Trojan.Siggen17.34917

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Processus hГґte pour les services WindowsProcessus hГґte pour les services Windows' = '%LOCALAPPDATA%\svchost.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '194327a149ecf0f0935dd3358e26c3a2' = '"%TEMP%\svchost.exe" ..'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '194327a149ecf0f0935dd3358e26c3a2' = '"%TEMP%\svchost.exe" ..'
[<HKLM>\Software\Classes\GoogleEarth.kmlfile\shell\open\command] '' = '"%ProgramFiles%\Google\Google Earth Pro\client\googleearth.exe" "%1"'
[<HKLM>\Software\Classes\GoogleEarth.kmzfile\shell\open\command] '' = '"%ProgramFiles%\Google\Google Earth Pro\client\googleearth.exe" "%1"'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\googleupdatetaskmachinecore{9f8d5ff2-a8ec-41b7-b89c-d8183bc5657a}
<SYSTEM32>\tasks\googleupdatetaskmachineua{2694287f-18a3-4d14-9301-3958d9e11af9}
%APPDATA%\microsoft\windows\start menu\programs\startup\194327a149ecf0f0935dd3358e26c3a2.exe

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\gupdate] 'Start' = '00000002'

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\svchost.exe" "svchost.exe" ENABLE

Изменения в файловой системе

Создает следующие файлы

%TEMP%\svchost.exe
%ProgramFiles%\google\google earth pro\client\res\gdal\datum_shift.csv
%ProgramFiles%\google\google earth pro\client\lang\hi.qm
%ProgramFiles%\google\google earth pro\client\res\gdal\projop_wparm.csv
%ProgramFiles%\google\google earth pro\client\res\gdal\gdal_datum.csv
%ProgramFiles%\google\google earth pro\client\res\gdal\itrf2000
%ProgramFiles%\google\google earth pro\client\shaders\watersurface.glslesv
%ProgramFiles%\google\google earth pro\client\plugins\mediaservice\wmfengine.dll
%ProgramFiles%\google\google earth pro\client\plugins\imageformats\qgif.dll
%ProgramFiles%\google\google earth pro\client\res\unknown_plugin.png
%ProgramFiles%\google\google earth pro\client\res\notifications.rcc
%ProgramFiles%\google\google earth pro\client\shaders\stfrond.glslesf
%ProgramFiles%\google\google earth pro\client\res\default_myplaces.rcc
%ProgramFiles%\google\google earth pro\client\shaders\stleafcard.arbfp1
%ProgramFiles%\google\google earth pro\client\shaders\stleafcard.glslesv
%ProgramFiles%\google\google earth pro\client\res\gdal\s57attributes.csv
%ProgramFiles%\google\google earth pro\client\lang\de.qm
%ProgramFiles%\google\google earth pro\client\igmath.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\osmconf.ini
%ProgramFiles%\google\google earth pro\client\lang\id.qm
%ProgramFiles%\google\google earth pro\client\plugins\imageformats\qsvg.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\vdv452.xml
%ProgramFiles%\google\google earth pro\client\msvcp140.dll
%ProgramFiles%\google\google earth pro\client\shaders\speedtree_configuration_glsles.h
%ProgramFiles%\google\google earth pro\client\alchemy\ogl\iggfx.dll
%ProgramFiles%\google\google earth pro\client\lang\lt.qm
%ProgramFiles%\google\google earth pro\client\shaders\stleafmesh.asd
%ProgramFiles%\google\google earth pro\client\lang\pl.qm
%ProgramFiles%\google\google earth pro\client\alchemy\ogles20\libegl.dll
%ProgramFiles%\google\google earth pro\client\shaders\stfrond.vs_2_0
%ProgramFiles%\google\google earth pro\client\alchemy\ogles20\igattrs.dll
%ProgramFiles%\google\google earth pro\client\shaders\stbillboard.vs_2_0
%ProgramFiles%\google\google earth pro\client\alchemy\ogles20\igsg.dll
%ProgramFiles%\google\google earth pro\client\res\renderui.rcc
%ProgramFiles%\google\google earth pro\client\res\balloons.rcc
%ProgramFiles%\google\google earth pro\client\igattrs.dll
%ProgramFiles%\google\google earth pro\client\qt5network.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\esri_epsg.wkt
%ProgramFiles%\google\google earth pro\client\swresample-2.dll
%ProgramFiles%\google\google earth pro\client\ssleay32.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\inspire_cp_cadastralzoning.gfs
%ProgramFiles%\google\google earth pro\client\lang\tr.qm
%ProgramFiles%\google\google earth pro\client\qt5winextras.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\esri.extra
%ProgramFiles%\google\google earth pro\client\res\gdal\gcs.override.csv
%ProgramFiles%\google\google earth pro\client\res\gdal\pcs.override.csv
%ProgramFiles%\google\google earth pro\client\shaders\stleafmesh.ps_2_0
%ProgramFiles%\google\google earth pro\client\qt5multimedia.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\pcs.csv
%ProgramFiles%\google\google earth pro\client\shaders\stbillboard.glslesv
%ProgramFiles%\google\google earth pro\client\lang\ro.qm
%ProgramFiles%\google\google earth pro\client\res\gdal\itrf2014
%ProgramFiles%\google\google earth pro\client\avutil-55.dll
%ProgramFiles%\google\google earth pro\client\res\statusbar.rcc
%ProgramFiles%\google\google earth pro\client\res\gdal\null
%ProgramFiles%\google\google earth pro\client\res\gdal\esri_wisconsin_extra.wkt
%ProgramFiles%\google\google earth pro\client\res\gdal\gmlasconf.xml
%ProgramFiles%\google\google earth pro\client\lang\cs.qm
%ProgramFiles%\google\google earth pro\client\lang\hu.qm
%ProgramFiles%\google\google earth pro\client\plugins\printsupport\windowsprintersupport.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\gmlasconf.xsd
%ProgramFiles%\google\google earth pro\client\lang\zh-hant.qm
%ProgramFiles%\google\google earth pro\client\plugins\platforms\qwindows.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\ozi_datum.csv
%ProgramFiles%\google\google earth pro\client\lang\ja.qm
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\xbox_360.ini
%ProgramFiles%\google\google earth pro\client\qt5multimediawidgets.dll
%ProgramFiles%\google\google earth pro\client\lang\fil.qm
%ProgramFiles%\google\google earth pro\client\shaders\stars.glslesv
%ProgramFiles%\google\google earth pro\client\iggfx.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\pds4_template.xml
%ProgramFiles%\google\google earth pro\client\shaders\viewshed.h
%ProgramFiles%\google\google earth pro\client\shaders\atmosphere.glsllib
%ProgramFiles%\google\google earth pro\client\shaders\stleafmesh.arbvp1
%ProgramFiles%\google\google earth pro\client\vcruntime140.dll
%ProgramFiles%\google\google earth pro\client\qt5webkitwidgets.dll
%ProgramFiles%\google\google earth pro\client\repair_tool.exe
%ProgramFiles%\google\google earth pro\client\lang\sr.qm
%ProgramFiles%\google\google earth pro\client\res\terrainmgr.rcc
%ProgramFiles%\google\google earth pro\client\plugins\mediaservice\qtmedia_audioengine.dll
%ProgramFiles%\google\google earth pro\client\avcodec-57.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\s57agencies.csv
%ProgramFiles%\google\google earth pro\client\res\gdal\nad27
%ProgramFiles%\google\google earth pro\client\shaders\stleafmesh.glslesf
%ProgramFiles%\google\google earth pro\client\res\gdal\nitf_spec.xml
%ProgramFiles%\google\google earth pro\client\shaders\stbillboard.glslesf
%ProgramFiles%\google\google earth pro\client\res\tmcontrols.rcc
%ProgramFiles%\google\google earth pro\client\res\gdal\nitf_spec.xsd
%ProgramFiles%\google\google earth pro\client\res\gdal\proj_def.dat
%ProgramFiles%\google\google earth pro\client\shaders\stfrond.cfg
%ProgramFiles%\google\google earth pro\client\shaders\stleafcard.arbvp1
%ProgramFiles%\google\google earth pro\client\qt5scripttools.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\pci_datum.txt
%ProgramFiles%\google\google earth pro\client\lang\sl.qm
%ProgramFiles%\google\google earth pro\client\res\flightsim\keyboard\sr22.ini
%ProgramFiles%\google\google earth pro\client\uninstall.ico
%ProgramFiles%\google\google earth pro\client\res\gdal\nad83
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\logitech_force_3d.ini
%ProgramFiles%\google\google earth pro\client\plugins\mediaservice\dsengine.dll
%ProgramFiles%\google\google earth pro\client\qt5widgets.dll
%ProgramFiles%\google\google earth pro\client\res\flightsim\hud\generic.ini
%ProgramFiles%\google\google earth pro\client\shaders\watersurface.glslesf
%ProgramFiles%\google\google earth pro\client\shaders\glsles.h
%ProgramFiles%\google\google earth pro\client\res\licenses.rcc
%ProgramFiles%\google\google earth pro\client\plugins\platforms\qoffscreen.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\inspire_cp_cadastralboundary.gfs
%ProgramFiles%\google\google earth pro\client\lang\el.qm
%ProgramFiles%\google\google earth pro\client\plugins\bearer\qnativewifibearer.dll
%ProgramFiles%\google\google earth pro\client\lang\lv.qm
%ProgramFiles%\google\google earth pro\client\res\gdal\gt_datum.csv
%ProgramFiles%\google\google earth pro\client\res\tourcontrols.rcc
%ProgramFiles%\google\google earth pro\client\res\gdal\gt_ellips.csv
%ProgramFiles%\google\google earth pro\client\shaders\stbranch.arbfp1
%ProgramFiles%\google\google earth pro\client\lang\zh-hans.qm
%ProgramFiles%\google\google earth pro\client\kml_file.ico
%ProgramFiles%\google\google earth pro\client\lang\uk.qm
%ProgramFiles%\google\google earth pro\client\res\gdal\ruian_vf_ob_v1.gfs
%ProgramFiles%\google\google earth pro\client\res\gdal\ellipsoid.csv
%ProgramFiles%\google\google earth pro\client\shaders\speedtree_utils_glsles.h
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\speed_link_black_widow.ini
%ProgramFiles%\google\google earth pro\client\shaders\stbranch.glslesv
%ProgramFiles%\google\google earth pro\client\kmz_file.ico
%ProgramFiles%\google\google earth pro\client\res\effects.rcc
%ProgramFiles%\google\google earth pro\client\lang\pt-pt.qm
%ProgramFiles%\google\google earth pro\client\res\gdal\inspire_cp_basicpropertyunit.gfs
%ProgramFiles%\google\google earth pro\client\plugins\imageformats\qico.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\ozi_ellips.csv
%ProgramFiles%\google\google earth pro\client\res\gdal\itrf2008
%ProgramFiles%\google\google earth pro\client\qt5positioning.dll
%ProgramFiles%\google\google earth pro\client\plugins\platforms\qminimal.dll
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\generic.ini
%ProgramFiles%\google\google earth pro\client\res\gdal\ruian_vf_st_uvoh_v1.gfs
%ProgramFiles%\google\google earth pro\client\lang\bg.qm
%ProgramFiles%\google\google earth pro\client\importeruisettings.ini
%ProgramFiles%\google\google earth pro\client\res\gdal\esri
%ProgramFiles%\google\google earth pro\client\igcore.dll
%ProgramFiles%\google\google earth pro\client\qt5gui.dll
%ProgramFiles%\google\google earth pro\client\igutils.dll
%ProgramFiles%\google\google earth pro\client\shaders\stfrond.ps_2_0
%ProgramFiles%\google\google earth pro\client\lang\nl.qm
%ProgramFiles%\google\google earth pro\client\res\gdal\eedaconf.json
%ProgramFiles%\google\google earth pro\client\res\startinglocations.rcc
%ProgramFiles%\google\google earth pro\client\google_earth_pro.ico
%ProgramFiles%\google\google earth pro\client\lang\he.qm
%ProgramFiles%\google\google earth pro\client\res\gdal\nad.lst
%ProgramFiles%\google\google earth pro\client\shaders\stbranch.arbvp1
%ProgramFiles%\google\google earth pro\client\shaders\hammer_aitoff.glslesv
%ProgramFiles%\google\google earth pro\client\lang\da.qm
%ProgramFiles%\google\google earth pro\client\googleearth.exe
%ProgramFiles%\google\google earth pro\client\res\gdal\ogrvrt.xsd
%ProgramFiles%\google\google earth pro\client\shaders\stbillboard.arbfp1
%ProgramFiles%\google\google earth pro\client\shaders\stbillboard.cfg
%ProgramFiles%\google\google earth pro\client\res\webbrowser.rcc
%ProgramFiles%\google\google earth pro\client\res\gdal\seed_3d.dgn
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\logitech_attack3.ini
%ProgramFiles%\google\google earth pro\client\plugins\audio\qtaudio_windows.dll
%ProgramFiles%\google\google earth pro\client\qt5printsupport.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\other.extra
%ProgramFiles%\google\google earth pro\client\shaders\lighting.h
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\saitek_x52.ini
%ProgramFiles%\google\google earth pro\client\shaders\stleafmesh.cfg
%ProgramFiles%\google\google earth pro\client\shaders\atmosphere.glslesv
%ProgramFiles%\google\google earth pro\client\lang\es.qm
%ProgramFiles%\google\google earth pro\client\lang\en.qm
%ProgramFiles%\google\google earth pro\client\res\flightsim\hud\sr22.ini
%ProgramFiles%\google\google earth pro\client\res\gdal\netcdf_config.xsd
%ProgramFiles%\google\google earth pro\client\shaders\stleafmesh.glslesv
%ProgramFiles%\google\google earth pro\client\res\flightsim\aircraft\f16.acf
%ProgramFiles%\google\google earth pro\client\plugins\imageformats\qmng.dll
%ProgramFiles%\google\google earth pro\client\d3dcompiler_47.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\gl27
%WINDIR%\installer\{c36e66a6-6ee5-47db-945f-a6f03225d540}\mainicon.ico
%ProgramFiles%\google\google earth pro\client\qt5svg.dll
%ProgramFiles%\google\google earth pro\client\shaders\stbillboard.arbvp1
%ProgramFiles%\google\google earth pro\client\res\application.rcc
%ProgramFiles%\google\google earth pro\client\alchemy\ogl\igattrs.dll
%ProgramFiles%\google\google earth pro\client\shaders\water.glsllib
%ProgramFiles%\google\google earth pro\client\res\gdal\world
%ProgramFiles%\google\google earth pro\client\res\gdal\unit_of_measure.csv
%ProgramFiles%\google\google earth pro\client\ge_exif.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\pci_ellips.txt
%ProgramFiles%\google\google earth pro\client\drivers.ini
%ProgramFiles%\google\google earth pro\client\shaders\precipitation_double_cone.glslesv
%ProgramFiles%\google\google earth pro\client\igsg.dll
%ProgramFiles%\google\google earth pro\client\shaders\stleafmesh.arbfp1
%ProgramFiles%\google\google earth pro\client\qt5dbus.dll
%ProgramFiles%\google\google earth pro\client\pcoptimizations.ini
%ProgramFiles%\google\google earth pro\client\shaders\stcommonobjects.ini
%ProgramFiles%\google\google earth pro\client\res\gdal\inspire_cp_cadastralparcel.gfs
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\speed_link_dark_tornado.ini
%ProgramFiles%\google\google earth pro\client\gpsbabel.exe
%ProgramFiles%\google\google earth pro\client\res\startinglocations-nonmac.rcc
%ProgramFiles%\google\google earth pro\client\proj.dll
%ProgramFiles%\google\google earth pro\client\shaders\stbranch.vs_2_0
%ProgramFiles%\google\google earth pro\client\res\gdal\s57expectedinput.csv
%ProgramFiles%\google\google earth pro\client\qt5quick.dll
%ProgramFiles%\google\google earth pro\client\shaders\stbranch.cfg
%ProgramFiles%\google\google earth pro\client\icuin54.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\epsg.wkt
%ProgramFiles%\google\google earth pro\client\lang\ar.qm
%ProgramFiles%\google\google earth pro\client\res\leftpanel-layer.rcc
%ProgramFiles%\google\google earth pro\client\shaders\stfrond.asd
%ProgramFiles%\google\google earth pro\client\res\cursor_crosshair_inverse.png
%ProgramFiles%\google\google earth pro\client\qt5webkit.dll
%ProgramFiles%\google\google earth pro\client\shaders\stleafcard.glslesf
%ProgramFiles%\google\google earth pro\client\avformat-57.dll
%ProgramFiles%\google\google earth pro\client\qt5opengl.dll
%ProgramFiles%\google\google earth pro\client\qt5script.dll
%ProgramFiles%\google\google earth pro\client\qt5qml.dll
%ProgramFiles%\google\google earth pro\client\alchemy\optimizations\igoptextension.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\s57objectclasses.csv
%ProgramFiles%\google\google earth pro\client\google_earth.ico
%ProgramFiles%\google\google earth pro\client\lang\sv.qm
%ProgramFiles%\google\google earth pro\client\qt5sensors.dll
%ProgramFiles%\google\google earth pro\client\swscale-4.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\vdv452.xsd
%ProgramFiles%\google\google earth pro\client\gdal204.dll
%ProgramFiles%\google\google earth pro\client\res\mouse3dgui.rcc
%ProgramFiles%\google\google earth pro\client\shaders\stbranch.asd
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\saitek_cyborg_evo.ini
%ProgramFiles%\google\google earth pro\client\lang\zh-hant-hk.qm
%ProgramFiles%\google\google earth pro\client\res\gdal\bag_template.xml
%ProgramFiles%\google\google earth pro\client\res\gdal\gdalvrt.xsd
%ProgramFiles%\google\google earth pro\client\qt5core.dll
%ProgramFiles%\google\google earth pro\client\res\toolbar.rcc
%ProgramFiles%\google\google earth pro\client\lang\no.qm
%ProgramFiles%\google\google earth pro\client\res\gdal\trailer.dxf
%ProgramFiles%\google\google earth pro\client\icuuc54.dll
%ProgramFiles%\google\google earth pro\client\alchemy\ogles20\libglesv2.dll
%ProgramFiles%\google\google earth pro\client\alchemy\ogles20\iggfx.dll
%ProgramFiles%\google\google earth pro\client\googleearth_pro.dll
%ProgramFiles%\google\google earth pro\client\res\userpalette.kml
%ProgramFiles%\google\google earth pro\client\googleearth2x.bat
%ProgramFiles%\google\google earth pro\client\shaders\stleafcard.cfg
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_sv.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_da.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_cs.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_ca.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_bn.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_bg.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_ar.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_am.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\googleupdatecomregistershell64.exe
%ProgramFiles(x86)%\google\update\1.3.36.122\googlecrashhandler64.exe
%ProgramFiles(x86)%\google\update\1.3.36.122\googlecrashhandler.exe
%ProgramFiles(x86)%\google\update\1.3.36.122\googleupdatecore.exe
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdate.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\googleupdate.exe
%ProgramFiles(x86)%\google\temp\gum8c.tmp\googleupdatesetup.exe
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_zh-tw.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_zh-cn.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_vi.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_ur.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_uk.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_tr.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_th.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_te.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_ta.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_sw.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_sl.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_el.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_en.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_en-gb.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_es.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_no.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_nl.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_ms.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_mr.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_ml.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_lv.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_lt.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_ko.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_kn.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_ja.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_iw.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_it.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_is.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_id.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_hu.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_hr.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_hi.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_gu.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_fr.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_fil.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_fi.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_fa.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_et.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_es-419.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_pl.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_sr.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_sk.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_kn.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_en.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_el.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_de.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_da.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_cs.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_ca.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_bn.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_bg.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_ar.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_am.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\googleupdatecore.exe
%ProgramFiles(x86)%\google\temp\gum8c.tmp\googlecrashhandler64.exe
%ProgramFiles(x86)%\google\temp\gum8c.tmp\psuser_64.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\psuser.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\psmachine_64.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\psmachine.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\googleupdatecomregistershell64.exe
%ProgramFiles(x86)%\google\temp\gum8c.tmp\googleupdateondemand.exe
%ProgramFiles(x86)%\google\temp\gum8c.tmp\googleupdatebroker.exe
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdate.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\googlecrashhandler.exe
%ProgramFiles(x86)%\google\temp\gum8c.tmp\googleupdate.exe
%ProgramFiles(x86)%\google\temp\gut8d.tmp
%TEMP%\googleearthprosetup.exe
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_es.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_es-419.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_en-gb.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_et.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_ru.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_fa.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_ro.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_pt-pt.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_pt-br.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_pl.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_no.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_nl.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_ms.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_mr.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_ml.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_lv.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_lt.dll
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\google earth pro.lnk
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_pt-br.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_ja.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_iw.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_it.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_is.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_id.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_hu.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_hr.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_hi.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_gu.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_fr.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_fil.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_fi.dll
%ProgramFiles(x86)%\google\temp\gum8c.tmp\goopdateres_ko.dll
%ProgramFiles%\google\google earth pro\client\shaders\stbranch.ps_2_0
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_pt-pt.dll
%TEMP%\googleearth-ec-x64.msi
%ProgramFiles%\google\google earth pro\client\res\navcontrols.rcc
%ProgramFiles%\google\google earth pro\client\res\print.rcc
%ProgramFiles%\google\google earth pro\client\igexportcommon.dll
%ProgramFiles%\google\google earth pro\client\igopt.dll
%ProgramFiles%\google\google earth pro\client\res\progress.rcc
%ProgramFiles%\google\google earth pro\client\res\gdal\compdcs.csv
%ProgramFiles%\google\google earth pro\client\res\gdal\esri_stateplane_extra.wkt
%ProgramFiles%\google\google earth pro\client\res\gdal\gml_registry.xml
%ProgramFiles%\google\google earth pro\client\res\gdal\seed_2d.dgn
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\speed_link_cougar_flightstick.ini
%ProgramFiles%\google\google earth pro\client\shaders\stfrond.arbvp1
%ProgramFiles%\google\google earth pro\client\alchemy\ogl\igsg.dll
%ProgramFiles%\google\google earth pro\client\shaders\stbillboard.ps_2_0
%ProgramFiles%\google\google earth pro\client\res\spin_icon.png
%ProgramFiles%\google\google earth pro\client\res\cursor_crosshair_thick.png
%ProgramFiles%\google\google earth pro\client\res\gdal\ignf
%ProgramFiles%\google\google earth pro\client\res\gdal\coordinate_axis.csv
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\logitech_freedom.ini
%ProgramFiles%\google\google earth pro\client\plugins\platforms\qdirect2d.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\geoccs.csv
%ProgramFiles%\google\google earth pro\client\qt5webchannel.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\prime_meridian.csv
%ProgramFiles%\google\google earth pro\client\qt.conf
%ProgramFiles%\google\google earth pro\client\res\gdal\gcs.csv
%ProgramFiles%\google\google earth pro\client\shaders\color.h
%ProgramFiles%\google\google earth pro\client\res\gdal\default.rsc
%ProgramFiles%\google\google earth pro\client\shaders\precipitation_double_cone.glslesf
%ProgramFiles%\google\google earth pro\client\res\gdal\plscenesconf.json
%ProgramFiles%\google\google earth pro\client\lang\es-419.qm
%ProgramFiles%\google\google earth pro\client\lang\fr.qm
%ProgramFiles%\google\google earth pro\client\lang\it.qm
%ProgramFiles%\google\google earth pro\client\res\gdal\cubewerx_extra.wkt
%ProgramFiles%\google\google earth pro\client\res\gdal\stateplane.csv
%ProgramFiles%\google\google earth pro\client\res\gdal\vertcs.override.csv
%ProgramFiles%\google\google earth pro\client\res\repair_tool.rcc
%ProgramFiles%\google\google earth pro\client\shaders\stfrond.glslesv
%ProgramFiles%\google\google earth pro\client\lang\fa.qm
%ProgramFiles%\google\google earth pro\client\res\search.rcc
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\speed_link_black_hawk.ini
%ProgramFiles%\google\google earth pro\client\shaders\stbranch.glslesf
%ProgramFiles%\google\google earth pro\client\plugins\imageformats\qjpeg.dll
%ProgramFiles%\google\google earth pro\client\lang\vi.qm
%ProgramFiles%\google\google earth pro\client\res\localshapes.rcc
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_de.dll
%ProgramFiles%\google\google earth pro\client\shaders\stleafcard.asd
%ProgramFiles%\google\google earth pro\client\plugins\npgeinprocessplugin.dll
%ProgramFiles%\google\google earth pro\client\importerglobalsettings.ini
%ProgramFiles%\google\google earth pro\client\shaders\stleafcard.vs_2_0
%ProgramFiles%\google\google earth pro\client\res\flightsim\aircraft\sr22.acf
%ProgramFiles%\google\google earth pro\client\shaders\hammer_aitoff.glslesf
%ProgramFiles%\google\google earth pro\client\res\doppler.txt
%ProgramFiles%\google\google earth pro\client\lang\ko.qm
%ProgramFiles%\google\google earth pro\client\lang\fi.qm
%ProgramFiles%\google\google earth pro\client\shaders\stleafcard.ps_2_0
%ProgramFiles%\google\google earth pro\client\lang\pt.qm
%ProgramFiles%\google\google earth pro\client\res\gdal\esri_extra.wkt
%ProgramFiles%\google\google earth pro\client\icudt54.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\ruian_vf_st_v1.gfs
%TEMP%\googleearth-ec-x64.msi.log
%ProgramFiles(x86)%\google\update\download\{65e60e95-0de9-43ff-9f3f-4f7d2dff04b5}\7.3.4.8573\googleearth-win-pro-7.3.4.8573-x64.exe
%TEMP%\bit641f.tmp
%LOCALAPPDATA%\svchost.exe
%ProgramFiles(x86)%\google\update\1.3.36.122\googleupdateondemand.exe
%ProgramFiles(x86)%\google\update\1.3.36.122\googleupdatebroker.exe
%ProgramFiles(x86)%\google\update\1.3.36.122\googleupdatesetup.exe
%ProgramFiles(x86)%\google\update\1.3.36.122\psmachine_64.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\psmachine.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\psuser_64.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\psuser.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_zh-tw.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_zh-cn.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_vi.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_ur.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_uk.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_tr.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_th.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_te.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_ta.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_sw.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_sv.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_sr.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_sl.dll
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_sk.dll
%ProgramFiles(x86)%\google\update\install\{e748ca89-1527-432e-8978-0e60877a2172}\googleearth-win-pro-7.3.4.8573-x64.exe
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\genius_maxfighter_f16u.ini
%ProgramFiles%\google\google earth pro\client\res\flightsim\planet\earth.ini
%ProgramFiles%\google\google earth pro\client\lang\ru.qm
%ProgramFiles%\google\google earth pro\client\qt5sql.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\ch
%ProgramFiles%\google\google earth pro\client\plugins\imageformats\qwebp.dll
%ProgramFiles%\google\google earth pro\client\res\flightsim\controller\logitech_extreme_3d.ini
%ProgramFiles%\google\google earth pro\client\res\gdal\ecw_cs.wkt
%ProgramFiles%\google\google earth pro\client\res\leftpanel-common.rcc
%ProgramFiles%\google\google earth pro\client\libexpat.dll
%ProgramFiles%\google\google earth pro\client\res\flightsim\flightsim.ini
%ProgramFiles%\google\google earth pro\client\lang\hr.qm
%ProgramFiles%\google\google earth pro\client\alchemyext.dll
%ProgramFiles%\google\google earth pro\client\lang\ca.qm
%ProgramFiles%\google\google earth pro\client\shaders\stars.glslesf
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_ru.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\epsg
%ProgramFiles%\google\google earth pro\client\shaders\stfrond.arbfp1
%ProgramFiles%\google\google earth pro\client\shaders\stleafmesh.vs_2_0
%ProgramFiles%\google\google earth pro\client\plugins\bearer\qgenericbearer.dll
%ProgramFiles%\google\google earth pro\client\res\gdal\vertcs.csv
%ProgramFiles%\google\google earth pro\client\lang\sk.qm
%ProgramFiles%\google\google earth pro\client\libeay32.dll
%ProgramFiles%\google\google earth pro\client\lang\th.qm
%ProgramFiles%\google\google earth pro\client\shaders\stbillboard.asd
%ProgramFiles%\google\google earth pro\client\res\gdal\header.dxf
%ProgramFiles%\google\google earth pro\client\res\gdal\ruian_vf_v1.gfs
%ProgramFiles%\google\google earth pro\client\shaders\atmosphere.glslesf
%ProgramFiles%\google\google earth pro\client\res\flightsim\keyboard\generic.ini
%ProgramFiles(x86)%\google\update\1.3.36.122\goopdateres_ro.dll
C:\users\public\desktop\google earth pro.lnk

Присваивает атрибут 'скрытый' для следующих файлов

%TEMP%\bit641f.tmp

Удаляет следующие файлы

%TEMP%\{e3723538-2ef3-444f-b78f-f17e94d8a65c}-googleearth-win-pro-7.3.4.8573-x64.exe
%TEMP%\googleearth-ec-x64.msi
%TEMP%\googleearth-ec-x64.msi.log

Перемещает следующие файлы

%TEMP%\bit641f.tmp в %TEMP%\{e3723538-2ef3-444f-b78f-f17e94d8a65c}-googleearth-win-pro-7.3.4.8573-x64.exe

Сетевая активность

Подключается к

'sy####.servebeer.com':88
'up####.googleapis.com':443
'ed####.me.gvt1.com':80

TCP

Запросы HTTP GET

http://ed####.me.gvt1.com/edgedl/release2/Earth/adggq4c3fndk2w2r3vajwgh32wcq_7.3.4.8573/googleearth-win-pro-7.3.4.8573-x64.exe

Другие

'up####.googleapis.com':443

UDP

DNS ASK sy####.servebeer.com
DNS ASK up####.googleapis.com
DNS ASK ed####.me.gvt1.com

Другое

Создает и запускает на исполнение

'%TEMP%\svchost.exe'
'%TEMP%\googleearthprosetup.exe'
'%ProgramFiles(x86)%\google\temp\gum8c.tmp\googleupdate.exe' /installsource taggedmi /install "appguid={65E60E95-0DE9-43FF-9F3F-4F7D2DFF04B5}&iid={C3EC1A88-3334-C619-3FA4-A6F8C2C821DA}&lang=undefined&browser=4&usagestats=1&appname=Google%20Earth%20Pro&ne...
'%ProgramFiles(x86)%\google\update\1.3.36.122\googleupdatecomregistershell64.exe'
'%ProgramFiles(x86)%\google\update\install\{e748ca89-1527-432e-8978-0e60877a2172}\googleearth-win-pro-7.3.4.8573-x64.exe' REBOOT=ReallySuppress OMAHA=1 ALLUSERS=1 REINSTALLMODE=emus
'%ProgramFiles(x86)%\google\update\1.3.36.122\googlecrashhandler.exe'
'%ProgramFiles(x86)%\google\update\1.3.36.122\googlecrashhandler64.exe'
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\svchost.exe" "svchost.exe" ENABLE' (со скрытым окном)

Запускает на исполнение

'%ProgramFiles(x86)%\google\update\googleupdate.exe' /regsvc
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /regserver
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMjIiIHNoZWxsX3ZlcnNpb249IjEuMy4yNi45IiBpc21hY2hpbmU...
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /handoff "appguid={65E60E95-0DE9-43FF-9F3F-4F7D2DFF04B5}&iid={C3EC1A88-3334-C619-3FA4-A6F8C2C821DA}&lang=undefined&browser=4&usagestats=1&appname=Google%20Earth%20Pro&needsadmin=True&brand=GGGE...
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /svc

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней