Техническая информация
Вредоносные функции
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
- iexplore.exe
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\local.tmp
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\19.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\32.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\32g.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\38.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\48.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\manifest.json
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\ogrpetaman.js
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\popup.html
- %TEMP%\7z.10448d\c3\prefs.json
- %TEMP%\7z.10448d\qds@qds.json
- %TEMP%\7z.10448d\qds@qds.xpi
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\background.html
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\background.js
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\128.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\16.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\contentscript.js
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\css\ext-main.css
- %LOCALAPPDATA%low\quandashi\qds1.old
- %TEMP%\7z.10448d\setting.dat
- %TEMP%\7z.10448d\s3\prefs.json
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\popup.html
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\ogrpetaman.js
- %TEMP%\7z.10448d\bs\logos\48.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\manifest.json
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\38.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\32g.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\32.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\19.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\16.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\128.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\jquery.js
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\jquery.js
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\css\ext-main.css
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\contentscript.js
- %TEMP%\7z.10448d\bs\default.ico
- %TEMP%\7z.10448d\bs\extra\iframe.js
- %TEMP%\7z.10448d\bs\images\baokuan.png
- %TEMP%\7z.10448d\bs\images\baokuan2.png
- %TEMP%\7z.10448d\bs\images\huanyipi.png
- %TEMP%\7z.10448d\bs\images\lijian.png
- %TEMP%\7z.10448d\bs\images\lijian2.png
- %TEMP%\7z.10448d\bs\images\logotxt.png
- %TEMP%\7z.10448d\bs\images\lookgoods.png
- %TEMP%\7z.10448d\bs\images\manjian.png
- %TEMP%\7z.10448d\bs\images\manjian2.png
- %TEMP%\7z.10448d\bs\images\new.png
- %TEMP%\7z.10448d\bs\images\new2.png
- %TEMP%\7z.10448d\bs\images\search.png
- %TEMP%\7z.10448d\bs\default-big.png
- %TEMP%\7z.10448d\bs\images\set.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\background.js
- %TEMP%\7z.10448d\bs\jquery.js
- %TEMP%\7z.10448d\bs\logos\128.png
- %TEMP%\7z.10448d\bs\logos\16.png
- %TEMP%\7z.10448d\bs\logos\19.png
- %TEMP%\7z.10448d\bs\logos\32.png
- %TEMP%\7z.10448d\bs\logos\32g.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\48.png
- %TEMP%\7z.10448d\bs\logos\38.png
- %LOCALAPPDATA%low\wanggouzhushou\wgzs1.cfg
- %TEMP%\7z.10448d\bs\popup.css
- %TEMP%\7z.10448d\bs\popup.html
- %TEMP%\7z.10448d\bs\popup.js
- %TEMP%\7z.10448d\bs\qds.js
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\background.html
- %TEMP%\7z.10448d\bs\manifest.xml
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\38.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.js
- %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\manifest-000002
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\css\ext-main.css
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\extra\iframe.js
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\baokuan.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\baokuan2.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\huanyipi.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lijian.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lijian2.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\logotxt.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lookgoods.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\manjian.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\manjian2.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\new.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\new2.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\popup.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\qds.js
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\search.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\set.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.html
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.css
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\manifest.json
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\jquery.js
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\contentscript.js
- %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\manifest-000001
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\background.js
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\48.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\38.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\32g.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\32.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\19.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\16.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\popup.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\popup.css
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\log
- %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\000003.log
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\css\ext-main.css
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\extra\iframe.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\baokuan.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\baokuan2.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\huanyipi.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\lijian.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\lijian2.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\logotxt.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\lookgoods.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\manjian.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\manjian2.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\new.png
- %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\000002.dbtmp
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\new2.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\jquery.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\search.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\set.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\16.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\19.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\32.png
- %TEMP%\7z.10448d\bs\css\ext-main.css
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\32g.png
- %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\000001.dbtmp
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\_metadata\computed_hashes.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\_metadata\verified_contents.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\background.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\contentscript.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\48.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\background.html
- %TEMP%\7z.10448d\bs\contentscript.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\48.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\background.html
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\background.js
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\contentscript.js
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\css\ext-main.css
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\extra\iframe.js
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\baokuan.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\baokuan2.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\huanyipi.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lijian.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lijian2.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\logotxt.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lookgoods.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\manjian.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\qds.js
- %TEMP%\7z.10448d\b2\prefs.json
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\manjian2.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\new.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.html
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.css
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\manifest.json
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\48.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\38.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\128.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\32g.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\19.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\16.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\128.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\jquery.js
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\set.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\search.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\new2.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\popup.js
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\popup.html
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\popup.css
- %LOCALAPPDATA%\2345explorer\user data\default\page_file.dat
- %TEMP%\gqdqlr1zla.tmp
- %TEMP%\extra.zip
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\background.html
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\background.js
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\contentscript.js
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\css\ext-main.css
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\extra\iframe.js
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\baokuan.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\baokuan2.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\huanyipi.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\lijian.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\lijian2.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\logotxt.png
- %LOCALAPPDATA%\2345explorer\user data\default\page_filev2.dat
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\lookgoods.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\manifest.json
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\manjian.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\manjian2.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\new.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\new2.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\search.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\set.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\32.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\jquery.js
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.js
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\19.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\32.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\32g.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\38.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\48.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\16.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\38.png
- %TEMP%\7z.10448d\bs\background.html
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\background.html
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\css\ext-main.css
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\extra\iframe.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\baokuan.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\baokuan2.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\huanyipi.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lijian.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lijian2.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\logotxt.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lookgoods.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\manjian.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\manjian2.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\new.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\new2.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\background.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\contentscript.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\search.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\set.png
- %TEMP%\7z.10448d\bq\prefs.json
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\qds.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.html
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.css
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\qds.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\manifest.json
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\38.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\32g.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\32.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\19.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\16.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\128.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\jquery.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\background.html
- %TEMP%\7z.10448d\bg\prefs.json
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\_metadata\verified_contents.json
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\contentscript.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\css\ext-main.css
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\extra\iframe.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\baokuan.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\baokuan2.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\huanyipi.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\lijian.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\lijian2.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\logotxt.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\lookgoods.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\manjian.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\manjian2.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\new.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\new2.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\background.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\search.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\_metadata\computed_hashes.json
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\set.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\jquery.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\128.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\16.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\19.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\32.png
- %TEMP%\7z.10448d\bs\background.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\32g.png
- %TEMP%\7z.10448d\bc\prefs.json
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\manifest.json
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\popup.css
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\popup.html
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\popup.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\qds.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\48.png
- %APPDATA%\opera software\opera stable\extensions\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\qds.js
Удаляет следующие файлы
- %TEMP%\extra.zip
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\manifest.json
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.css
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.html
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\qds.js
- %TEMP%\7z.10448d\bq\prefs.json
- %TEMP%\7z.10448d\bs\background.html
- %TEMP%\7z.10448d\bs\background.js
- %TEMP%\7z.10448d\bs\contentscript.js
- %TEMP%\7z.10448d\bs\css\ext-main.css
- %TEMP%\7z.10448d\bs\default-big.png
- %TEMP%\7z.10448d\bs\default.ico
- %TEMP%\7z.10448d\bs\extra\iframe.js
- %TEMP%\7z.10448d\bs\images\baokuan.png
- %TEMP%\7z.10448d\bs\images\baokuan2.png
- %TEMP%\7z.10448d\bs\images\huanyipi.png
- %TEMP%\7z.10448d\bs\images\lijian.png
- %TEMP%\7z.10448d\bs\images\lijian2.png
- %TEMP%\7z.10448d\bs\images\logotxt.png
- %TEMP%\7z.10448d\bs\images\lookgoods.png
- %TEMP%\7z.10448d\bs\images\manjian.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\48.png
- %TEMP%\7z.10448d\bs\images\manjian2.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\38.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\32.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\background.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\contentscript.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\css\ext-main.css
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\extra\iframe.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\baokuan.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\baokuan2.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\huanyipi.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lijian.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lijian2.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\logotxt.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lookgoods.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\manjian.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\manjian2.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\new.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\new2.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\search.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\set.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\jquery.js
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\128.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\16.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\19.png
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\32g.png
- %TEMP%\7z.10448d\bs\images\new.png
- %TEMP%\7z.10448d\bs\images\new2.png
- %TEMP%\7z.10448d\bs\images\search.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\ogrpetaman.js
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\popup.html
- %TEMP%\7z.10448d\c3\prefs.json
- %TEMP%\7z.10448d\qds@qds.json
- %TEMP%\7z.10448d\qds@qds.xpi
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\background.html
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\background.js
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\contentscript.js
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\css\ext-main.css
- %TEMP%\7z.10448d\s3\prefs.json
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\jquery.js
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\16.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\19.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\32.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\32g.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\38.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\48.png
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\manifest.json
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\ogrpetaman.js
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\popup.html
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\48.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\manifest.json
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\38.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\32g.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\32.png
- %TEMP%\7z.10448d\bs\jquery.js
- %TEMP%\7z.10448d\bs\logos\128.png
- %TEMP%\7z.10448d\bs\logos\16.png
- %TEMP%\7z.10448d\bs\logos\19.png
- %TEMP%\7z.10448d\bs\logos\32.png
- %TEMP%\7z.10448d\bs\logos\32g.png
- %TEMP%\7z.10448d\bs\logos\38.png
- %TEMP%\7z.10448d\bs\logos\48.png
- %TEMP%\7z.10448d\bs\manifest.xml
- %TEMP%\7z.10448d\bq\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\background.html
- %TEMP%\7z.10448d\bs\popup.html
- %TEMP%\7z.10448d\bs\popup.css
- %TEMP%\7z.10448d\bs\qds.js
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\background.html
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\background.js
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\contentscript.js
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\css\ext-main.css
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\jquery.js
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\128.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\16.png
- %TEMP%\7z.10448d\c3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\19.png
- %TEMP%\7z.10448d\bs\images\set.png
- %TEMP%\7z.10448d\bs\popup.js
- %TEMP%\7z.10448d\s3\mkmopioaanjdfgcakgcompjellfodlam\1.2.1.4_0\logos\128.png
- %TEMP%\7z.10448d\bg\prefs.json
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\19.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\32g.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\38.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\48.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\manifest.json
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\popup.css
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\popup.html
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\popup.js
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\qds.js
- %TEMP%\7z.10448d\b2\prefs.json
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\background.html
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\background.js
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\contentscript.js
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\css\ext-main.css
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\extra\iframe.js
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\baokuan.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\baokuan2.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\huanyipi.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lijian.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lijian2.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\logotxt.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\lookgoods.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\32.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\manjian.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\19.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\128.png
- %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\current~rf105dc2.tmp
- %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\manifest-000001
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\background.html
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\background.js
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\contentscript.js
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\css\ext-main.css
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\extra\iframe.js
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\baokuan.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\baokuan2.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\huanyipi.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\lijian.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\lijian2.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\logotxt.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\lookgoods.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\manjian.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\manjian2.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\new.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\new2.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\search.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\images\set.png
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\jquery.js
- %TEMP%\7z.10448d\b2\pngdbkjbnipaepjldfjbnnegiepmhegp\1.4.1.7_0\logos\16.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\manjian2.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\new.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\new2.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\lookgoods.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\manjian.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\manjian2.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\new.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\new2.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\search.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\set.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\jquery.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\128.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\_metadata\computed_hashes.json
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\16.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\32.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\32g.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\38.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\logos\48.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\manifest.json
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\popup.css
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\popup.html
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\popup.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\qds.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\lijian2.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\logotxt.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\lijian.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\huanyipi.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\baokuan2.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\set.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\jquery.js
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\128.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\16.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\19.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\32.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\32g.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\38.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\logos\48.png
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\_metadata\verified_contents.json
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.css
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\manifest.json
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.js
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\qds.js
- %TEMP%\7z.10448d\bc\prefs.json
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\background.html
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\background.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\contentscript.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\css\ext-main.css
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\extra\iframe.js
- %TEMP%\7z.10448d\bg\nebcijjbphjmagedbbbjbkfoccjpapil\1.0.1.7_0\images\baokuan.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\images\search.png
- %TEMP%\7z.10448d\bc\nebcijjbphjmagedbbbjbkfoccjpapil\1.2.1.7_0\popup.html
- %TEMP%\7z.10448d\setting.dat
Перемещает следующие файлы
- %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\000001.dbtmp в %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\current
- %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\000002.dbtmp в %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\current
- %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\current в %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\current~rf105dc2.tmp
Подменяет следующие файлы
- %LOCALAPPDATA%\google\chrome\user data\default\local extension settings\nebcijjbphjmagedbbbjbkfoccjpapil\current
Сетевая активность
TCP
Запросы HTTP GET
- http://gz.###renvip.com/2.gif?dv#################################################################################################################################################################...
- http://gz.###renvip.com/qxz/xbsd.htm?dv################################################################################################################################################
- http://gz.###renvip.com/qxz/dqcnm.htm?dv####################################################################################################################################################
- http://gz.###renvip.com/l17.gif?dv###############################################################################################################################################################...
- http://gz.###renvip.com/l13.gif?dv###############################################################################################################################################################...
- http://cs#.##arenvip.com/kz20/bd/12901121600202/GqdQLR1zLa.tmp
- http://gz.###renvip.com/l10.gif?dv###############################################################################################################################################################...
- http://gz.###renvip.com/7.gif?dv#################################################################################################################################################################...
UDP
- DNS ASK gz.###renvip.com
- DNS ASK cs#.##arenvip.com
