Adware.Escort.1

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\IminentToolbar\1.8.28.0\iminentsrv.exe' /RegServer
'%TEMP%\iminentTolbar\iminent\1.8.28.0\iminent4ffx.exe'
'%TEMP%\iminentTolbar\iminent\1.8.28.0\iminent4ie.exe'

Завершает или пытается завершить

следующие пользовательские процессы:

chrome.exe

Изменения в файловой системе:

Создает следующие файлы:

<LS_APPDATA>\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\json2.min.js
<LS_APPDATA>\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\logo.png
<LS_APPDATA>\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\hprtkMsg.htm
<LS_APPDATA>\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\hprtkMsg.js
%PROGRAM_FILES%\IminentToolbar\1.8.28.0\uninstall.exe
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsoE.tmp
<LS_APPDATA>\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\manifest.json
<LS_APPDATA>\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\pref.json
<LS_APPDATA>\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\CTB.dll
<LS_APPDATA>\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\appCntrl.js
%PROGRAM_FILES%\IminentToolbar\1.8.28.0\iminent.crx
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsbD.tmp
<LS_APPDATA>\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\ct.js
<LS_APPDATA>\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\dpk.js
<LS_APPDATA>\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\bg.html
<LS_APPDATA>\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\bg.js
%TEMP%\iminentTolbar\iminent\1.8.28.0\nst19.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nss1A.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsy17.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nss18.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nso1D.tmp
%TEMP%\nsm2.tmp\InetLoad.dll
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsd1B.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsi1C.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsg11.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsp12.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nswF.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsj10.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsz15.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nse16.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nss13.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsq14.tmp
%TEMP%\nsg7.tmp\md5dll.dll
%TEMP%\nsm2.tmp\Processes.dll
%TEMP%\iminentTolbar\iminent\1.8.28.0\iminent4ie.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\searchplugins\iminent.xml
<Текущая директория>\nsh4.tmp
%TEMP%\nsr8.tmp\System.dll
%TEMP%\nsg7.tmp\System.dll
%TEMP%\iminentTolbar\iminent\1.8.28.0\iminent4ffx.exe
%TEMP%\nsg7.tmp\UserInfo.dll
%TEMP%\nsm2.tmp\nsisos.dll
%TEMP%\nsm2.tmp\chrmPref.dll
%TEMP%\nsm2.tmp\UserInfo.dll
%TEMP%\nsm2.tmp\System.dll
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\user.js
<Текущая директория>\nsk3.tmp
%TEMP%\nsm2.tmp\mt.dll
%TEMP%\nsm2.tmp\Time.dll
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsd9.tmp
%PROGRAM_FILES%\IminentToolbar\1.8.28.0\iminentTlbr.dll
%PROGRAM_FILES%\IminentToolbar\1.8.28.0\bh\iminent.dll
%PROGRAM_FILES%\IminentToolbar\1.8.28.0\iminentApp.dll
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsrB.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nseC.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nszA.tmp
%PROGRAM_FILES%\IminentToolbar\1.8.28.0\iminentsrv.exe
%TEMP%\nsg7.tmp\nsisos.dll
%TEMP%\nsr8.tmp\Time.dll
%TEMP%\nsr8.tmp\nsisos.dll
%TEMP%\nsr8.tmp\mt.dll
%TEMP%\nsg7.tmp\Time.dll
%PROGRAM_FILES%\IminentToolbar\1.8.28.0\iminentEng.dll
%TEMP%\nsg7.tmp\mt.dll
%TEMP%\mt_ffx\iminent\iminent\1.8.28.0\iminent.xpi

Удаляет следующие файлы:

%TEMP%\iminentTolbar\iminent\1.8.28.0\nsq14.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsz15.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nse16.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nss13.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsj10.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsg11.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsp12.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsy17.tmp
%TEMP%\nsr8.tmp\nsisos.dll
%TEMP%\nsr8.tmp\System.dll
%TEMP%\nsr8.tmp\Time.dll
%TEMP%\nsr8.tmp\mt.dll
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\user.js
%TEMP%\iminentTolbar\iminent\1.8.28.0\nst19.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nss1A.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsrB.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nseC.tmp
%TEMP%\nsg7.tmp\md5dll.dll
%TEMP%\iminentTolbar\iminent\1.8.28.0\nszA.tmp
<Текущая директория>\nsk3.tmp
<Текущая директория>\nsh4.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsd9.tmp
%TEMP%\nsg7.tmp\mt.dll
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsbD.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsoE.tmp
%TEMP%\iminentTolbar\iminent\1.8.28.0\nswF.tmp
%TEMP%\nsg7.tmp\UserInfo.dll
%TEMP%\nsg7.tmp\nsisos.dll
%TEMP%\nsg7.tmp\System.dll
%TEMP%\nsg7.tmp\Time.dll

Перемещает следующие файлы:

%TEMP%\iminentTolbar\iminent\1.8.28.0\nsi1C.tmp в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\user.js
%TEMP%\iminentTolbar\iminent\1.8.28.0\nso1D.tmp в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\user.js
%TEMP%\iminentTolbar\iminent\1.8.28.0\nss18.tmp в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\user.js
%TEMP%\iminentTolbar\iminent\1.8.28.0\nsd1B.tmp в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\user.js

Сетевая активность:

Подключается к:

're#####.montiera.com':80

TCP:

Запросы HTTP GET:

re#####.montiera.com/reports/jsRprt.srf?ri######################################################################################################################################################################################################

UDP: