Trojan.Siggen10.22518

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\8EDAD8E8FEEE] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\8EDAD8E8FEEE] 'ImagePath' = '%WINDIR%\8EDAD8E8FEEE.sys'

Создает следующие сервисы

'8EDAD8E8FEEE' %WINDIR%\8EDAD8E8FEEE.sys

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im opera.exe

Внедряет код в

следующие системные процессы:

%WINDIR%\syswow64\rundll32.exe

следующие пользовательские процессы:

firefox.exe

Читает файлы, отвечающие за хранение паролей сторонними программами

%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%APPDATA%\mozilla\firefox\profiles.ini
%APPDATA%\opera software\opera stable\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Изменения в файловой системе

Создает следующие файлы

%TEMP%\yandex.exe
%TEMP%\scoped_dir_596_11374\crx_install\_locales\el\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\en_gb\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\en_us\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\es\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\es_419\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\et\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\fi\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\fil\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\fr\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\he\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\hi\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\hr\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\id\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\it\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\ja\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\ko\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\lt\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\lv\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\ms\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\nl\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\pl\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\pt_br\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\pt_pt\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\da\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\de\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\hu\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\ro\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\bg\messages.json
%TEMP%\1600391458340\default\login data
%TEMP%\1600391458340\default\gcm store\log
%TEMP%\1600391458340\default\cache\data_0
%TEMP%\1600391458340\default\cache\data_1
%TEMP%\1600391458340\default\cache\data_2
%TEMP%\1600391458340\default\cache\data_3
%TEMP%\1600391458340\default\b2cb.tmp
%TEMP%\1600391458340\default\history
%TEMP%\1600391458340\default\favicons-journal
%TEMP%\etilqs_kjyapwpavdupfib
%TEMP%\1600391458340\default\favicons
%TEMP%\1600391458340\default\visited links
%TEMP%\1600391458340\default\cookies-journal
%TEMP%\etilqs_0dhjerdswa9hhi3
%TEMP%\1600391458340\default\cookies
%TEMP%\1600391458340\default\gpucache\index
%TEMP%\1600391458340\default\gpucache\data_0
%TEMP%\1600391458340\default\gpucache\data_1
%TEMP%\1600391458340\default\gpucache\data_2
%TEMP%\1600391458340\default\gpucache\data_3
%TEMP%\scoped_dir_596_12892\crx_install\manifest.json
%TEMP%\scoped_dir_596_11374\crx_install\manifest.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\ar\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\ca\messages.json
%TEMP%\etilqs_y8irvutlwstb51j
%TEMP%\scoped_dir_596_11374\crx_install\_locales\cs\messages.json
%WINDIR%\8edad8e8feee.sys
%TEMP%\scoped_dir_596_11374\crx_install\_locales\sk\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\hu\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\it\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\ja\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\ko\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\lt\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\lv\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\nl\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\pl\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\pt_br\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\pt_pt\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\ro\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\sl\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\sk\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\sr\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\sv\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\th\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\tr\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\uk\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\vi\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\zh_cn\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\zh_tw\messages.json
%TEMP%\1600391458340\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\manifest-000001
%TEMP%\1600391458340\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000001.dbtmp
%TEMP%\scoped_dir_596_21355\crx_install\_locales\hr\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\hi\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\id\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\he\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\fr\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\sr\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\th\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\tr\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\uk\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\vi\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\zh_cn\messages.json
%TEMP%\scoped_dir_596_11374\crx_install\_locales\zh_tw\messages.json
%TEMP%\1600391458340\default\databases\databases.db-journal
%TEMP%\etilqs_kdrdc5efugbdagr
%TEMP%\1600391458340\default\databases\databases.db
%TEMP%\1600391458340\default\quotamanager-journal
%TEMP%\1600391458340\default\login data-journal
%TEMP%\etilqs_1s1bkx1zdvzjezg
%TEMP%\1600391458340\default\cache\index
%TEMP%\scoped_dir_596_21355\crx_install\manifest.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\bg\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\ca\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\cs\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\da\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\de\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\el\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\en\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\es\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\fi\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\fil\messages.json
%TEMP%\1600391458340\default\quotamanager
%TEMP%\scoped_dir_596_11374\crx_install\_locales\sv\messages.json
%TEMP%\scoped_dir_596_21355\crx_install\_locales\ar\messages.json
%TEMP%\scoped_dir_596_32641\gmail.crx
%TEMP%\b9b2.tmp
%TEMP%\scoped_dir_596_22206\search.crx
%APPDATA%\opera software\opera stable\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\background.js
%APPDATA%\opera software\opera stable\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\book.js
%APPDATA%\opera software\opera stable\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\jquery-1.8.3.min.js
%APPDATA%\opera software\opera stable\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\popup.js
%APPDATA%\opera software\opera stable\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\manifest.json
%TEMP%\1600391418116
%LOCALAPPDATA%\cookies1600391418070
%LOCALAPPDATA%\cookies.sqlite1600391419520
%LOCALAPPDATA%\cookies.sqlite1600391419520-shm
%LOCALAPPDATA%\login data1600391419973
%LOCALAPPDATA%\cookies1600391419988
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\default\moz-extension+++fe0ddd3d-a6f9-4fcf-9fa1-04ee736f082a\.metadata-v2
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\default\moz-extension+++c9cdd9b2-a8a6-4f4c-8167-86f19e1820e6^usercontextid=4294967295\.metadata-v2
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\default\moz-extension+++d1f351cc-31ff-421b-b87d-57d5cb71c1f8^usercontextid=4294967295\.metadata-v2
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\default\moz-extension+++68c56b1f-25b6-4a97-b66d-eb454bcdbf0f^usercontextid=4294967295\.metadata-v2
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\default\moz-extension+++fe0ddd3d-a6f9-4fcf-9fa1-04ee736f082a^usercontextid=4294967295\.metadata-v2
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\default\moz-extension+++d1f351cc-31ff-421b-b87d-57d5cb71c1f8^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sqlite
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\default\moz-extension+++fe0ddd3d-a6f9-4fcf-9fa1-04ee736f082a^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sqlite
%APPDATA%\opera software\opera stable\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\icon.png
%LOCALAPPDATA%\login data1600391417945
%APPDATA%\opera software\opera stable\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\popup.html
%TEMP%\1600391418038
%LOCALAPPDATA%\google\chrome\user data\default\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\manifest.json
%LOCALAPPDATA%\scrsnap\pgort80.dll
%LOCALAPPDATA%\scrsnap\resource\back.bmp
%LOCALAPPDATA%\scrsnap\resource\brush.bmp
%LOCALAPPDATA%\scrsnap\resource\close.bmp
%LOCALAPPDATA%\scrsnap\resource\copy.bmp
%LOCALAPPDATA%\scrsnap\resource\header.bmp
%LOCALAPPDATA%\scrsnap\resource\save.bmp
%LOCALAPPDATA%\scrsnap\resource\text.bmp
%LOCALAPPDATA%\scrsnap\resource\undo.bmp
%LOCALAPPDATA%\scrsnap\scrsnap.ini
%LOCALAPPDATA%\scrsnap\scrsnap.exe
%LOCALAPPDATA%\scrsnap\unstall.exe
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\default\moz-extension+++c9cdd9b2-a8a6-4f4c-8167-86f19e1820e6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sqlite
%TEMP%\1600391458340\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\log
%LOCALAPPDATA%\scrsnap\pgodb80.dll
%HOMEPATH%\desktop\scrsnap.lnk
%TEMP%\1600391417383
%LOCALAPPDATA%\crx.7z
%LOCALAPPDATA%\crx.json
%LOCALAPPDATA%\google\chrome\user data\default\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\icon.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\icon48.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\popup.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\background.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\book.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\jquery-1.8.3.min.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\popup.js
%LOCALAPPDATA%\scrsnap.7z
%LOCALAPPDATA%\scrsnap\scrsnap.dll
%TEMP%\scoped_dir_596_21355\crx_install\_locales\sl\messages.json
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\default\moz-extension+++68c56b1f-25b6-4a97-b66d-eb454bcdbf0f^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sqlite
%LOCALAPPDATA%\web data1600391428896
%TEMP%\1600391458340\default\extension rules\000001.dbtmp
%TEMP%\1600391458340\default\extension rules\log
%TEMP%\1600391458340\default\web data-journal
%TEMP%\etilqs_xrutrx5vcivymub
%TEMP%\1600391458340\default\history-journal
%TEMP%\etilqs_q3xbthfyih0xffd
%TEMP%\1600391458340\default\web data
%TEMP%\b8d4.tmp
%TEMP%\1600391458340\default\top sites-journal
%TEMP%\etilqs_dur8gak65jbuqnk
%APPDATA%\opera software\opera stable\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\icon48.png
%TEMP%\1600391458340\default\top sites
%TEMP%\1600391458340\default\shortcuts-journal
%TEMP%\1600391458340\default\shortcuts
%TEMP%\1600391458340\default\network action predictor-journal
%TEMP%\1600391458340\default\gcm store\000001.dbtmp
%TEMP%\scoped_dir_596_12892\docs.crx
%TEMP%\b971.tmp
%TEMP%\scoped_dir_596_11374\drive.crx
%TEMP%\b991.tmp
%TEMP%\scoped_dir_596_21355\youtube.crx
%TEMP%\1600391458340\default\network action predictor
%TEMP%\b9a2.tmp
%TEMP%\1600391458340\default\chromedwritefontcache
%TEMP%\1600391458340\default\gcm store\manifest-000001
%TEMP%\1600391458340\default\extension rules\manifest-000001
%TEMP%\1600391463114
%TEMP%\1600391458340\safe browsing uws list prefix set
%TEMP%\1600391458340\safe browsing uws list
%LOCALAPPDATA%webdata1600391428990
%LOCALAPPDATA%\login data1600391433240
%LOCALAPPDATA%\cookies1600391433240
%LOCALAPPDATA%\web data1600391433255
%LOCALAPPDATA%webdata1600391433255
%LOCALAPPDATA%\login data1600391434581
%LOCALAPPDATA%\cookies1600391434597
%LOCALAPPDATA%\cookies.sqlite1600391434628
%LOCALAPPDATA%\cookies.sqlite1600391434628-shm
%LOCALAPPDATA%\login data1600391435018
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\default\moz-extension+++fe0ddd3d-a6f9-4fcf-9fa1-04ee736f082a\idb\61413404gyreekansoem.sqlite
%LOCALAPPDATA%\cookies1600391435018
%LOCALAPPDATA%\login data1600391428756
%WINDIR%\temp\udd7177.tmp
%TEMP%\1600391458340\local state
%TEMP%\1600391458340\safe browsing bloom
%TEMP%\1600391458340\safe browsing bloom prefix set
%TEMP%\1600391458340\safe browsing cookies
%TEMP%\1600391458340\safe browsing cookies-journal
%TEMP%\1600391458340\safe browsing csd whitelist
%TEMP%\1600391458340\safe browsing download
%TEMP%\1600391458340\safe browsing download whitelist
%TEMP%\1600391458340\safe browsing extension blacklist
%TEMP%\1600391458340\safe browsing inclusion whitelist
%LOCALAPPDATA%\cookies1600391428771
%TEMP%\1600391458340\safe browsing ip blacklist
%TEMP%\1600391458340\chrome_shutdown_ms.txt
%TEMP%\1600391458340\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000003.log

Удаляет следующие файлы

%LOCALAPPDATA%\scrsnap.7z
%TEMP%\b8d4.tmp
%TEMP%\b971.tmp
%TEMP%\b991.tmp
%TEMP%\b9a2.tmp
%TEMP%\b9b2.tmp
%TEMP%\1600391458340\default\b2cb.tmp
%TEMP%\scoped_dir_596_12892\crx_install\icon_128.png
%TEMP%\scoped_dir_596_12892\crx_install\icon_16.png
%TEMP%\scoped_dir_596_12892\decoded_images
%TEMP%\scoped_dir_596_12892\decoded_message_catalogs
%TEMP%\scoped_dir_596_12892\docs.crx
%TEMP%\scoped_dir_596_11374\crx_install\128.png
%TEMP%\scoped_dir_596_11374\decoded_images
%TEMP%\scoped_dir_596_11374\decoded_message_catalogs
%TEMP%\scoped_dir_596_11374\drive.crx
%TEMP%\scoped_dir_596_21355\crx_install\128.png
%TEMP%\scoped_dir_596_21355\decoded_images
%TEMP%\scoped_dir_596_21355\decoded_message_catalogs
%TEMP%\scoped_dir_596_21355\youtube.crx
%TEMP%\scoped_dir_596_22206\crx_install\128.png
%TEMP%\scoped_dir_596_22206\crx_install\16.png
%TEMP%\scoped_dir_596_22206\crx_install\32.png
%TEMP%\scoped_dir_596_22206\crx_install\48.png
%TEMP%\scoped_dir_596_22206\search.crx
%TEMP%\scoped_dir_596_32641\crx_install\128.png
%TEMP%\1600391458340\chrome_shutdown_ms.txt
%TEMP%\1600391458340\local state~rf123774.tmp
%TEMP%\1600391463114
%LOCALAPPDATA%\cookies1600391435018
%LOCALAPPDATA%\crx.json
%LOCALAPPDATA%\crx.7z
%TEMP%\1600391417383
%LOCALAPPDATA%\login data1600391417945
%TEMP%\1600391418038
%LOCALAPPDATA%\cookies1600391418070
%LOCALAPPDATA%\cookies.sqlite1600391419520-shm
%LOCALAPPDATA%\cookies.sqlite1600391419520
%LOCALAPPDATA%\login data1600391419973
%LOCALAPPDATA%\cookies1600391419988
%TEMP%\1600391418116
%LOCALAPPDATA%\login data1600391428756
%LOCALAPPDATA%\cookies1600391428771
%LOCALAPPDATA%\web data1600391428896
%LOCALAPPDATA%webdata1600391428990
%TEMP%\yandex.exe
%LOCALAPPDATA%\login data1600391433240
%LOCALAPPDATA%\cookies1600391433240
%LOCALAPPDATA%\web data1600391433255
%LOCALAPPDATA%webdata1600391433255
%LOCALAPPDATA%\login data1600391434581
%LOCALAPPDATA%\cookies1600391434597
%LOCALAPPDATA%\cookies.sqlite1600391434628-shm
%LOCALAPPDATA%\cookies.sqlite1600391434628
%LOCALAPPDATA%\login data1600391435018
%WINDIR%\temp\udd7177.tmp
%TEMP%\scoped_dir_596_32641\gmail.crx

Перемещает следующие файлы

%LOCALAPPDATA%\google\chrome\user data\default\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\book.js в %LOCALAPPDATA%\google\chrome\user data\default\extensions\dgjpmndjkklbmbopefiepialhdgobool\1.0.0.0_0\d8yi+hf7rx.js
%TEMP%\1600391458340\default\extension rules\000001.dbtmp в %TEMP%\1600391458340\default\extension rules\current
%TEMP%\1600391458340\default\gcm store\000001.dbtmp в %TEMP%\1600391458340\default\gcm store\current
%TEMP%\1600391458340\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000001.dbtmp в %TEMP%\1600391458340\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\current
%TEMP%\1600391458340\local state в %TEMP%\1600391458340\local state~rf123774.tmp

Подменяет следующие файлы

%LOCALAPPDATA%\crx.7z
%LOCALAPPDATA%\crx.json
%TEMP%\scoped_dir_596_12892\crx_install\icon_128.png
%TEMP%\scoped_dir_596_12892\crx_install\icon_16.png
%TEMP%\scoped_dir_596_11374\crx_install\128.png
%TEMP%\scoped_dir_596_21355\crx_install\128.png

Самоудаляется.

Сетевая активность

Подключается к

'08#####1fac71ad2.xyz':80

TCP

Запросы HTTP GET

http://08#####1fac71ad2.xyz/info/big
http://08#####1fac71ad2.xyz/info/r

Запросы HTTP POST

http://08#####1fac71ad2.xyz/info/e
http://08#####1fac71ad2.xyz/info/g
http://08#####1fac71ad2.xyz/info/w

'we###.wamesheet.com':443

UDP

DNS ASK 08#####1fac71ad2.xyz
DNS ASK we###.wamesheet.com
DNS ASK google.com

Другое

Добавляет корневой сертификат

Ищет следующие окна

ClassName: '' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\1600391458340'
ClassName: 'Chrome_RenderWidgetHostHWND' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\yandex.exe' 0011 user01
'%TEMP%\yandex.exe' 200 user01
'%TEMP%\yandex.exe' 300 user01
'%TEMP%\yandex.exe' 0011 user01' (со скрытым окном)
'%TEMP%\yandex.exe' 200 user01' (со скрытым окном)
'%TEMP%\yandex.exe' 300 user01' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "<Полный путь к файлу>"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im opera.exe' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "%TEMP%\Yandex.exe"' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe
'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "<Полный путь к файлу>"
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im opera.exe
'%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "%TEMP%\Yandex.exe"
'%WINDIR%\syswow64\rundll32.exe'
'%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data" "%TEMP%\1600391458340\" /e
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --window-position=0,-5000 --user-data-dir="%TEMP%\1600391458340" http://www.in####stvideo.com/video1.php
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="596.0.1643977044\1977237725" --user-data-dir="%TEMP%\1600391458340" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-de...
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptivePo...
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptiveP...

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней