Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\4f726ad4\awhm4ki8ij78jv3.dat
- %TEMP%\4f726ad4\w4968x@a.edu\content\bg.js
- %TEMP%\4f726ad4\w4968x@a.edu\bootstrap.js
- %TEMP%\4f726ad4\w4968x@a.edu\chrome.manifest
- %TEMP%\4f726ad4\w4968x@a.edu\install.rdf
- %TEMP%\4f726ad4\ffclkjfkmjlhkggfmilmohocnbmadnld\hoe1f.js
- %TEMP%\4f726ad4\ffclkjfkmjlhkggfmilmohocnbmadnld\background.html
- %TEMP%\4f726ad4\ffclkjfkmjlhkggfmilmohocnbmadnld\manifest.json
- %TEMP%\4f726ad4\ffclkjfkmjlhkggfmilmohocnbmadnld\content.js
- %TEMP%\4f726ad4\ffclkjfkmjlhkggfmilmohocnbmadnld\lsdb.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\administrator\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\administrator\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\guest\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\guest\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- %LOCALAPPDATA%\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- %LOCALAPPDATA%\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- %LOCALAPPDATA%\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- %LOCALAPPDATA%\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- %LOCALAPPDATA%\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\hoe1f.js
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\ffclkjfkmjlhkggfmilmohocnbmadnld\2.0\manifest.json
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- <SYSTEM32>\grouppolicy\machine\registry.pol
- <SYSTEM32>\grouppolicy\gpt.ini
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions\staged\w4968x@a.edu\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions\staged\w4968x@a.edu\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions\staged\w4968x@a.edu\content\bg.js
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions\staged\w4968x@a.edu\install.rdf
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\extensions\staged\w4968x@a.edu\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\extensions\staged\w4968x@a.edu\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\extensions\staged\w4968x@a.edu\content\bg.js
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\extensions\staged\w4968x@a.edu\install.rdf
- %ALLUSERSPROFILE%\1e3d95e6943dc858\{c87834eb-a2a0-b9d4-aa9a-c263d1191051}.20260211121501
Удаляет файлы, которые сам же создал
- %TEMP%\4f726ad4\awhm4ki8ij78jv3.dat
- %TEMP%\4f726ad4\w4968x@a.edu\content\bg.js
- %TEMP%\4f726ad4\w4968x@a.edu\bootstrap.js
- %TEMP%\4f726ad4\w4968x@a.edu\chrome.manifest
- %TEMP%\4f726ad4\w4968x@a.edu\install.rdf
- %TEMP%\4f726ad4\ffclkjfkmjlhkggfmilmohocnbmadnld\hoe1f.js
- %TEMP%\4f726ad4\ffclkjfkmjlhkggfmilmohocnbmadnld\background.html
- %TEMP%\4f726ad4\ffclkjfkmjlhkggfmilmohocnbmadnld\manifest.json
- %TEMP%\4f726ad4\ffclkjfkmjlhkggfmilmohocnbmadnld\content.js
- %TEMP%\4f726ad4\ffclkjfkmjlhkggfmilmohocnbmadnld\lsdb.js
Изменяет следующие файлы
- %LOCALAPPDATA%\google\chrome\user data\local state
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
Другое
Запускает на исполнение
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s fhsvc
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -s WPDBusEnum
