Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\luban] 'ImagePath' = '%APPDATA%\122640331\luban.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\luban] 'Start' = '00000002'
- '%APPDATA%\122640331\luban.exe'
- '%APPDATA%\122640331\lubanAssist.exe' BootDoThings
- '%TEMP%\is-HJIJ0.tmp\<Имя файла>.tmp' /SL5="$30092,1054400,56832,<Полный путь к файлу>"
- '%APPDATA%\122640331\luban.exe' -i
- '<SYSTEM32>\net.exe' start luban
- '<SYSTEM32>\net1.exe' start luban
- '<SYSTEM32>\sc.exe' delete luban
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\122640331\DataView.dll"
- '<SYSTEM32>\sc.exe' stop luban
- %APPDATA%\122640331\resource\is-KN8CF.tmp
- %APPDATA%\122640331\resource\is-NLLB9.tmp
- %APPDATA%\122640331\resource\is-EKSHL.tmp
- %APPDATA%\122640331\resource\is-FQIVO.tmp
- %APPDATA%\122640331\resource\is-2UGEU.tmp
- %APPDATA%\122640331\resource\is-CMJEI.tmp
- %APPDATA%\122640331\resource\is-G081H.tmp
- %APPDATA%\122640331\resource\is-BM6U2.tmp
- %APPDATA%\122640331\resource\is-9UT29.tmp
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\is-9UP2P.tmp
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_CN\is-OT1LJ.tmp
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-39NGB.tmp
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-UFC1S.tmp
- %APPDATA%\122640331\resource\is-4G68T.tmp
- %APPDATA%\122640331\resource\is-V42V9.tmp
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-90PQT.tmp
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-T0SPM.tmp
- %APPDATA%\122640331\resource\is-RBB51.tmp
- %APPDATA%\122640331\resource\DirectUI\is-P3HMS.tmp
- %APPDATA%\122640331\resource\DirectUI\is-TKU4O.tmp
- %APPDATA%\122640331\resource\DirectUI\is-CC63D.tmp
- %APPDATA%\122640331\resource\DirectUI\is-1H3PU.tmp
- %APPDATA%\122640331\is-I6IEE.tmp
- %APPDATA%\122640331\is-8D2PI.tmp
- %APPDATA%\122640331\xmlconfig\is-LR6SE.tmp
- %APPDATA%\122640331\xmlconfig\is-N1FE2.tmp
- %APPDATA%\122640331\resource\is-MGDL5.tmp
- %APPDATA%\122640331\resource\is-J1AOU.tmp
- %APPDATA%\122640331\resource\is-EOURT.tmp
- %APPDATA%\122640331\resource\is-V0LEH.tmp
- %APPDATA%\122640331\resource\is-MGJSD.tmp
- %APPDATA%\122640331\resource\is-N6NB5.tmp
- %APPDATA%\122640331\resource\is-HM79U.tmp
- %APPDATA%\122640331\resource\is-KVJG0.tmp
- %APPDATA%\122640331\resource\is-70JEL.tmp
- %APPDATA%\122640331\is-6P2SB.tmp
- %APPDATA%\122640331\is-V72RR.tmp
- %APPDATA%\122640331\is-04SSH.tmp
- %APPDATA%\122640331\is-D6F99.tmp
- %APPDATA%\122640331\extensions\is-TDNTM.tmp
- %APPDATA%\122640331\extensions\is-8CA5J.tmp
- %APPDATA%\122640331\extensions\is-MA0QN.tmp
- %APPDATA%\122640331\extensions\is-DIKRB.tmp
- %APPDATA%\122640331\is-3EGS1.tmp
- %TEMP%\is-QHKTE.tmp\ISTask.dll
- %APPDATA%\122640331\is-B79NK.tmp
- %TEMP%\is-HJIJ0.tmp\<Имя файла>.tmp
- %TEMP%\is-QHKTE.tmp\_isetup\_shfoldr.dll
- %APPDATA%\122640331\is-MPLSN.tmp
- %APPDATA%\122640331\is-BVB6I.tmp
- %APPDATA%\122640331\is-K7OEA.tmp
- %APPDATA%\122640331\is-MND90.tmp
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-CSRQD.tmp
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-0BKHK.tmp
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-8JVPP.tmp
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-U7G2M.tmp
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-TMS7K.tmp
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-HDPAJ.tmp
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-NCI1M.tmp
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-4UOHR.tmp
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-LGUME.tmp
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_CN\is-H16O5.tmp
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-TP1KV.tmp
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-GNC69.tmp
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-VRC4M.tmp
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-AOU3B.tmp
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-M719N.tmp
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\is-7I1T3.tmp
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-P54R1.tmp
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-PURQ3.tmp
- %APPDATA%\122640331\DataView.dll
- %APPDATA%\122640331\resource\is-KN8CF.tmp в %APPDATA%\122640331\resource\btn_alpha.png
- %APPDATA%\122640331\resource\is-NLLB9.tmp в %APPDATA%\122640331\resource\btn_cancel.png
- %APPDATA%\122640331\resource\is-EKSHL.tmp в %APPDATA%\122640331\resource\browser.png
- %APPDATA%\122640331\resource\is-FQIVO.tmp в %APPDATA%\122640331\resource\btnBK.png
- %APPDATA%\122640331\resource\is-2UGEU.tmp в %APPDATA%\122640331\resource\btn_ok.png
- %APPDATA%\122640331\resource\is-CMJEI.tmp в %APPDATA%\122640331\resource\btn_today.png
- %APPDATA%\122640331\resource\is-G081H.tmp в %APPDATA%\122640331\resource\btn_close.png
- %APPDATA%\122640331\resource\is-BM6U2.tmp в %APPDATA%\122640331\resource\btn_min.png
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_CN\is-OT1LJ.tmp в %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_CN\messages.json
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-90PQT.tmp в %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\computed_hashes.json
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-UFC1S.tmp в %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\icon.gif
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\is-9UP2P.tmp в %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\messages.json
- %APPDATA%\122640331\resource\is-V42V9.tmp в %APPDATA%\122640331\resource\arrow_right.png
- %APPDATA%\122640331\resource\is-9UT29.tmp в %APPDATA%\122640331\resource\box_check.png
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-T0SPM.tmp в %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\verified_contents.json
- %APPDATA%\122640331\resource\is-4G68T.tmp в %APPDATA%\122640331\resource\arrow_left.png
- %APPDATA%\122640331\resource\DirectUI\is-CC63D.tmp в %APPDATA%\122640331\resource\DirectUI\scrollArrowDown.bmp
- %APPDATA%\122640331\resource\DirectUI\is-1H3PU.tmp в %APPDATA%\122640331\resource\DirectUI\scrollArrowUp.bmp
- %APPDATA%\122640331\resource\is-HM79U.tmp в %APPDATA%\122640331\resource\return.png
- %APPDATA%\122640331\resource\is-MGDL5.tmp в %APPDATA%\122640331\resource\wtl.exe.manifest
- %APPDATA%\122640331\xmlconfig\is-LR6SE.tmp в %APPDATA%\122640331\xmlconfig\install.xml
- %APPDATA%\122640331\xmlconfig\is-N1FE2.tmp в %APPDATA%\122640331\xmlconfig\riliclient.xml
- %APPDATA%\122640331\resource\DirectUI\is-P3HMS.tmp в %APPDATA%\122640331\resource\DirectUI\scrollBar.bmp
- %APPDATA%\122640331\resource\DirectUI\is-TKU4O.tmp в %APPDATA%\122640331\resource\DirectUI\srollBk.bmp
- %APPDATA%\122640331\resource\is-MGJSD.tmp в %APPDATA%\122640331\resource\License.txt
- %APPDATA%\122640331\resource\is-J1AOU.tmp в %APPDATA%\122640331\resource\logo.png
- %APPDATA%\122640331\resource\is-RBB51.tmp в %APPDATA%\122640331\resource\Calendar.ico
- %APPDATA%\122640331\resource\is-V0LEH.tmp в %APPDATA%\122640331\resource\comboxBk.png
- %APPDATA%\122640331\resource\is-70JEL.tmp в %APPDATA%\122640331\resource\now_start.png
- %APPDATA%\122640331\resource\is-N6NB5.tmp в %APPDATA%\122640331\resource\radio.png
- %APPDATA%\122640331\resource\is-EOURT.tmp в %APPDATA%\122640331\resource\mainBk.png
- %APPDATA%\122640331\resource\is-KVJG0.tmp в %APPDATA%\122640331\resource\menuButton.png
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-39NGB.tmp в %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\crx.png
- %APPDATA%\122640331\extensions\is-MA0QN.tmp в %APPDATA%\122640331\extensions\jychromeex.crx
- %APPDATA%\122640331\extensions\is-DIKRB.tmp в %APPDATA%\122640331\extensions\jySougou.sext
- %APPDATA%\122640331\is-6P2SB.tmp в %APPDATA%\122640331\lubanAssist.exe
- %APPDATA%\122640331\is-V72RR.tmp в %APPDATA%\122640331\luqing.exe
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-CSRQD.tmp в %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\background.html
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-VRC4M.tmp в %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\background.js
- %APPDATA%\122640331\extensions\is-TDNTM.tmp в %APPDATA%\122640331\extensions\sec_setting.json
- %APPDATA%\122640331\extensions\is-8CA5J.tmp в %APPDATA%\122640331\extensions\setting.json
- %APPDATA%\122640331\is-MND90.tmp в %APPDATA%\122640331\DataView64.dll
- %APPDATA%\122640331\is-MPLSN.tmp в %APPDATA%\122640331\fixfunction.dll
- %APPDATA%\122640331\is-B79NK.tmp в %APPDATA%\122640331\config.ini
- %APPDATA%\122640331\is-K7OEA.tmp в %APPDATA%\122640331\DataView.dll
- %APPDATA%\122640331\is-04SSH.tmp в %APPDATA%\122640331\kan.exe
- %APPDATA%\122640331\is-D6F99.tmp в %APPDATA%\122640331\luban.exe
- %APPDATA%\122640331\is-BVB6I.tmp в %APPDATA%\122640331\istask.dll
- %APPDATA%\122640331\is-3EGS1.tmp в %APPDATA%\122640331\jywebHelper.dll
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-0BKHK.tmp в %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\background.html
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-8JVPP.tmp в %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\background.js
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-U7G2M.tmp в %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\computed_hashes.json
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-TMS7K.tmp в %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\verified_contents.json
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-HDPAJ.tmp в %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\manifest.json
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-NCI1M.tmp в %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\popup.html
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-4UOHR.tmp в %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\calmath.js
- %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-LGUME.tmp в %APPDATA%\122640331\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\contentscript.js
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-GNC69.tmp в %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\manifest.json
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-P54R1.tmp в %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\popup.html
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-AOU3B.tmp в %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\calmath.js
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-TP1KV.tmp в %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\contentscript.js
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\is-7I1T3.tmp в %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\messages.json
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_CN\is-H16O5.tmp в %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_CN\messages.json
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-PURQ3.tmp в %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\crx.png
- %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-M719N.tmp в %APPDATA%\122640331\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\icon.gif
- %APPDATA%\122640331\DataView.dll