Adware.Plugin.1416

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%WINDIR%\tasks\getdeal coupon widget-chromeinstaller.job
<SYSTEM32>\tasks\getdeal coupon widget-chromeinstaller
%WINDIR%\tasks\getdeal coupon widget-firefoxinstaller.job
<SYSTEM32>\tasks\getdeal coupon widget-firefoxinstaller
%WINDIR%\tasks\getdeal coupon widget-codedownloader.job
<SYSTEM32>\tasks\getdeal coupon widget-codedownloader
%WINDIR%\tasks\getdeal coupon widget-enabler.job
<SYSTEM32>\tasks\getdeal coupon widget-enabler
%WINDIR%\tasks\temp_getdeal coupon widget-enabler.job
<SYSTEM32>\tasks\temp_getdeal coupon widget-enabler
%WINDIR%\tasks\getdeal coupon widget-updater.job
<SYSTEM32>\tasks\getdeal coupon widget-updater

Malicious functions

Executes the following

'%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://cr###rider.com/thank_you/35399

Terminates or attempts to terminate

the following user processes:

iexplore.exe
firefox.exe

Modifies file system

Creates the following files

%TEMP%\nshe466.tmp
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\webrequest.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\background.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\dbmanager.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\firefoxomnibox.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\message.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\firefoxnotifications.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\request.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\utils.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\uninstallobserver.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\requestobject.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\idbwrapper.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\httpobserver.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\installer.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\firefox.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\reports.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\consts.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\delegate.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\console.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\updatemanager.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\registry.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\prefs.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\pluginsmanager.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\reloadobserver.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\searchsettings.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\xhr.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\browser.xul
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\options.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\core\progresslistenerobserver.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\filemanager.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\contextmenu.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\asyncdb.js
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-updater.exe
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-enabler.exe
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-bg.exe
%ProgramFiles(x86)%\getdeal coupon widget\background.html
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-bho.dll
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget.ico
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-buttonutil64.dll
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-buttonutil.dll
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-buttonutil64.exe
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-buttonutil.exe
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-helper.exe
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-codedownloader.exe
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\button4.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\crossrider_statusbar.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\icon128.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\panelarrow-up.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\icon16.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\button1.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\button3.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\icon24.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\skin.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\button5.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\button2.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\update.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\popup.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\skin\icon48.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\dom_bg.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\tabs.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\api\browseraction.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\extensioncode\pagecode.js
%ProgramFiles(x86)%\getdeal coupon widget\installer.log
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\extensioncode\backgroundcode.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\baseobject.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\popupresource\newpopup.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\popupresource\popup.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\logging.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\xhr.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\background.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\app\background.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\app\extension.js
%TEMP%\nsmf23c.tmp\execdos.dll
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-chromeinstaller.exe
%ProgramFiles(x86)%\getdeal coupon widget\35399.crx
%ProgramFiles(x86)%\getdeal coupon widget\uninstall.exe
%TEMP%\nsmf23c.tmp\temp_file_after.tmp
%TEMP%\nsmf23c.tmp\temp_file_before.tmp
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\async_api.js
%ProgramFiles(x86)%\getdeal coupon widget\utils.exe
%TEMP%\nsmf23c.tmp\userinfo.dll
%TEMP%\nsmf23c.tmp\md5dll.dll
%TEMP%\nsmf23c.tmp\nsisos.dll
%TEMP%\getdeal coupon widgetinstaller_1655270282.log
%TEMP%\nsmf23c.tmp\nsislog.dll
%TEMP%\nsmf23c.tmp\system.dll
%TEMP%\nsmf23c.tmp\stdutils.dll
%TEMP%\nsrf20c.tmp
%TEMP%\nsxe477.tmp\stdutils.dll
%TEMP%\nsxe477.tmp\jilrwob.exe
%TEMP%\nsxe477.tmp\installerutils.dll
%TEMP%\nsxe477.tmp\irctiobd.tmp
%TEMP%\nsxe477.tmp\system.dll
%TEMP%\nsmf23c.tmp\installerutils.dll
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\bg_app_api.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\cookie_store.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\data_store.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\search_dialog.xul
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\background.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\dialog.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\options.xul
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome.manifest
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\defaults\preferences\prefs.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\locale\en-us\translations.dtd
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\install.rdf
%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-firefoxinstaller.exe
%ProgramFiles(x86)%\getdeal coupon widget\35399.xpi
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\crossridermanifest.json
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\manifest.json
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\icons\icon128.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\icons\icon16.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\icons\actions\1.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\icons\icon48.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\background.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\popup.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\api\chrome.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\api\cookie.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\api\message.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\events.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\onbgdocumentload.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\installer.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\reports.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\crossriderapi.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\delegate.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\util.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nfofgmjiajhfoplbakfdfmacbphhljdi\1.23.12_0\js\lib\app_api.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\b8bb8f0c-9e3c-4892-8a9f-aabefc6a8eb3@c6391171-5fee-4029-a221-0cb4884eadc0.com\chrome\content\main.js
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022061420220615\index.dat

Deletes the following files

%WINDIR%\tasks\temp_getdeal coupon widget-enabler.job
%TEMP%\nsxe477.tmp\jilrwob.exe
%TEMP%\nsxe477.tmp\irctiobd.tmp
%TEMP%\nsxe477.tmp\installerutils.dll
%TEMP%\nsmf23c.tmp\userinfo.dll
%TEMP%\nsmf23c.tmp\temp_file_before.tmp
%TEMP%\nsmf23c.tmp\temp_file_after.tmp
%TEMP%\nsxe477.tmp\stdutils.dll
%TEMP%\nsmf23c.tmp\system.dll
%TEMP%\nsmf23c.tmp\nsisos.dll
%TEMP%\nsmf23c.tmp\nsislog.dll
%TEMP%\nsmf23c.tmp\md5dll.dll
%TEMP%\nsmf23c.tmp\installerutils.dll
%TEMP%\nsmf23c.tmp\execdos.dll
<SYSTEM32>\tasks\temp_getdeal coupon widget-enabler
%TEMP%\nsmf23c.tmp\stdutils.dll
%TEMP%\nsxe477.tmp\system.dll

Modifies the following files

%LOCALAPPDATA%\google\chrome\user data\default\preferences

Network activity

Connects to

'st###.#tatsdatasrv.com':80
'er####.statsdatasrv.com':80
'ap######ic.crossrider.com':80
'cr###rider.com':80

TCP

HTTP GET requests

http://st###.#tatsdatasrv.com/installer.gif?ac###################################################################################################################################################...
http://er####.statsdatasrv.com/ie-error.gif?ac###################################################################################################################################################...
http://st###.#tatsdatasrv.com/stats.gif?ac#######################################################################################################################################################...
http://st###.#tatsdatasrv.com/apps.gif?ac########################################################################################################################################################...
http://cr###rider.com/thank_you/35399
http://cr###rider.com/cdn-cgi/styles/main.css
http://cr###rider.com/cdn-cgi/images/cf-icon-browser.png
http://cr###rider.com/cdn-cgi/images/cf-icon-ok.png
http://cr###rider.com/cdn-cgi/images/cf-icon-server.png
http://cr###rider.com/cdn-cgi/images/cf-icon-error.png
http://cr###rider.com/cdn-cgi/images/cf-icon-cloud.png
http://cr###rider.com/favicon.ico

UDP

DNS ASK st###.#tatsdatasrv.com
DNS ASK st###.myappsync.com
DNS ASK er####.statsdatasrv.com
DNS ASK ap######ic.crossrider.com
DNS ASK cr###rider.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'Static' WindowName: ''
ClassName: '#32770' WindowName: 'CrossriderApp0035399-Background'
ClassName: 'CrossriderApp0035399' WindowName: ''
ClassName: 'IEFrame' WindowName: ''

Creates and executes the following

'%TEMP%\nsxe477.tmp\jilrwob.exe'
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-chromeinstaller.exe' /installcrx /agentregpath='GetDeal Coupon Widget' /extensionfilepath='%ProgramFiles(x86)%\GetDeal Coupon Widget\35399.crx' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843...
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-firefoxinstaller.exe' /installxpi /agentregpath='GetDeal Coupon Widget' /extensionfilepath='%ProgramFiles(x86)%\GetDeal Coupon Widget\35399.xpi' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843...
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-codedownloader.exe' /installapp /agentregpath='GetDeal Coupon Widget' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843FBA435EAEDFC339904IE /verifier=76191e6ab7f3880919495e5bb6286ad8 /installe...
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-helper.exe' /externallog='%TEMP%\GetDeal Coupon WidgetInstaller_1655270282.log'
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-bg.exe' /executebg /externallog='%TEMP%\GetDeal Coupon WidgetInstaller_1655270282.log'
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-enabler.exe' /enablebho /agentregpath='GetDeal Coupon Widget' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843FBA435EAEDFC339904IE /verifier=76191e6ab7f3880919495e5bb6286ad8 /installer...
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-bg.exe' /createbg
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-chromeinstaller.exe' /installcrx /agentregpath='GetDeal Coupon Widget' /extensionfilepath='%ProgramFiles(x86)%\GetDeal Coupon Widget\35399.crx' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843...' (with hidden window)
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-firefoxinstaller.exe' /installxpi /agentregpath='GetDeal Coupon Widget' /extensionfilepath='%ProgramFiles(x86)%\GetDeal Coupon Widget\35399.xpi' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843...' (with hidden window)
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-codedownloader.exe' /installapp /agentregpath='GetDeal Coupon Widget' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843FBA435EAEDFC339904IE /verifier=76191e6ab7f3880919495e5bb6286ad8 /installe...' (with hidden window)
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-helper.exe' /externallog='%TEMP%\GetDeal Coupon WidgetInstaller_1655270282.log'' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\GetDeal Coupon Widget\GetDeal Coupon Widget-bho.dll"' (with hidden window)
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-bg.exe' /executebg /externallog='%TEMP%\GetDeal Coupon WidgetInstaller_1655270282.log'' (with hidden window)
'%ProgramFiles(x86)%\getdeal coupon widget\getdeal coupon widget-enabler.exe' /enablebho /agentregpath='GetDeal Coupon Widget' /appid=35399 /srcid='000216' /subid='0' /zdata='0' /bic=03FC1885C32843FBA435EAEDFC339904IE /verifier=76191e6ab7f3880919495e5bb6286ad8 /installer...' (with hidden window)

Executes the following

'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\GetDeal Coupon Widget\GetDeal Coupon Widget-bho.dll"

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней