Техническая информация
- '%TEMP%\nsv2.tmp\ns5.tmp' xcopy "<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\id.js" "%PROGRAM_FILES%\Notificatoin\1.0.0" /H /Y /K
- '%TEMP%\nsv2.tmp\ns6.tmp' xcopy "<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\id.js" "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}" /H /Y /K
- '%TEMP%\nsv2.tmp\ns3.tmp' "RMDIR /S /Q "%PROGRAM_FILES%\Notificatoin"
- 'C:\ProgramData\Microsoft\Windows\DRM\Server\notificatoin_1.0.0.exe' /S
- '<SYSTEM32>\xcopy.exe' "<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\id.js" "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}" /H /Y /K
- '<SYSTEM32>\xcopy.exe' "<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\id.js" "%PROGRAM_FILES%\Notificatoin\1.0.0" /H /Y /K
- firefox.exe
- iexplore.exe
- chrome.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\lang.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\legacy.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\message_target.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\kango.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\i18n.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\invoke_async.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\io.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\message_target_module.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\userscript_client.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\userscript_engine.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\utils.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\uninstall.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\messaging.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\storage.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\timer.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\icons\icon16.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\icons\icon32.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\icons\icon48.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\icons\icon128.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\f.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\icons\button.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\icons\icon100.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\install.rdf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\chrome_windows.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\console.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\content_proxy.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\browser.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\jquery.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\backgroundscript_engine.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\base.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\tail-left.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\tail-right.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\tail-top.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\tail-bottom.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\middle-left.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\middle-right.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\style.css
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\top-left.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\readme.txt
- %TEMP%\nsv2.tmp\ns6.tmp
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\id.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\p.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\top-middle.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\top-right.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\ui_base.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\content_notifications.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\context_menu.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\kango_api.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\contentNotificationStyle.tmpl
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango\xhr.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\browser_button.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\contentNotification.tmpl
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\notifications.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\bottom-left.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\bottom-middle.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\theme\bubble\bottom-right.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\popup_window.xul
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\options.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\popup.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\kango-ui\popup_window.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\notifications.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\options.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\remote_popup_host.html
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\kango_api.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\readme.txt
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\browser_button.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\context_menu.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\remote_popup_host.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\console.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\i18n.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\initialize.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\browser.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango-ui\ui_base.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\backgroundscript_engine.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\base.js
- C:\ProgramData\Microsoft\Windows\DRM\Server\notificatoin_1.0.0.xpi
- C:\ProgramData\Microsoft\Windows\DRM\Server\prefpend
- C:\ProgramData\Microsoft\Windows\DRM\Server\notificatoin_1.0.0.crx
- C:\ProgramData\Microsoft\Windows\DRM\Server\notificatoin_1.0.0.exe
- %TEMP%\nsv2.tmp\UserMgr.dll
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\nsProcess.dll
- %TEMP%\nsv2.tmp\ZipDLL.dll
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\jquery.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\manifest.json
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\p.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\f.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\b.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\background.html
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\extension_info.json
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\icons\icon32.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\icons\icon48.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\id.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\icons\icon16.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\icons\button.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\icons\icon100.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\icons\icon128.png
- %TEMP%\nsv2.tmp\nsExec.dll
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\bootstrap.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\chrome.manifest
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\extension_info.json
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\background.html
- %TEMP%\nsv2.tmp\ns3.tmp
- %TEMP%\nsv2.tmp\ns5.tmp
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{941E9C01-F8E0-493E-B814-E693BC99A1A1}\b.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\legacy.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\message_target.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\message_target_module.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\lang.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\invoke_async.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\io.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\kango.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\messaging.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\utils.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\xhr.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\includes\content.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\userscript_engine.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\storage.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\timer.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\hmhfbmpdiffkamakhdbcgojfnbnlcenm\1.0.0_0\kango\userscript_client.js
- %TEMP%\nsv2.tmp\nsProcess.dll
- %TEMP%\nsv2.tmp\nsExec.dll
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\ZipDLL.dll
- %TEMP%\nsv2.tmp\UserMgr.dll
- C:\ProgramData\Microsoft\Windows\DRM\Server\notificatoin_1.0.0.exe
- %TEMP%\nsv2.tmp\ns5.tmp
- %TEMP%\nsv2.tmp\ns3.tmp
- %TEMP%\nsv2.tmp\ns6.tmp
- C:\ProgramData\Microsoft\Windows\DRM\Server\notificatoin_1.0.0.xpi
- C:\ProgramData\Microsoft\Windows\DRM\Server\prefpend
- ClassName: '#32770' WindowName: '(null)'