Техническая информация
Вредоносные функции
Регистрирует BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3957DBAD-878B-172C-397D-FCE88DC87A65}]
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\2ecf6423\f68j156h.dat
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\guest\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\guest\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- %LOCALAPPDATA%\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- %LOCALAPPDATA%\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- %LOCALAPPDATA%\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\administrator\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\administrator\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- %LOCALAPPDATA%\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- %LOCALAPPDATA%\torch\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\hv@uehgvl.co.uk\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\hv@uehgvl.co.uk\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\hv@uehgvl.co.uk\content\bg.js
- %ALLUSERSPROFILE%\shoppingchip\f68j156h.dat
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\hv@uehgvl.co.uk\install.rdf
- %ProgramFiles(x86)%\shoppingchip\9txepko.tlb
- %ProgramFiles(x86)%\shoppingchip\9txepko.dat
- %LOCALAPPDATA%low\{3957dbad-878b-172c-397d-fce88dc87a65}\shoppingchip.2.9.dat
- %ProgramFiles(x86)%\shoppingchip\9txepko.x64.dll
- %LOCALAPPDATA%\packages\windows_ie_ac_001\ac\{3957dbad-878b-172c-397d-fce88dc87a65}\shoppingchip.2.9.dat
- %ALLUSERSPROFILE%\shoppingchip\f68j156h.exe
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- %ProgramFiles(x86)%\shoppingchip\9txepko.dll
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- %TEMP%\2ecf6423\f68j156h.exe
- %TEMP%\2ecf6423\i1hrq.dll
- %TEMP%\2ecf6423\9txepko.x64.dll
- %TEMP%\2ecf6423\9txepko.tlb
- %TEMP%\2ecf6423\9txepko.dll
- %TEMP%\2ecf6423\hv@uehgvl.co.uk\content\bg.js
- %TEMP%\2ecf6423\hv@uehgvl.co.uk\install.rdf
- %TEMP%\2ecf6423\hv@uehgvl.co.uk\chrome.manifest
- %TEMP%\2ecf6423\hv@uehgvl.co.uk\bootstrap.js
- %TEMP%\2ecf6423\kfacnmgepfjjbceiapmpndcohhmpjehc\lsdb.js
- %TEMP%\2ecf6423\kfacnmgepfjjbceiapmpndcohhmpjehc\content.js
- %TEMP%\2ecf6423\kfacnmgepfjjbceiapmpndcohhmpjehc\manifest.json
- %TEMP%\2ecf6423\kfacnmgepfjjbceiapmpndcohhmpjehc\background.html
- %TEMP%\2ecf6423\kfacnmgepfjjbceiapmpndcohhmpjehc\yvw5ru8uq.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\background.html
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\yvw5ru8uq.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\kfacnmgepfjjbceiapmpndcohhmpjehc\1.1\manifest.json
- %ALLUSERSPROFILE%\1a04097e6fbdc983\{1d2abf6a-2b19-3e94-0991-5b5bdb7134da}.20220603105113
Удаляет следующие файлы
- %TEMP%\2ecf6423\f68j156h.dat
- %TEMP%\2ecf6423\f68j156h.exe
- %TEMP%\2ecf6423\i1hrq.dll
- %TEMP%\2ecf6423\9txepko.x64.dll
- %TEMP%\2ecf6423\9txepko.tlb
- %TEMP%\2ecf6423\9txepko.dll
- %TEMP%\2ecf6423\hv@uehgvl.co.uk\content\bg.js
- %TEMP%\2ecf6423\hv@uehgvl.co.uk\install.rdf
- %TEMP%\2ecf6423\hv@uehgvl.co.uk\chrome.manifest
- %TEMP%\2ecf6423\hv@uehgvl.co.uk\bootstrap.js
- %TEMP%\2ecf6423\kfacnmgepfjjbceiapmpndcohhmpjehc\lsdb.js
- %TEMP%\2ecf6423\kfacnmgepfjjbceiapmpndcohhmpjehc\content.js
- %TEMP%\2ecf6423\kfacnmgepfjjbceiapmpndcohhmpjehc\manifest.json
- %TEMP%\2ecf6423\kfacnmgepfjjbceiapmpndcohhmpjehc\background.html
- %TEMP%\2ecf6423\kfacnmgepfjjbceiapmpndcohhmpjehc\yvw5ru8uq.js
Изменяет следующие файлы
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\2ecf6423\f68j156h.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\ShoppingChip\9tXEPKO.x64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\ShoppingChip\9tXEPKO.x64.dll"
