Техническая информация
Вредоносные функции
Регистрирует BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e00e2bbe-a9d9-4e58-bd56-215461fcb4af}]
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\5abd5116\heqz5kufhwkaipq.dat
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\guest\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\guest\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- %LOCALAPPDATA%\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- %LOCALAPPDATA%\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- %LOCALAPPDATA%\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\administrator\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\administrator\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- %ALLUSERSPROFILE%\gosave\heqz5kufhwkaipq.dat
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\lh@7.com\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\lh@7.com\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\lh@7.com\content\bg.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\lh@7.com\install.rdf
- %ProgramFiles(x86)%\gosave\3bsgcg7rnywcod.dll
- %ProgramFiles(x86)%\gosave\3bsgcg7rnywcod.tlb
- %ProgramFiles(x86)%\gosave\3bsgcg7rnywcod.dat
- %ProgramFiles(x86)%\gosave\3bsgcg7rnywcod.x64.dll
- %ALLUSERSPROFILE%\gosave\heqz5kufhwkaipq.exe
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- %LOCALAPPDATA%\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- %LOCALAPPDATA%\torch\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- %TEMP%\5abd5116\3bsgcg7rnywcod.dll
- %TEMP%\5abd5116\3bsgcg7rnywcod.tlb
- %TEMP%\5abd5116\3bsgcg7rnywcod.x64.dll
- %TEMP%\5abd5116\lh@7.com\content\bg.js
- %TEMP%\5abd5116\lh@7.com\bootstrap.js
- %TEMP%\5abd5116\lh@7.com\chrome.manifest
- %TEMP%\5abd5116\lh@7.com\install.rdf
- %TEMP%\5abd5116\imiilhhofelegolopchlgbhiaoimhckn\q0gojwoda9.js
- %TEMP%\5abd5116\imiilhhofelegolopchlgbhiaoimhckn\background.html
- %TEMP%\5abd5116\imiilhhofelegolopchlgbhiaoimhckn\manifest.json
- %TEMP%\5abd5116\imiilhhofelegolopchlgbhiaoimhckn\content.js
- %TEMP%\5abd5116\imiilhhofelegolopchlgbhiaoimhckn\lsdb.js
- %LOCALAPPDATA%\google\chrome\user data\default\preferences__.tmp
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\background.html
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\manifest.json
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\q0gojwoda9.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\imiilhhofelegolopchlgbhiaoimhckn\2.0\lsdb.js
- %ALLUSERSPROFILE%\6adc9d6147551a72\{c87834eb-a2a0-b9d4-aa9a-c263d1191051}.20220604124943
Удаляет следующие файлы
- %TEMP%\5abd5116\heqz5kufhwkaipq.dat
- %TEMP%\5abd5116\3bsgcg7rnywcod.dll
- %TEMP%\5abd5116\3bsgcg7rnywcod.tlb
- %TEMP%\5abd5116\3bsgcg7rnywcod.x64.dll
- %TEMP%\5abd5116\lh@7.com\content\bg.js
- %TEMP%\5abd5116\lh@7.com\bootstrap.js
- %TEMP%\5abd5116\lh@7.com\chrome.manifest
- %TEMP%\5abd5116\lh@7.com\install.rdf
- %TEMP%\5abd5116\imiilhhofelegolopchlgbhiaoimhckn\q0gojwoda9.js
- %TEMP%\5abd5116\imiilhhofelegolopchlgbhiaoimhckn\background.html
- %TEMP%\5abd5116\imiilhhofelegolopchlgbhiaoimhckn\manifest.json
- %TEMP%\5abd5116\imiilhhofelegolopchlgbhiaoimhckn\content.js
- %TEMP%\5abd5116\imiilhhofelegolopchlgbhiaoimhckn\lsdb.js
Изменяет следующие файлы
- %LOCALAPPDATA%\google\chrome\user data\local state
- %LOCALAPPDATA%\google\chrome\user data\default\preferences__.tmp
Подменяет следующие файлы
- %LOCALAPPDATA%\google\chrome\user data\default\preferences__.tmp
- %ALLUSERSPROFILE%\ntuser.pol
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\GoSave\3bsGCG7rNYwCod.x64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\GoSave\3bsGCG7rNYwCod.x64.dll"
- '<SYSTEM32>\raserver.exe' /offerraupdate
