Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\376062d4-fc2b-41c1-bdc7-7406eaf8c668-4.job
- %WINDIR%\Tasks\376062d4-fc2b-41c1-bdc7-7406eaf8c668-11.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
- '%PROGRAM_FILES%\E-shop\376062d4-fc2b-41c1-bdc7-7406eaf8c668-4.exe' /QgiiMnXzq /XadzHIww='E-shop' /fCfJX='%PROGRAM_FILES%\E-shop\50710.xpi' /WBVVcYffv=50710 /yIXCdEKO='001757' /CwNlFMqeX='0' /qPYFlsN='0' /YHmJV=049F80EAF5A14A849A1ED5BEA92BA411IE /BnpVqFDpn=163476022bb250a90eac340c2607f8f0 /etxFYCE=1_34_07_01 /YfbGDCq=1.34.7.1 /JAjDd=1418331278 /trxahYOU=http://st###.#eninfocloud.com /reyYiam=http://er####.geninfocloud.com /knWQD=300 /EuIJVVI=db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com /ZGqprACX=0.94 /BPrYpwcRe=adb8669c1641c478087dfe5fe95f7a37f27fb782ac8ac47c6874e307063564320com50710 /fWuqVBhsC=https://w9u6a2p6.ssl.hwcdn.net/plugin/ff/update/50710.rdf /xhmeiqra='E-shop' /CpOFdklEl='E-shop' /TkjSuqfV='Media Corporation' /atTom=ie /ZdUsBlTv='{"asw":[0, 0, 0]}' /djFTHdXJ /ssrDu /tblFJ /VSJDh='http://up####.geninfocloud.com/ff_agent_updates/{CAMP_ID}/update.json' /hgKqx /ZlZaDEXvD='installer' /sFkjK='%TEMP%\E-shopInstaller_1418331278.log'
- '%PROGRAM_FILES%\E-shop\376062d4-fc2b-41c1-bdc7-7406eaf8c668-11.exe' /ZTbYD=H+3d+vyUxN2Pgico6H3qpY3MwP5t6KlAGyDc1P9P11aS1TapgxNatOZqabM89ZeHv9MGQMgXJVr8cF1P476EzIuKzI2ADnBZ0KfQzo63ODtY/2kdo/o/eg0zKyYesOyAQGsmoFbO0bKI0TPeRPWV+H3OhIWNcPAet2m9tTWPneUKj7GfaJnOQutw4K+bYOgGIkM1xVtro2AzRNqsBdP9QcDv76nVXLTrH687hW9ZHouC2+imJniFZAI1Ttt1mRvznvex0CYfSB+AdS/t98VrzP5PT9ZYtYvwsd65BUX7QIuSFJGHiyYALZEUE4aYhNN/oArcDQUbcgO0j58bgS3i7rtr6EuJjDGEMmEIWFVg6NLLheA3ZMALfm1fO98hHcF9PeQtrlZWZl4PxJ7ZCj/aZotcRNrOyk+fDR6DIgISpXJ317rDj0snE7Q4ln9ZEhocbLJMCTcAqTg0S5UXt9Io3PT48iPLRQkRQnp6t4798H/jEHMdFUKM30cMiBVXkDlTE8MJ+99XtVQ1DxF+CkZkcwt3Vs+DRPA3thmgJEnehdzZU2BFsk6LwmWgsINBUoiD79Kb8PacLmPlVDKCzNovTxqhyWxiSAFuO4IYwJc1HHyR9xho1hhz4cosDtfZOV9N7xqXDkp39A/Wsw8+jak1DFee0Ao5yiggWtmb1Axs2DUjK3JYLEGC79rkluNTzLHz2A5Fp9UHg53Y4oRKmTawJ9LFDoU23xh4X1xi1IN5VwquME0ZcyayorDeIXzcc353DS8qPrwFiBP7LBm7qpz6/LVoSDc2xaOdlTBVNa59/Alg0Yjp2Hd3bO96ooeEWQavXUKwUqfyDDDFRuqR8rlw2sM2vDUd4IduFO4ww5XiQH0alfZ8e258l39Ho7JNxWl7zOA9YmFceChNppOjIyy/XKf0rHm6xSgB468tPIJHtGAwIG6wHKUb70sI7UjH3QNN83WHND3n1AXc2bZyJ/N4jds0fOS+/pUk50Z97rS3YtnSc9ReniIvsvmbxIGJDpiUwHG0R+tr6Ab4mTrv/gbAk1o80aben+973nP3FqOiG5LH2v58qi744bGAWC6z7BVXtPqFKVaq3cUELh3X9yxc3cVTTswwwNeSgcs2FGXcd6aruRv5p/8znbSfcPLWPIAOdnVjN3A7Lc3nJ7U6pUAdDre5cRA4IXCLIhpPYM/nKKA9aN81orzO/p9GkcXcKI1SNP2/Vf0vum8Kq0lNtiim32T9BBJz8HNjp5B2E9Vl2mPDK0aalFi50KFu3NfYECrW5G0JHdFFQ9koKlWHugbf9o2kbVyYMnC60SJiC0ob0dpuFb1Slt7clH3aFRLbOxB5RRxocaXnKTdxJX7VOG0FLL4abFcMh8EB6WexUv/F3/fD61whnlEUAmrXr0dlHZm3qHNcm6efGSz6ecTh+1rL9IcyRMwreEtO2MmYJWObder3kshHpCkSbyb0sQkUUbV+EEryWAIVvlc6JGQhz6Pd/yynTU5LSALbRuUHfP+YZ34dyzb3D6fKCMvUW1324OSqR4ROk/xSMN5kgiSFpA1Ed5RZFssARxyaz/W4gIUsZ0HC/UjiwKbt82VZJYl5s4X+hNsL3zR+22aJy0lkSw9xs+9LZYQuovXJ0fJhh4t0v97WsBmc6XU3HDr6VXfapRyq6rjPihyrYF4qeUbeJ2eJJAtmfUkvS1KVuXEvCE0rcEg=
- '%TEMP%\nsx3.tmp\Tlxrwovr.exe'
- '%TEMP%\comh.59197\GoogleUpdate.exe' /silent /install "appguid={d912383b-38fe-43c0-9864-5f49874f13c2}&appname=d4d4b8fb-5b04-4ca7-9ec9-6a4f0cee23bb&needsadmin=True&lang=en"
Запускает на исполнение:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Завершает или пытается завершить
следующие пользовательские процессы:
- opera.exe
- firefox.exe
- iexplore.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\98.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\13.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\userCode\extension.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\207.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\78.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\102.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\47.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\17.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\background.html
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\dialog.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\9169e0da77431e6f49d0cbd4551c3d84.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\ffCoreFilesIndex.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\options.xul
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\userCode\background.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\dbe533dbbe2a33e8ac9b6dd64caee85e.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\69c451802c05546cfe6ec86fc3d5086b.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\91.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\16.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\21.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\4.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\28.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\183.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\93.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\268.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\246.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\22.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\72.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\64.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\182.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\1.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\177.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins\14.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\search_dialog.xul
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\3c1884c8136ed673cc941cf23e4da6e9.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\63ba6098fc479f8c253cfeb0afc3a163.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\c5ec48b44a39fed5b4fff7aeec329685.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\a87960f8f5729981b29e21297187e2b7.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\3eb917bd64ed6f0804f987fa8b62267d.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\25c57e240ae49bc4e5e8d505a9ea5e7f.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\131e52858b0ab1023b54d81dca5b6f6e.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\73b7bf7b7ddaba2a07072ed3e4590903.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\api\bd7ded0ef6dc6e9dbf6e18082a3cb6d6.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\api\5e73925681271291f955f9e04a64cc61.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\api\69d88e3f43d19b00ec5504c852fa6dd7.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\api\5fd56b8baaa3b6a1c1072507a15821e6.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\api\ccb3dd872a055caa6db04e1776ffcd8a.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\bc54621f42044d4dbd36cbec9afa9b92.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\api\828101721e1d2728c08c5da9c54887b7.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\api\730b8411e26c9b22e0f20f879d5d2586.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\a1a56775bc6c3a768683e60ae90df919.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\c166502283d9f826d602a3af7a74a8ce.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\81535cca3e5aacb3ba0a16d554a6c082.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\0795cb7288992076437c32e99c34bc0b.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\options.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\54e5dca6ddf97353f2bff04d97c8a3a5.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\0f283ca9e3282361dae6386814421230.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\browser.xul
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\b37902c4f3f737354605e6f71ae1fe16.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\63eb1dde78f51041a245535349090456.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\b05a46bae6b516ea6963f153c62960cd.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\installer.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\803683da6b1f69ba55217e47fd2406e6.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\da30395580de9ebef87668a28b165660.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\57904896ee39c58ae87a759a060bbd98.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome\content\core\38a40eae0f8f756af2d08b1eb57c1b05.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\manifest.xml
- %TEMP%\comh.59197\GoogleCrashHandler.exe
- %PROGRAM_FILES%\E-shop\Uninstall.exe
- %TEMP%\comh.59197\GoogleUpdateBroker.exe
- %TEMP%\comh.59197\GoogleUpdate.exe
- %PROGRAM_FILES%\E-shop\utils.exe
- %TEMP%\nsz6.tmp\108712
- %TEMP%\nsz6.tmp\294838
- %TEMP%\comh.59197\psmachine.dll
- %TEMP%\comh.59197\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %TEMP%\comh.59197\psuser.dll
- %TEMP%\comh.59197\GoogleUpdateOnDemand.exe
- %TEMP%\comh.59197\GoogleUpdateHelper.msi
- %TEMP%\comh.59197\goopdateres_en.dll
- %TEMP%\comh.59197\goopdate.dll
- %TEMP%\nsx3.tmp\StdUtils.dll
- %TEMP%\nsx3.tmp\Tlxrwovr.exe
- %TEMP%\nsz6.tmp\StdUtils.dll
- %TEMP%\nsu5.tmp
- %TEMP%\nsx3.tmp\System.dll
- %TEMP%\nsc2.tmp
- %TEMP%\nsx3.tmp\WrapperUtils.dll
- %TEMP%\nsx3.tmp\Rtzchwbskybwfg.tmp
- %TEMP%\nsz6.tmp\UserInfo.dll
- %TEMP%\nsz6.tmp\md5dll.dll
- %TEMP%\nsz6.tmp\update.json
- %TEMP%\nsz6.tmp\inetc.dll
- %TEMP%\nsz6.tmp\InstallerUtils.dll
- %TEMP%\nsz6.tmp\System.dll
- %TEMP%\nsz6.tmp\nsisos.dll
- %TEMP%\nsz6.tmp\InstallerUtils2.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %TEMP%\CabB.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\defaults\preferences\prefs.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\locale\en-US\translations.dtd
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\extensionData\plugins.json
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\chrome.manifest
- %PROGRAM_FILES%\E-shop\50710.xpi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\db8669c1-641c-4780-87df-e5fe95f7a37f@27fb782a-c8ac-47c6-874e-307063564320.com\install.rdf
- %PROGRAM_FILES%\E-shop\376062d4-fc2b-41c1-bdc7-7406eaf8c668-4.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %TEMP%\Cab7.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\E-shop\360-50710.crx
- %PROGRAM_FILES%\E-shop\1293297481.mxaddon
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\E-shop\376062d4-fc2b-41c1-bdc7-7406eaf8c668.crx
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %TEMP%\Cab9.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %TEMP%\nsz6.tmp\ExecDos.dll
- %PROGRAM_FILES%\E-shop\376062d4-fc2b-41c1-bdc7-7406eaf8c668-11.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
Удаляет следующие файлы:
- %TEMP%\Cab9.tmp
- %TEMP%\CabB.tmp
- %TEMP%\nsz6.tmp\108712
- %TEMP%\Cab7.tmp
Сетевая активность:
Подключается к:
- 'www.download.windowsupdate.com':80
- 'cr#.#hawte.com':80
- 'ts####.ws.symantec.com':80
- 'lo##.##ninfocloud.com':80
- 'up####.geninfocloud.com':80
- 'er####.geninfocloud.com':80
- 'st###.#eninfocloud.com':80
TCP:
Запросы HTTP GET:
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- ts####.ws.symantec.com/tss-ca-g2.crl
- cr#.#hawte.com/ThawteTimestampingCA.crl
- er####.geninfocloud.com/installer-error.gif?ac########################################################################################################################################################################################################################################################################################################################################################################################################
- up####.geninfocloud.com/installer_updates/001757/update.json
- lo##.##ninfocloud.com/monetization.gif?ev#############################################################################################################################################################################################################################################################################################################################################################################
- st###.#eninfocloud.com/installer.gif?ac####################################################################################################################################################################################################################################################################################################################################################################################################################################
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK lo##.##ninfocloud.com
- DNS ASK up####.geninfocloud.com
- DNS ASK er####.geninfocloud.com
- DNS ASK st###.#eninfocloud.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
