Техническая информация
Вредоносные функции
Внедряет код в
следующие системные процессы:
- %WINDIR%\explorer.exe
следующие пользовательские процессы:
- iexplore.exe
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\raserver.exe
следующие пользовательские процессы:
- firefox.exe
- iexplore.exe
Регистрирует BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F56C182-CCB1-6996-893C-412F96680E5D}]
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\3d77640c\vyvyjz8iq.dat
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\guest\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\guest\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- %LOCALAPPDATA%\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- %LOCALAPPDATA%\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- %LOCALAPPDATA%\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- %LOCALAPPDATA%\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- %LOCALAPPDATA%\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %APPDATA%\mozilla\firefox\profiles\xlpdq5cf.default\extensions\staged\vzsou-i@twga-aenlso.org\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\xlpdq5cf.default\extensions\staged\vzsou-i@twga-aenlso.org\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\xlpdq5cf.default\extensions\staged\vzsou-i@twga-aenlso.org\content\bg.js
- %APPDATA%\mozilla\firefox\profiles\xlpdq5cf.default\extensions\staged\vzsou-i@twga-aenlso.org\install.rdf
- %ProgramFiles(x86)%\costmin\prpu9j5n.dll
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- %ProgramFiles(x86)%\costmin\prpu9j5n.tlb
- %LOCALAPPDATA%low\{9f56c182-ccb1-6996-893c-412f96680e5d}\costmin.2.9.dat
- %ProgramFiles(x86)%\costmin\prpu9j5n.x64.dll
- %LOCALAPPDATA%\packages\windows_ie_ac_001\ac\{9f56c182-ccb1-6996-893c-412f96680e5d}\costmin.2.9.dat
- %ALLUSERSPROFILE%\costmin\vyvyjz8iq.exe
- %ALLUSERSPROFILE%\costmin\vyvyjz8iq.dat
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- %TEMP%\3d77640c\bpdbachcghpfdehbcpgoeehjdbnadbeo\lsdb.js
- %TEMP%\3d77640c\prpu9j5n.x64.dll
- %TEMP%\3d77640c\prpu9j5n.tlb
- %TEMP%\3d77640c\prpu9j5n.dll
- %TEMP%\3d77640c\vzsou-i@twga-aenlso.org\content\bg.js
- %TEMP%\3d77640c\vzsou-i@twga-aenlso.org\install.rdf
- %TEMP%\3d77640c\vzsou-i@twga-aenlso.org\chrome.manifest
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- %ALLUSERSPROFILE%\4303df3d555b6694\{ce681a67-9477-cbe6-eb9d-fe534875f98d}.20201120233846
- %TEMP%\3d77640c\vzsou-i@twga-aenlso.org\bootstrap.js
- %TEMP%\3d77640c\bpdbachcghpfdehbcpgoeehjdbnadbeo\manifest.json
- %TEMP%\3d77640c\bpdbachcghpfdehbcpgoeehjdbnadbeo\background.html
- %TEMP%\3d77640c\bpdbachcghpfdehbcpgoeehjdbnadbeo\wkmwtiuzh1.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- %TEMP%\3d77640c\vyvyjz8iq.exe
- %TEMP%\3d77640c\bpdbachcghpfdehbcpgoeehjdbnadbeo\content.js
- %ProgramFiles(x86)%\costmin\prpu9j5n.dat
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\wkmwtiuzh1.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\background.html
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\bpdbachcghpfdehbcpgoeehjdbnadbeo\2.0\content.js
- %WINDIR%\appcompat\programs\install\install_0001_08fe8a98-004d-4bd9-a0fb-8adb30da52bf.txt
Подменяет следующие файлы
- %ProgramFiles%\UNP\Logs\UpdateNotificationPipeline.001.etl
- %ALLUSERSPROFILE%\ntuser.pol
Сетевая активность
UDP
- DNS ASK share.microsoft.com
- DNS ASK go.microsoft.com
- DNS ASK settings-win.data.microsoft.com
- DNS ASK maps.windows.com
- DNS ASK dl.delivery.mp.microsoft.com
- DNS ASK ar#.msn.com
- 'ff##::fb':5353
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\3d77640c\vyvyjz8iq.exe'
Запускает на исполнение
- '<SYSTEM32>\apphostregistrationverifier.exe'
- '<SYSTEM32>\devicecensus.exe' UserCxt
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\CostMin\prPu9J5n.x64.dll"
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\CostMin\prPu9J5n.x64.dll"
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '<SYSTEM32>\compattelrunner.exe' -m:aeinv.dll -f:UpdateSoftwareInventoryW
- '<SYSTEM32>\svchost.exe' -k netsvcs -p
