Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\7f5b27df\7En_x.exe'
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
- firefox.exe
- chrome.exe
Modifies file system :
Creates the following files:
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\lsdb.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\content.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\yWPiXsVqOd.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\manifest.json
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\background.html
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\lsdb.js
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\content.js
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\yWPiXsVqOd.js
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\manifest.json
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\background.html
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\lsdb.js
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\content.js
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\yWPiXsVqOd.js
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\manifest.json
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\background.html
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\lsdb.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\content.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\yWPiXsVqOd.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\manifest.json
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\background.html
- %TEMP%\7f5b27df\wdso.sqzv@wfabua.org\install.rdf
- %TEMP%\7f5b27df\wdso.sqzv@wfabua.org\content\bg.js
- %TEMP%\7f5b27df\wdso.sqzv@wfabua.org\bootstrap.js
- %TEMP%\7f5b27df\wdso.sqzv@wfabua.org\chrome.manifest
- %TEMP%\7f5b27df\p6sL.dll
- %TEMP%\7f5b27df\7En_x.exe
- %TEMP%\7f5b27df\7En_x.dat
- %TEMP%\7f5b27df\p6sL.tlb
- %TEMP%\7f5b27df\p6sL.x64.dll
- %TEMP%\7f5b27df\gccncaiionejdbhopdnmgfmndkebgkfd\lsdb.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\lsdb.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\content.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\yWPiXsVqOd.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\manifest.json
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\gccncaiionejdbhopdnmgfmndkebgkfd\2.0\background.html
- %TEMP%\7f5b27df\gccncaiionejdbhopdnmgfmndkebgkfd\manifest.json
- %TEMP%\7f5b27df\gccncaiionejdbhopdnmgfmndkebgkfd\content.js
- %TEMP%\7f5b27df\gccncaiionejdbhopdnmgfmndkebgkfd\yWPiXsVqOd.js
- %TEMP%\7f5b27df\gccncaiionejdbhopdnmgfmndkebgkfd\background.html
