Техническая информация
Вредоносные функции
Регистрирует BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8EE4834E-57F3-554D-A963-2974C8CE5FED}]
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\36422840\5_r.dat
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\guest\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\guest\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- <LS_APPDATA>\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- <LS_APPDATA>\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- <LS_APPDATA>\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- <LS_APPDATA>\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- <LS_APPDATA>\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- <LS_APPDATA>\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- <LS_APPDATA>\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- <LS_APPDATA>\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- <LS_APPDATA>\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\administrator\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\administrator\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- <LS_APPDATA>\torch\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- <LS_APPDATA>\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- <LS_APPDATA>\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- <LS_APPDATA>\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ouo.yu875@amdiioao.edu\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ouo.yu875@amdiioao.edu\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ouo.yu875@amdiioao.edu\content\bg.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ouo.yu875@amdiioao.edu\install.rdf
- %ProgramFiles(x86)%\surff and. keep\49.tlb
- %ProgramFiles(x86)%\surff and. keep\49.dat
- <LS_APPDATA>low\{8ee4834e-57f3-554d-a963-2974c8ce5fed}\surff and. keep.2.9.dat
- %ProgramFiles(x86)%\surff and. keep\49.x64.dll
- <LS_APPDATA>\packages\windows_ie_ac_001\ac\{8ee4834e-57f3-554d-a963-2974c8ce5fed}\surff and. keep.2.9.dat
- %PROGRAMDATA%\surff and. keep\5_r.exe
- <LS_APPDATA>\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- <LS_APPDATA>\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- <LS_APPDATA>\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- <LS_APPDATA>\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- %TEMP%\36422840\5_r.exe
- %TEMP%\36422840\49.x64.dll
- %TEMP%\36422840\49.tlb
- %TEMP%\36422840\49.dll
- %TEMP%\36422840\ouo.yu875@amdiioao.edu\content\bg.js
- %TEMP%\36422840\ouo.yu875@amdiioao.edu\install.rdf
- %TEMP%\36422840\ouo.yu875@amdiioao.edu\chrome.manifest
- %TEMP%\36422840\ouo.yu875@amdiioao.edu\bootstrap.js
- %TEMP%\36422840\lhdnmkkhaeaeomfngjhlinlinjpfngof\lsdb.js
- %TEMP%\36422840\lhdnmkkhaeaeomfngjhlinlinjpfngof\content.js
- %TEMP%\36422840\lhdnmkkhaeaeomfngjhlinlinjpfngof\manifest.json
- %TEMP%\36422840\lhdnmkkhaeaeomfngjhlinlinjpfngof\background.html
- %TEMP%\36422840\lhdnmkkhaeaeomfngjhlinlinjpfngof\mznm.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- <LS_APPDATA>\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- <LS_APPDATA>\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- <LS_APPDATA>\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- <LS_APPDATA>\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- <LS_APPDATA>\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- <LS_APPDATA>\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- <LS_APPDATA>\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- <LS_APPDATA>\google\chrome\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- %PROGRAMDATA%\surff and. keep\5_r.dat
- %ProgramFiles(x86)%\surff and. keep\49.dll
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\manifest.json
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\lhdnmkkhaeaeomfngjhlinlinjpfngof\2.3\mznm.js
- %PROGRAMDATA%\15d0dd579e2c23d9\{a35ca8ff-cb7d-8361-1cb9-83219cd11c78}.20190928224312
Удаляет следующие файлы
- %TEMP%\36422840\5_r.exe
- %TEMP%\36422840\ouo.yu875@amdiioao.edu\install.rdf
Другое
Создает и запускает на исполнение
- '%TEMP%\36422840\5_r.exe' "<LS_APPDATA>\Temp/36422840/5_R.exe"
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\surff And. keep\49.x64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\surff And. keep\49.x64.dll"
