Техническая информация
Вредоносные функции
Регистрирует BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E2CE5719-1895-1B26-041F-A19119F4671F}]
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\01567f56\vd4.dat
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\guest\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\guest\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- %LOCALAPPDATA%\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- %LOCALAPPDATA%\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- %LOCALAPPDATA%\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- %LOCALAPPDATA%\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\administrator\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\administrator\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- %LOCALAPPDATA%\torch\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\b_ye@yiauoxuj.co.uk\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\b_ye@yiauoxuj.co.uk\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\b_ye@yiauoxuj.co.uk\content\bg.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\b_ye@yiauoxuj.co.uk\install.rdf
- %ProgramFiles(x86)%\adblocker\j8.tlb
- %ProgramFiles(x86)%\adblocker\j8.dat
- %LOCALAPPDATA%low\{e2ce5719-1895-1b26-041f-a19119f4671f}\adblocker.2.7.dat
- %ProgramFiles(x86)%\adblocker\j8.x64.dll
- %LOCALAPPDATA%\packages\windows_ie_ac_001\ac\{e2ce5719-1895-1b26-041f-a19119f4671f}\adblocker.2.7.dat
- %ALLUSERSPROFILE%\adblocker\vd4.exe
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- %TEMP%\01567f56\vd4.exe
- %TEMP%\01567f56\j8.x64.dll
- %TEMP%\01567f56\j8.tlb
- %TEMP%\01567f56\j8.dll
- %TEMP%\01567f56\b_ye@yiauoxuj.co.uk\content\bg.js
- %TEMP%\01567f56\b_ye@yiauoxuj.co.uk\install.rdf
- %TEMP%\01567f56\b_ye@yiauoxuj.co.uk\chrome.manifest
- %TEMP%\01567f56\b_ye@yiauoxuj.co.uk\bootstrap.js
- %TEMP%\01567f56\dfjicjbgigloghophniikbafaeejpojo\lsdb.js
- %TEMP%\01567f56\dfjicjbgigloghophniikbafaeejpojo\content.js
- %TEMP%\01567f56\dfjicjbgigloghophniikbafaeejpojo\manifest.json
- %TEMP%\01567f56\dfjicjbgigloghophniikbafaeejpojo\background.html
- %TEMP%\01567f56\dfjicjbgigloghophniikbafaeejpojo\xztk.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- %ALLUSERSPROFILE%\adblocker\vd4.dat
- %ProgramFiles(x86)%\adblocker\j8.dll
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\manifest.json
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\dfjicjbgigloghophniikbafaeejpojo\1.0\xztk.js
- %ALLUSERSPROFILE%\5000d0e6758e32d5\{4820778d-ab0d-6d18-c316-52a6a0e1d507}.20220620112748
Удаляет следующие файлы
- %TEMP%\01567f56\vd4.dat
- %TEMP%\01567f56\vd4.exe
- %TEMP%\01567f56\j8.x64.dll
- %TEMP%\01567f56\j8.tlb
- %TEMP%\01567f56\j8.dll
- %TEMP%\01567f56\b_ye@yiauoxuj.co.uk\content\bg.js
- %TEMP%\01567f56\b_ye@yiauoxuj.co.uk\install.rdf
- %TEMP%\01567f56\b_ye@yiauoxuj.co.uk\chrome.manifest
- %TEMP%\01567f56\b_ye@yiauoxuj.co.uk\bootstrap.js
- %TEMP%\01567f56\dfjicjbgigloghophniikbafaeejpojo\lsdb.js
- %TEMP%\01567f56\dfjicjbgigloghophniikbafaeejpojo\content.js
- %TEMP%\01567f56\dfjicjbgigloghophniikbafaeejpojo\manifest.json
- %TEMP%\01567f56\dfjicjbgigloghophniikbafaeejpojo\background.html
- %TEMP%\01567f56\dfjicjbgigloghophniikbafaeejpojo\xztk.js
Изменяет следующие файлы
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
Другое
Создает и запускает на исполнение
- '%TEMP%\01567f56\vd4.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Adblocker\j8.x64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Adblocker\j8.x64.dll"
