Техническая информация
Вредоносные функции
Регистрирует BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4088536D-C152-7F32-88EE-87A6992D42E4}]
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\2b58403d\6t5ns.dat
- C:\users\administrator\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\administrator\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- %LOCALAPPDATA%\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- %ALLUSERSPROFILE%\costmin\6t5ns.dat
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- %ALLUSERSPROFILE%\costmin\6t5ns.exe
- %LOCALAPPDATA%\packages\windows_ie_ac_001\ac\{4088536d-c152-7f32-88ee-87a6992d42e4}\costmin.2.9.dat
- %ProgramFiles(x86)%\costmin\bs7s.x64.dll
- %LOCALAPPDATA%low\{4088536d-c152-7f32-88ee-87a6992d42e4}\costmin.2.9.dat
- %ProgramFiles(x86)%\costmin\bs7s.dat
- %ProgramFiles(x86)%\costmin\bs7s.tlb
- %ProgramFiles(x86)%\costmin\bs7s.dll
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\hukc_b@pmrkslajd.com\install.rdf
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\hukc_b@pmrkslajd.com\content\bg.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\hukc_b@pmrkslajd.com\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\hukc_b@pmrkslajd.com\bootstrap.js
- %LOCALAPPDATA%\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- %LOCALAPPDATA%\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- %LOCALAPPDATA%\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- %LOCALAPPDATA%\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\guest\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\guest\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- %TEMP%\2b58403d\iopigageanmcemocjfgpdhlddndijbga\wzog1d.js
- %TEMP%\2b58403d\iopigageanmcemocjfgpdhlddndijbga\background.html
- %TEMP%\2b58403d\iopigageanmcemocjfgpdhlddndijbga\manifest.json
- %TEMP%\2b58403d\iopigageanmcemocjfgpdhlddndijbga\content.js
- %TEMP%\2b58403d\iopigageanmcemocjfgpdhlddndijbga\lsdb.js
- %TEMP%\2b58403d\hukc_b@pmrkslajd.com\bootstrap.js
- %TEMP%\2b58403d\hukc_b@pmrkslajd.com\chrome.manifest
- %TEMP%\2b58403d\hukc_b@pmrkslajd.com\install.rdf
- %TEMP%\2b58403d\hukc_b@pmrkslajd.com\content\bg.js
- %TEMP%\2b58403d\bs7s.dll
- %TEMP%\2b58403d\bs7s.tlb
- %TEMP%\2b58403d\bs7s.x64.dll
- %TEMP%\2b58403d\6t5ns.exe
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\lsdb.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\wzog1d.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\iopigageanmcemocjfgpdhlddndijbga\2.2\content.js
- %ALLUSERSPROFILE%\e26550d514ddf804\{2f5f003b-c71b-72e3-42b4-de51ab079eb2}
Удаляет следующие файлы
- %TEMP%\2b58403d\6t5ns.dat
- %TEMP%\2b58403d\6t5ns.exe
- %TEMP%\2b58403d\bs7s.x64.dll
- %TEMP%\2b58403d\bs7s.tlb
- %TEMP%\2b58403d\bs7s.dll
- %TEMP%\2b58403d\hukc_b@pmrkslajd.com\content\bg.js
- %TEMP%\2b58403d\hukc_b@pmrkslajd.com\install.rdf
- %TEMP%\2b58403d\hukc_b@pmrkslajd.com\chrome.manifest
- %TEMP%\2b58403d\hukc_b@pmrkslajd.com\bootstrap.js
- %TEMP%\2b58403d\iopigageanmcemocjfgpdhlddndijbga\lsdb.js
- %TEMP%\2b58403d\iopigageanmcemocjfgpdhlddndijbga\content.js
- %TEMP%\2b58403d\iopigageanmcemocjfgpdhlddndijbga\manifest.json
- %TEMP%\2b58403d\iopigageanmcemocjfgpdhlddndijbga\background.html
- %TEMP%\2b58403d\iopigageanmcemocjfgpdhlddndijbga\wzog1d.js
Изменяет следующие файлы
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\2b58403d\6t5ns.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\CostMin\bS7S.x64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\CostMin\bS7S.x64.dll"
