Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %WINDIR%\tasks\getdeal coupon widget-chromeinstaller.job
- <SYSTEM32>\tasks\getdeal coupon widget-chromeinstaller
- %WINDIR%\tasks\getdeal coupon widget-firefoxinstaller.job
- <SYSTEM32>\tasks\getdeal coupon widget-firefoxinstaller
- %WINDIR%\tasks\getdeal coupon widget-codedownloader.job
- <SYSTEM32>\tasks\getdeal coupon widget-codedownloader
- %WINDIR%\tasks\getdeal coupon widget-enabler.job
- <SYSTEM32>\tasks\getdeal coupon widget-enabler
- %WINDIR%\tasks\temp_getdeal coupon widget-enabler.job
- <SYSTEM32>\tasks\temp_getdeal coupon widget-enabler
- %WINDIR%\tasks\getdeal coupon widget-updater.job
- <SYSTEM32>\tasks\getdeal coupon widget-updater
Вредоносные функции
Запускает на исполнение
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://cr###rider.com/thank_you/35399
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
- firefox.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nshe466.tmp
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\webrequest.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\background.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\dbmanager.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\firefoxomnibox.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\message.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\firefoxnotifications.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\request.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\utils.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\uninstallobserver.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\requestobject.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\idbwrapper.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\httpobserver.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\installer.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\firefox.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\reports.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\consts.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\delegate.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\console.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\updatemanager.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\registry.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\prefs.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\pluginsmanager.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\reloadobserver.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\searchsettings.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\xhr.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\browser.xul
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\options.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\progresslistenerobserver.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\filemanager.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\contextmenu.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\asyncdb.js
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-updater.exe
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-enabler.exe
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-bg.exe
- %ProgramFiles(x86)%\getdeal coupon widget\background.html
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-bho.dll
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget.ico
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-buttonutil64.dll
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-buttonutil.dll
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-buttonutil64.exe
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-buttonutil.exe
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-helper.exe
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-codedownloader.exe
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\button4.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\crossrider_statusbar.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\icon128.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\panelarrow-up.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\icon16.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\button1.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\button3.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\icon24.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\skin.css
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\button5.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\button2.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\update.css
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\popup.html
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\icon48.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\dom_bg.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\tabs.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\browseraction.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\extensioncode\pagecode.js
- %ProgramFiles(x86)%\getdeal coupon widget\installer.log
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\extensioncode\backgroundcode.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\baseobject.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\popupresource\newpopup.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\popupresource\popup.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\logging.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\xhr.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\background.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\app\background.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\app\extension.js
- %TEMP%\nsmf23c.tmp\execdos.dll
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-chromeinstaller.exe
- %ProgramFiles(x86)%\getdeal coupon widget\35399.crx
- %ProgramFiles(x86)%\getdeal coupon widget\uninstall.exe
- %TEMP%\nsmf23c.tmp\temp_file_after.tmp
- %TEMP%\nsmf23c.tmp\temp_file_before.tmp
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\async_api.js
- %ProgramFiles(x86)%\getdeal coupon widget\utils.exe
- %TEMP%\nsmf23c.tmp\userinfo.dll
- %TEMP%\nsmf23c.tmp\md5dll.dll
- %TEMP%\nsmf23c.tmp\nsisos.dll
- %TEMP%\getdeal coupon widgetinstaller_1655270282.log
- %TEMP%\nsmf23c.tmp\nsislog.dll
- %TEMP%\nsmf23c.tmp\system.dll
- %TEMP%\nsmf23c.tmp\stdutils.dll
- %TEMP%\nsrf20c.tmp
- %TEMP%\nsxe477.tmp\stdutils.dll
- %TEMP%\nsxe477.tmp\jilrwob.exe
- %TEMP%\nsxe477.tmp\installerutils.dll
- %TEMP%\nsxe477.tmp\irctiobd.tmp
- %TEMP%\nsxe477.tmp\system.dll
- %TEMP%\nsmf23c.tmp\installerutils.dll
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\bg_app_api.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\cookie_store.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\data_store.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\search_dialog.xul
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\background.html
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\dialog.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\options.xul
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\defaults\preferences\prefs.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\locale\en-us\translations.dtd
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\install.rdf
- %ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-firefoxinstaller.exe
- %ProgramFiles(x86)%\getdeal coupon widget\35399.xpi
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\crossridermanifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\icons\icon128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\icons\icon16.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\icons\actions\1.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\icons\icon48.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\popup.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\api\chrome.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\api\cookie.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\api\message.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\events.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\onbgdocumentload.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\installer.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\reports.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\crossriderapi.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\delegate.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\util.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\app_api.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\main.js
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022061420220615\index.dat
Удаляет следующие файлы
- %WINDIR%\tasks\temp_getdeal coupon widget-enabler.job
- %TEMP%\nsxe477.tmp\jilrwob.exe
- %TEMP%\nsxe477.tmp\irctiobd.tmp
- %TEMP%\nsxe477.tmp\installerutils.dll
- %TEMP%\nsmf23c.tmp\userinfo.dll
- %TEMP%\nsmf23c.tmp\temp_file_before.tmp
- %TEMP%\nsmf23c.tmp\temp_file_after.tmp
- %TEMP%\nsxe477.tmp\stdutils.dll
- %TEMP%\nsmf23c.tmp\system.dll
- %TEMP%\nsmf23c.tmp\nsisos.dll
- %TEMP%\nsmf23c.tmp\nsislog.dll
- %TEMP%\nsmf23c.tmp\md5dll.dll
- %TEMP%\nsmf23c.tmp\installerutils.dll
- %TEMP%\nsmf23c.tmp\execdos.dll
- <SYSTEM32>\tasks\temp_getdeal coupon widget-enabler
- %TEMP%\nsmf23c.tmp\stdutils.dll
- %TEMP%\nsxe477.tmp\system.dll
Изменяет следующие файлы
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
Сетевая активность
Подключается к
- 'st###.#tatsdatasrv.com':80
- 'er####.statsdatasrv.com':80
- 'ap######ic.crossrider.com':80
- 'cr###rider.com':80
TCP
Запросы HTTP GET
- http://st###.#tatsdatasrv.com/installer.gif?ac###################################################################################################################################################...
- http://er####.statsdatasrv.com/ie-error.gif?ac###################################################################################################################################################...
- http://st###.#tatsdatasrv.com/stats.gif?ac#######################################################################################################################################################...
- http://st###.#tatsdatasrv.com/apps.gif?ac########################################################################################################################################################...
- http://cr###rider.com/thank_you/35399
- http://cr###rider.com/cdn-cgi/styles/main.css
- http://cr###rider.com/cdn-cgi/images/cf-icon-browser.png
- http://cr###rider.com/cdn-cgi/images/cf-icon-ok.png
- http://cr###rider.com/cdn-cgi/images/cf-icon-server.png
- http://cr###rider.com/cdn-cgi/images/cf-icon-error.png
- http://cr###rider.com/cdn-cgi/images/cf-icon-cloud.png
- http://cr###rider.com/favicon.ico
UDP
- DNS ASK st###.#tatsdatasrv.com
- DNS ASK st###.myappsync.com
- DNS ASK er####.statsdatasrv.com
- DNS ASK ap######ic.crossrider.com
- DNS ASK cr###rider.com
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: '#32770' WindowName: 'CrossriderApp0035399-Background'
- ClassName: 'CrossriderApp0035399' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\nsxe477.tmp\jilrwob.exe'
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-chromeinstaller.exe' /installcrx /agentregpath='GetDeal Coupon Widget' /extensionfilepath='%ProgramFiles(x86)%\GetDeal Coupon Widget\35399.crx' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843...
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-firefoxinstaller.exe' /installxpi /agentregpath='GetDeal Coupon Widget' /extensionfilepath='%ProgramFiles(x86)%\GetDeal Coupon Widget\35399.xpi' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843...
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-codedownloader.exe' /installapp /agentregpath='GetDeal Coupon Widget' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843FBA435EAEDFC339904IE /verifier=76191e6ab7f3880919495e5bb6286ad8 /installe...
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-helper.exe' /externallog='%TEMP%\GetDeal Coupon WidgetInstaller_1655270282.log'
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-bg.exe' /executebg /externallog='%TEMP%\GetDeal Coupon WidgetInstaller_1655270282.log'
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-enabler.exe' /enablebho /agentregpath='GetDeal Coupon Widget' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843FBA435EAEDFC339904IE /verifier=76191e6ab7f3880919495e5bb6286ad8 /installer...
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-bg.exe' /createbg
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-chromeinstaller.exe' /installcrx /agentregpath='GetDeal Coupon Widget' /extensionfilepath='%ProgramFiles(x86)%\GetDeal Coupon Widget\35399.crx' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843...' (со скрытым окном)
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-firefoxinstaller.exe' /installxpi /agentregpath='GetDeal Coupon Widget' /extensionfilepath='%ProgramFiles(x86)%\GetDeal Coupon Widget\35399.xpi' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843...' (со скрытым окном)
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-codedownloader.exe' /installapp /agentregpath='GetDeal Coupon Widget' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843FBA435EAEDFC339904IE /verifier=76191e6ab7f3880919495e5bb6286ad8 /installe...' (со скрытым окном)
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-helper.exe' /externallog='%TEMP%\GetDeal Coupon WidgetInstaller_1655270282.log'' (со скрытым окном)
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\GetDeal Coupon Widget\GetDeal Coupon Widget-bho.dll"' (со скрытым окном)
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-bg.exe' /executebg /externallog='%TEMP%\GetDeal Coupon WidgetInstaller_1655270282.log'' (со скрытым окном)
- '%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-enabler.exe' /enablebho /agentregpath='GetDeal Coupon Widget' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843FBA435EAEDFC339904IE /verifier=76191e6ab7f3880919495e5bb6286ad8 /installer...' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\GetDeal Coupon Widget\GetDeal Coupon Widget-bho.dll"
