Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\403941b4-075c-4016-b5d1-60941f22b3c2-11.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineCore.job
- %WINDIR%\Tasks\403941b4-075c-4016-b5d1-60941f22b3c2-3.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\services\globalUpdate] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /handoff "appguid={cea32c95-119d-487a-a105-20a458c84c07}&appname=eb438133-a7af-40b8-b551-7572e4782b26&needsadmin=True&lang=en" /installsource otherinstallcmd /sessionid "{8AD7587F-3A89-4F6D-8923-FA77A306543F}" /silent
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjUuMCIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins4QUQ3NTg3Ri0zQTg5LTRGNkQtODkyMy1GQTc3QTMwNjU0M0Z9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0iezZCOEUyNTk4LTExNUQtNDZFQi1BNTk4LTQxMUFFQkFCMjk1M30iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDg2Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4yNS4wIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /ua /installsource core
- '%PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe' /crashhandler
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /svc
- '%TEMP%\comh.89866\GoogleUpdate.exe' /silent /install "appguid={cea32c95-119d-487a-a105-20a458c84c07}&appname=eb438133-a7af-40b8-b551-7572e4782b26&needsadmin=True&lang=en"
- '%TEMP%\nsn8B5F.tmp\Ezepchicy.exe'
- '%PROGRAM_FILES%\Cinema-Plus-1.2\403941b4-075c-4016-b5d1-60941f22b3c2-3.exe' /uhqIvkdxV=US8pNi6tQ0Utumj91pRXC1O3ojAWGi+eQna9JRDS4LgNRO9IPiPb2lp0+eYfqhByLe6/qfG2QC7nD8uPoAe5dYy1ahSI1JVWyc2G66FappPmQRvxdl+90kCNCeXhhNqmUiNvuKwvYFxdOif8ZmSjmIyeRPlGd0wYwMqjnJDedFiw+aH2+86/v7dWu+zuU7+GHo4FTg90dxfrnbLKZfh7FX65iFgESIYDJKLvi8bdLNBZACIzegPr6i61BZxYBBQ+K6jgwAtd9QidorsujXPJHgBFKRnMPmXZHvrKhBd27KCJtTvL1671qSQvA3bfV4Pplxb8U+1s4FMLl5sYC3Mo+087pXfaMV5N17spkHIq2jBr4kqVZFmfDT0NQ5bjEmKPTFrDpy/MOYSoglbPpF/adNexiL9QwyYGyVVLWA7rJ5MbKx5XqG5PKLkZnsfYDmv8UQW7gNmwWL6Ustgj621AhwjvZBysbu7HwLq58E8ifv1p+re/9SG+lJC43CRCVhmWTmY5tKnOQAO2qz/Ms1ggou6ShAd+SG40GxoGtEWqP53XBX+mPEz6dUnCaxhytV6FL6RkE7Irihxe28zYCurkSorm7E7ElurkjxPGpt1hxD+wKUthJ09kK40ppZ2f8jbRfa+nZ/167c30xpttmidWJRU17DXt8wSfjp3Sqxi9us8cYi7AighRmrLiRO3Cy/C3O+Qo/szmGj9QwNEqsAyuI2FaqSJTvlE1gwdyKex0JYxcP/WyTGJQjGaINh+Y3l98Gi51/gtmWHGqLCzRhHp6kAcNudukp75V9gw91Ap33LT2eRARDl+5+Bhp8d/Ac3iOSskwDkwNiVZZyQ3JTZM9Gr14RcuqELF7xwQp7Pyy6fSugCvuwfMtrO/8ex9VEp731qxh2fEaZZfM9fAZnMjEGSB0xAGreati2p2ox6bjYINlbmqZPhlyUUxXkiHInPIqgNJY1u8I5kTXbnwc1kP7fMfhmSoF8Z/SlPuOkR8mtJMgR7rbE/LFsI17hsWxMRBZl1R069w94cWXOxEltS5qyk80NV4MQNv9zuorMTjel6dbPEzywLhSCMT+jWInGDAfoi4gXtlddQ8x8HGV6XlGqGW0yuc8ysYBCF/xJSzXqwVlivqfSySMPXVaOzi+Fb8KX1Tg5537WQqF43uUF58ll5kZH6Z0vnzT2PGJXA1QiXGE8GMb+ybChlNZh4oVZb3bR9XmxbRy6M09gjd4RPW4yzxeTY1ETvm72oWpHExPFcDFjwNHSCQb0Z+YIT3r0bvccTyztfvG8Uw8leFS6x7YKjg74fUgg+fnq7P8OtkLB5toNrymVa2Ae1VtN80vYsvmQOypUntGH3/sWZM6Gu6F5XKbyrAeOxffbgBvUBVp+UoNCBg7HbLXDIzKLdYnK2xFGkJvtblC8LROiV1n7lxHhg1mskqtO0JO+x+NlBbcXvTN7gO1/n5DZscWxrue1WxBdLEoDBbGMDf398Jq3lUjwHf1y9nw5cbyCjfAgUEYTxt/rIiuUc8KiFqDvkk9BryB
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
Запускает на исполнение:
- '<SYSTEM32>\conhost.exe' /regserver
- '<SYSTEM32>\msiexec.exe' /V
Завершает или пытается завершить
следующие пользовательские процессы:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\267.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\221.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\91.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\93.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\123.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\179.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\286.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\259.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\242.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\119.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\7.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\195.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\1.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\4.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\281.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\231.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\21.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\273.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\background.html
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\chromeCoreFilesIndex.txt
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\icons\actions\1.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\icons\icon48.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\api\monitor.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\api\chrome.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\popup.html
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\api\pageActionBG.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\icons\icon16.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\183.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\232.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\28.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\180.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\manifest.json
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\icons\icon128.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\manifest.xml
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins.json
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\182.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\47.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\17.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\190.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\13.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\80.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\184.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\78.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\102.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\207.js
- %PROGRAM_FILES%\Cinema-Plus-1.2\1293297481.mxaddon
- <SYSTEM32>\Tasks\403941b4-075c-4016-b5d1-60941f22b3c2-11
- %PROGRAM_FILES%\Cinema-Plus-1.2\403941b4-075c-4016-b5d1-60941f22b3c2.crx
- %PROGRAM_FILES%\Cinema-Plus-1.2\8385c2c6-f2f0-485a-9ae6-9276226d04a9.crx
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\userCode\background.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\userCode\extension.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Cookies-journal
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\Settings.json
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\72.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\177.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\284.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\260.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\263.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\9.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\19.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\14.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\104.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\22.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\178.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\64.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\191.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\223.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\262.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\246.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\97.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\extensionData\plugins\220.js
- %TEMP%\comh.89866\GoogleUpdateOnDemand.exe
- %TEMP%\comh.89866\GoogleUpdateHelper.msi
- %TEMP%\comh.89866\goopdateres_en.dll
- %TEMP%\comh.89866\goopdate.dll
- %TEMP%\comh.89866\GoogleCrashHandler.exe
- %PROGRAM_FILES%\Cinema-Plus-1.2\Uninstall.exe
- %TEMP%\comh.89866\GoogleUpdateBroker.exe
- %TEMP%\comh.89866\GoogleUpdate.exe
- %TEMP%\comh.89866\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %TEMP%\comh.89866\psuser.dll
- %TEMP%\comh.89866\psmachine.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %TEMP%\nsyA5D2.tmp\190681
- %TEMP%\nsn8B5F.tmp\StdUtils.dll
- %TEMP%\nsn8B5F.tmp\Ezepchicy.exe
- %TEMP%\nsyA5D2.tmp\StdUtils.dll
- %TEMP%\nssA563.tmp
- %TEMP%\nsn8B5F.tmp\System.dll
- %TEMP%\nsi8B4E.tmp
- %TEMP%\nsn8B5F.tmp\WrapperUtils.dll
- %TEMP%\nsn8B5F.tmp\Pgkuz.tmp
- %TEMP%\nsyA5D2.tmp\System.dll
- %TEMP%\nsyA5D2.tmp\inetc.dll
- %TEMP%\nsyA5D2.tmp\UserInfo.dll
- %TEMP%\nsyA5D2.tmp\437899
- %PROGRAM_FILES%\Cinema-Plus-1.2\utils.exe
- %TEMP%\nsyA5D2.tmp\InstallerUtils2.dll
- %TEMP%\nsyA5D2.tmp\InstallerUtils.dll
- %TEMP%\nsyA5D2.tmp\md5dll.dll
- %TEMP%\nsyA5D2.tmp\nsisos.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\delegate.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\util.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\crossriderAPI.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\consts.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\cookie_store.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\bg_app_api.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\app_api.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\updateManager.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\reports.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\api\message.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\storageWrapper.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\api\cookie.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\api\pageAction.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\onBGDocumentLoad.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\installer.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\extensionDataStore.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\events.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\logFile.js
- %PROGRAM_FILES%\Cinema-Plus-1.2\a4d3c319-7de0-4517-b593-6cb9fa7a29b6.crx
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\Cinema-Plus-1.2\403941b4-075c-4016-b5d1-60941f22b3c2-3.exe
- <SYSTEM32>\Tasks\globalUpdateUpdateTaskMachineCore
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- <SYSTEM32>\Tasks\403941b4-075c-4016-b5d1-60941f22b3c2-3
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %TEMP%\MSI8b23e.LOG
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\logging.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\xhr.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\popupResource\newPopup.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\lib\popupResource\popup.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\platformVersion.js
- %TEMP%\nsyA5D2.tmp\ExecDos.dll
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\main.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\ikpbmdkdomofnnkcaoepabekgkedfhom\1.26.51_0\js\background.js
Удаляет следующие файлы:
- %TEMP%\nsyA5D2.tmp\190681
Сетевая активность:
UDP:
- DNS ASK st###.#enstatsnet.com
- DNS ASK lo##.##nstatsnet.com
- DNS ASK www.go###eapis.com
- DNS ASK up####.genstatsnet.com
- DNS ASK er####.genstatsnet.com
- DNS ASK dn#.##ftncsi.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
