Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\temp_59a38043-a41e-4422-94c8-8f395a47c605.job
- %WINDIR%\Tasks\59a38043-a41e-4422-94c8-8f395a47c605.job
- %WINDIR%\Tasks\17349c7a-cd45-4136-aaf2-0136689d6bc1.job
- %WINDIR%\Tasks\8224a317-e649-462f-a935-8bec295f19a2-4.job
- %WINDIR%\Tasks\8224a317-e649-462f-a935-8bec295f19a2-11.job
- %WINDIR%\Tasks\8224a317-e649-462f-a935-8bec295f19a2-3.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineUA.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineCore.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
- '%PROGRAM_FILES%\HQPureV1.8\59a38043-a41e-4422-94c8-8f395a47c605.exe' 001904 7B002BDA7E544298AF0DA4FC9889B7B5IE 61762 1408671386 93-0,102-0,104-0,178-288,179-288,180-288,223-288,263-24 HQPureV1.8
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regserver
- '%TEMP%\comh.174703\GoogleUpdate.exe' /silent /install "appguid={3873b20d-2792-4cbe-a8bb-1c984ba448a7}&appname=09d3e00d-00fb-407b-bf20-e2e4947b5c07&needsadmin=True&lang=en"
- '%PROGRAM_FILES%\HQPureV1.8\8224a317-e649-462f-a935-8bec295f19a2-3.exe' /rawdata=Z2y/i/+pRhtDv2eDziJvWipIZ2N8INW9jgKGsitbFZAOGX6jlJ8gAAErlHQuVXKCZI7Ao2pC/yyuUb3AYfBbSTJ87ItDPZ6/qHf+vjBSkBNTb9cEWE5nIX0H4NH7DmZWv1EheJOaR1ExaT+qTjcVKqsMBth9WzEl1R5oAgmiwv3AMUNqqRVV4msrz8oqboz1fraCKJsyVgX5AWsTHXfqUVjIhbuokSNUN3pQ2xQCZwnJ/aE76gqGmlZbTFZQyccQEZeTKC6igEv2Z6NUOqXCXgLfi5Lu3faYH9WrYYjtQZnqRSIOvgOtPeQwDsRuIkkvJEdQfQm8IMzIAtjgEpyGq43CMrKrFEahM42/qmhE8ApcI0vuhb66O7rhbPPvu9qI5JtkEXi5OaEXMkxOJPVz6C1lDwZ0Apkmap2NbXine/HrhowCnbTBnz4NfezztWpwMLfSRoMyMNG5R0qTYO9DZvdOx3avmrxa3nvn0O+Mh0VJxP2QvOY3O+27ZPFaI7+Wk93Kv+xTXzprSjrltgbhj8KIg/vj3UL3MMfSkiFhimcQUUprLAhzcBP8HDBRfvQe0NqFCYrf/Lnlwq+4E6qwvuZYE2Q7v/EKdo9vvliICk74SBPdxBtaRRQo+mxcuWcXHYWNQ6rk7Ug36Z7YiKUaTDi+E3NW/N1Ux36DUsqKHoo9zVWsEed2l0b3UHd+qfL46156pQfkVTH9dG9FZt5LRfeEQCIIKvmePLNCiVnGQeU25C9EN/YB9ifyfhY2aCJXHcIwHnEw063inC6BzsxRw3fuammeX4/APPPp2ZuBtTVQomNuiwFTnLglKjgEUfN4Lwhkngy6LxuMGXA6cFpqhhVhy1yUriE7UWjF22AELzgYwzdtgUTo9YgAClCbDFQIAjbfMPVyL7vGYjcej+VT9mLtBv7fe0Ruvem03MCwgZawyhJNsufRMwoB/2X9AnZiVU0IwR+/UTgvR2+lE9AFwbebJ/R1+jDoPbB3lHlRBccYP2guQdQRwewzIxh5QRt3VEtvELTJrYXufG+5CJsndmMEdiyDsa4lOGN5iLeRlPtmsoEUsk9S9QIHyykO7pf0yplX0xLCi9hITrVwH4lptgWBgc70NsuShNBYGgzeQfsYb2kzQqfJdT0RuVBidw0kD+OUFeFXT1Yc30Od6zkwjnOtp8DPzzlXJlUdUrX0YoeFTBdLspiolGAxeRooJAWHj7J4dcSAq7bdv82Ez/Jxzsh2MVvwiewmZETaDnzc7gHKRzKxcz2zl9pEovqp16A5a2Bui2fu4d3htxohYzpQc72x3FHAD1ZGg3NfFQgUUo5zrwDWUdaqTkTcE15BvNd1bCUPMAvUVx+FDFhl4UOPQFTDfZpbxQ4N+KoUgUD48qAQ9Wg4YYE24L4FA5aLN0BxlLQUUFRFOMseFu5jLsFZS3yIZjKdm6QKgWj9ylAYiLVHNWNBiPegQ9f2m1Lr5nsARF7nSLMxfnNe1hJCotpcU/z8KoqBqu+Wni6xl1gY6f9dmicH6wTh968cAyOQAPPXgQrNb9BjY7f/+N696ohOu7b74XOHvn2Q3jCUBgLPCdousaH/FEXH2Ru3ZjLnJYllCrP/dwLkrTHzcbLQOabUwM51CmP3ZGksfJ08DaPR3QKZvWsCoINeVYf1k/bmONcVwcsWAcIvxqhBqO7VwySIC3SYe+Eloa43mOpgihjXUhQ=
- '%PROGRAM_FILES%\HQPureV1.8\8224a317-e649-462f-a935-8bec295f19a2-11.exe' /rawdata=G9RZgyslt+6FOo6E5bAE+qXr7O/Ty1E2fUpN1N92giNGktvPrsSNxuoulijjU/mPj9+IJXBhChSw/YoYDJuZhlzUJYwd/qX4Dgg/2jC0maBn2naR/Kjkaxbsw/XRBZU11X/ANtZutMQs0q98uvVqHY+kVO2UlEmUfOjDSDrr2RqipDXSldGb4xQxaazbEX4+QZtuHVHtIdaJfkn6meYDnhnmGhIcNLYP1dtmDQgPiZOmgEaMpNaQUkjc156ExaDOZp6UQXhSW4VdcqfiuwKNpjBm9WmHBVuRDhiKaFkkKkYtYKfl58tR+MNqUKZ/XczQ7KjDZUE19d0Y2FrZAdFkFDGWyYXfAB+Inr4+6ByB/Ls4VLntVrKHKEoSEGHrVOpgXOwu3ksnE/yCtmt9yzHcmt9D45X4960AuZEFqXX/krcT33cE/ubfkoe2Jipo/HHYsdkKmnBlcAompb+9VkTozBwa8D/jy5ZShIAaZiMOPKD92PtAImz9t196IiLBytmSHrLJYHKah06NT1ZzlinyxktSO7ufWGapP4EDyebQmJ389wujM6mFJWQJ+fwaHiMEiQwBmyUHkfDmaZcOtOEeG8kagYU43yrNE+X8upanLpcFGL6b4byFhhgYIsUDPmM0dMuKcovPZWy3NNy2pdO6cjHcusjdTucNLugj1oUDdXFeMKq/Xk86BR5rnnPkZFuW8DMWjm0nCxDc54R9hB9L5BpW9SBeJxYVLFH5yShZRsdVTMHIw0MYVYjIfuEzRCunwtOToLukMWAmpt/hbjw+HyzhuuUeLlQs0jJN8jx4FNogumnjws5HqShj3O3ALBoYH+NekqJfRedFZ+uMCKa0mIJr5lHH+VOqBYiOWM44VrUQAaZnfhbyW9/jmFThuOhofoOKSKFUqcLtIJjLmNm/fEnbNjY/brrfvx6MPw7TusaaG0IO3j2M7Yvo/OF0mffc+BkGZ7NVPMNJaZXxHUaTKeUpbNZk/2Nhm7I7eyKnEVYfybcaZaYQ80eqpMgLnX+0AvEIuw57JKKxEpPvZ4WT7wVUF7rsNdn/SBNfGvvzEmodU2OEgYnq2MZT5uFIA0kWkVCozdu3U8DXLmt+OsR4TQmsc2KtIWDwKpaNEl/7PDuv7iMK0y/8Ep/UtAeb2uMPXMDFEi3CU56O0dK3tZa8aAvNiVU8Tb89jEkWkk080O25gYtTTE/XBnE4XuHd56/YdAsZgHYJ+ngIgKFrRocZBkysJWUlN49EJs2GuJHNc8WCy7AoT6yk1x1DW4UyNW9ysFVzIc3M3LOJek3Fw7wWGkjgo7Q7zqtLOpEvH3ymn6O2JxGDhhHrLKi44Xew9ao0DYRak/1W1vUGfz55K+C3BAYhu6IwsFCA3fxjFlr7j/Lov+WJsMtxiuuifyV4Omx8VKJTEkm+6WDt97AtnMI/J97WgS8vJ0+okwDGa0yb/dGMgVi1JfiSC+DUtEWJfZajX5hnz717qQB71H95cjqwedm47uDR5epEisBKFlTZFF9TK7Q/VJQCW5hJu0e3pOOKTPjGub2NLai4N4tRR2i10SyvskaD9zmheYwuv+X3yYVPVsaN33GihqIT4Xe/hZ43KLvNXdeubC4dwjJjTJHu/PDOf1c38u5+gBAJIeDEoJuVJ0nYNNrL8kyAkhaBjAp7kVxsIp0U19+NDF/nUunJEaGZYyJkrGhkvo1YNVyjG3MTRcgY7a99xbA+OXINgM3NfqinBWYOjLY2vdBiqMdTHaLEEFctVStYD++7fB23AxepGzSO8+dZffJxoVzA5xhSVfHpeWuAf0XdJ0t5hAY/RlsFf0Qp5mzVwHKIqSzEyx6EE640PSrUURkW8TuMpKqBdsdfhyo9EQjqI900ljlNo67qf+4Wg653xQl4A64wzABRcpIGL8NSyrJXNb7sm5lBSRZs+/cxS48N2xRSlnpWpxoVGZ8Xuw2v8DG1BxxLwsf4YrEAcVmzrzmCq6AlYjXCA7Px7BH6PmdvMBnYy2kdoVgFuBGkwMOMm9Lc0XslaBSbqWzlLMbrWIMmjbvGPq3W
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' /V
Завершает или пытается завершить
следующие пользовательские процессы:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\HQPureV1.8\59a38043-a41e-4422-94c8-8f395a47c605.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %TEMP%\Cab8.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %PROGRAM_FILES%\HQPureV1.8\Interop.IWshRuntimeLibrary.dll
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\HQPureV1.8\8224a317-e649-462f-a935-8bec295f19a2-11.exe
- %PROGRAM_FILES%\HQPureV1.8\b1523690-4d4e-4988-8153-8d5551a30158.crx
- %PROGRAM_FILES%\HQPureV1.8\8224a317-e649-462f-a935-8bec295f19a2.crx
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %PROGRAM_FILES%\HQPureV1.8\1293297481.mxaddon
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %TEMP%\Cab6.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %WINDIR%\Installer\MSIA.tmp
- C:\Config.Msi\47c34.rbs
- %WINDIR%\Installer\47c31.msi
- %PROGRAM_FILES%\HQPureV1.8\8224a317-e649-462f-a935-8bec295f19a2.xpi
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70
- %PROGRAM_FILES%\HQPureV1.8\8224a317-e649-462f-a935-8bec295f19a2-4.exe
- %TEMP%\MSI49bee.LOG
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70
- %PROGRAM_FILES%\HQPureV1.8\8224a317-e649-462f-a935-8bec295f19a2_.xpi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\HQPureV1.8\Newtonsoft.Json.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\HQPureV1.8\SuperSocket.ClientEngine.Protocol.dll
- %PROGRAM_FILES%\HQPureV1.8\WebSocket4Net.dll
- %PROGRAM_FILES%\HQPureV1.8\SuperSocket.ClientEngine.Common.dll
- %PROGRAM_FILES%\HQPureV1.8\SuperSocket.ClientEngine.Core.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %TEMP%\nsi3.tmp\287059
- %TEMP%\nsi3.tmp\72562
- %TEMP%\nsi3.tmp\update.json
- %PROGRAM_FILES%\HQPureV1.8\utils.exe
- %TEMP%\comh.174703\GoogleUpdate.exe
- %TEMP%\comh.174703\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\HQPureV1.8\Uninstall.exe
- %TEMP%\comh.174703\GoogleCrashHandler.exe
- %TEMP%\nsi3.tmp\inetc.dll
- %TEMP%\nsi3.tmp\System.dll
- %TEMP%\nsi3.tmp\InstallerUtils.dll
- %TEMP%\nsi2.tmp
- %TEMP%\nsi3.tmp\StdUtils.dll
- %TEMP%\nsi3.tmp\nsisos.dll
- %TEMP%\nsi3.tmp\md5dll.dll
- %TEMP%\nsi3.tmp\InstallerUtils2.dll
- %TEMP%\nsi3.tmp\UserInfo.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\HQPureV1.8\8224a317-e649-462f-a935-8bec295f19a2-3.exe
- %PROGRAM_FILES%\HQPureV1.8\b8b7ff49-24c0-4a9a-b0e0-f7a21711fa50.crx
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %TEMP%\Cab4.tmp
- %TEMP%\nsi3.tmp\ExecDos.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %TEMP%\comh.174703\goopdate.dll
- %TEMP%\comh.174703\goopdateres_en.dll
- %TEMP%\comh.174703\GoogleUpdateHelper.msi
- %TEMP%\comh.174703\GoogleUpdateOnDemand.exe
- %TEMP%\comh.174703\psuser.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %TEMP%\comh.174703\npGoogleUpdate4.dll
- %TEMP%\comh.174703\psmachine.dll
Удаляет следующие файлы:
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Tasks\temp_59a38043-a41e-4422-94c8-8f395a47c605.job
- %WINDIR%\Installer\47c31.msi
- C:\Config.Msi\47c34.rbs
- %TEMP%\Cab4.tmp
- %TEMP%\nsi3.tmp\72562
- %TEMP%\Cab8.tmp
- %TEMP%\Cab6.tmp
Сетевая активность:
Подключается к:
- 'cr#.#hawte.com':80
- 'www.download.windowsupdate.com':80
- 'cr#.##ertrust.com':80
- 'ts####.ws.symantec.com':80
- 'er####.inputgenserv.com':80
- 'up####.inputgenserv.com':80
- 'lo##.##putgenserv.com':80
- 'st###.#nputgenserv.com':80
TCP:
Запросы HTTP GET:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- cr#.##ertrust.com/UTN-USERFirst-Object.crl
- up####.inputgenserv.com/installer_updates/001904/update.json
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
UDP:
- DNS ASK ts####.ws.symantec.com
- DNS ASK cr#.#hawte.com
- DNS ASK cr#.##modoca.com
- DNS ASK cr#.##ertrust.com
- DNS ASK www.download.windowsupdate.com
- DNS ASK er####.inputgenserv.com
- DNS ASK up####.inputgenserv.com
- DNS ASK lo##.##putgenserv.com
- DNS ASK st###.#nputgenserv.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
