG5.tmp в %ProgramFiles%\Malwarebytes Anti-Malware\Languages\lang_no.qm
Подменяет следующие файлы:
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\marketing.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\scheduler.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\manifest.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\build.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\database.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\statistics.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\settings.conf
- %ProgramFiles%\Malwarebytes Anti-Malware\mbam.exe
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\license.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\gatekeeper.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\notifications.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore\net.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\manifest.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\marketing.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\database.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\net.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\build.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\scheduler.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\settings.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\license.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\notifications.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\statistics.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Configuration\gatekeeper.conf
Другое:
Ищет следующие окна:
- ClassName: 'ToolbarWindow32' WindowName: 'Notification Area'
- ClassName: 'ToolbarWindow32' WindowName: 'User Promoted Notification Area'
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
