Trojan.Crossrider.11

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%WINDIR%\tasks\shop-up-chromeinstaller.job
<SYSTEM32>\tasks\shop-up-chromeinstaller
%WINDIR%\tasks\shop-up-firefoxinstaller.job
<SYSTEM32>\tasks\shop-up-firefoxinstaller
%WINDIR%\tasks\shop-up-codedownloader.job
<SYSTEM32>\tasks\shop-up-codedownloader
%WINDIR%\tasks\shop-up-enabler.job
<SYSTEM32>\tasks\shop-up-enabler
%WINDIR%\tasks\temp_shop-up-enabler.job
<SYSTEM32>\tasks\temp_shop-up-enabler
%WINDIR%\tasks\shop-up-updater.job
<SYSTEM32>\tasks\shop-up-updater

Malicious functions

Terminates or attempts to terminate

the following user processes:

firefox.exe

Registers BHO

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411281122}]

Modifies file system

Creates the following files

%TEMP%\nsh2118.tmp
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\159_cortica_rollover_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\170_icm1_5_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\4_jquery_1_7_1.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\158_50onred_ads_only_no_fb_m.j...
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\128_superfish_pricora_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\87_ginyas_wrapper.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\91_monetizationloader.js.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\17_jquery.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\116_ads_only_5_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\28_initializer.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\108_icm_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\13_crossriderapputils.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\21_debug.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\xhr.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\175_coolmirage_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\usercode\extension.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\usercode\background.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\options.xul
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\dialog.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\background.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\search_dialog.xul
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\baseobject.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\main.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\options.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\browser.xul
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\7_hooks.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\155_ibario_pops_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\125_arcadi2_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\142_intext_fa_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\117_coupons_intext_ads_5_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\171_arcadi2_sourceid_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\101_cortica_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\14_crossriderutils.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\120_luck_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\64_appapimessage.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\126_revizer_ws_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\72_appapivalidation.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\92_superfish_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\47_resources_background.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\105_corticas_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\98_omnicommands.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\102_dealply_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\22_resources.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\138_getdeal_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\174_arcadi_serp_dynamic_id_m.j...
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\127_revizer_p_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\107_coupish_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\1_base.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\104_jollywallet_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\123_intext_adv_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\103_intext_5_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\141_corticas_ru_m.js.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\9_search_engine_hook.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\119_similar_web_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\124_superfish_no_search_no_cou...
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\135_arcadi3_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\searchsettings.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\reloadobserver.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\logfile.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\popup.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\update.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button2.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button5.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\skin.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\icon24.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button3.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button1.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\icon16.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\panelarrow-up.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\icon128.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\dom_bg.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\icon48.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\crossrider_statusbar.png
%ProgramFiles(x86)%\shop-up\shop-up-helper.exe
%ProgramFiles(x86)%\shop-up\shop-up-buttonutil.exe
%ProgramFiles(x86)%\shop-up\shop-up-buttonutil64.exe
%ProgramFiles(x86)%\shop-up\shop-up-buttonutil.dll
%ProgramFiles(x86)%\shop-up\shop-up-buttonutil64.dll
%ProgramFiles(x86)%\shop-up\shop-up.ico
%ProgramFiles(x86)%\shop-up\shop-up-bho.dll
%ProgramFiles(x86)%\shop-up\shop-up-bho64.dll
%ProgramFiles(x86)%\shop-up\background.html
%ProgramFiles(x86)%\shop-up\shop-up-bg.exe
%ProgramFiles(x86)%\shop-up\shop-up-enabler.exe
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button4.png
%ProgramFiles(x86)%\shop-up\shop-up-codedownloader.exe
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\tabs.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\browseraction.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\asyncdb.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\registry.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\updatemanager.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\console.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\delegate.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\consts.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\progresslistenerobserver.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\reports.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\installer.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\folderiowrapper.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\httpobserver.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\idbwrapper.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\requestobject.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\prefs.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\uninstallobserver.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\utils.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\request.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\firefoxnotifications.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\message.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\pageaction.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\firefoxomnibox.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\dbmanager.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\background.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\webrequest.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\firefox.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\filemanager.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\contextmenu.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\extensiondatastore.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\16_ffappapiwrapper.js
%ProgramFiles(x86)%\shop-up\shop-up-updater.exe
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\129_widdit_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\93_superfish_no_coupons_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\updatemanager.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\app_api.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\util.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\delegate.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\consts.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\crossriderapi.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\reports.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\installer.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\onbgdocumentload.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\events.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\extensiondatastore.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\storagewrapper.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\pageaction.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\93_superfish_no_coupons_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\cookie.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\chrome.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\pageactionbg.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\popup.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\background.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\icons\icon48.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\icons\actions\1.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\icons\icon16.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\icons\icon128.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\manifest.json
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins.json
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\manifest.xml
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\cookie_store.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\message.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\bg_app_api.js
%TEMP%\nsw2cbc.tmp\md5dll.dll
%TEMP%\nsh2119.tmp\system.dll
%TEMP%\nsh2119.tmp\pccodkpau.tmp
%TEMP%\nsh2119.tmp\wrapperutils.dll
%TEMP%\nsh2119.tmp\rmxuq.exe
%TEMP%\nsh2119.tmp\stdutils.dll
%TEMP%\nsh2cac.tmp
%TEMP%\nsw2cbc.tmp\stdutils.dll
%TEMP%\nsw2cbc.tmp\system.dll
%TEMP%\nsw2cbc.tmp\nsislog.dll
%TEMP%\shop-upinstaller_1598743539.log
%TEMP%\nsw2cbc.tmp\installerutils.dll
%TEMP%\nsw2cbc.tmp\nsisos.dll
%TEMP%\nsw2cbc.tmp\userinfo.dll
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\popupresource\newpopup.js
%ProgramFiles(x86)%\shop-up\utils.exe
%TEMP%\nsw2cbc.tmp\temp_file_before.tmp
%TEMP%\nsw2cbc.tmp\temp_file_after.tmp
%ProgramFiles(x86)%\shop-up\uninstall.exe
%ProgramFiles(x86)%\shop-up\42822.crx
%ProgramFiles(x86)%\shop-up\shop-up-chromeinstaller.exe
%TEMP%\nsw2cbc.tmp\execdos.dll
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\background.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\main.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\xhr.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\logging.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\popupresource\popup.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\logfile.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\78_crossriderinfo.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\129_widdit_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\117_coupons_intext_ads_5_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\158_50onred_ads_only_no_fb_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\128_superfish_pricora_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\87_ginyas_wrapper.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\91_monetizationloader.js.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\17_jquery.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\80_chpopupappapi.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\116_ads_only_5_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\28_initializer.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\108_icm_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\13_crossriderapputils.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\155_ibario_pops_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\170_icm1_5_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\4_jquery_1_7_1.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\21_debug.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\usercode\extension.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\usercode\background.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\crossridermanifest.json
%ProgramFiles(x86)%\shop-up\42822.xpi
%ProgramFiles(x86)%\shop-up\shop-up-firefoxinstaller.exe
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\install.rdf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\locale\en-us\translations.dtd
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\defaults\preferences\prefs.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome.manifest
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins.json
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\manifest.xml
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\19_chappapiwrapper.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\175_coolmirage_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\159_cortica_rollover_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\7_hooks.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\125_arcadi2_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\101_cortica_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\14_crossriderutils.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\120_luck_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\64_appapimessage.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\126_revizer_ws_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\72_appapivalidation.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\92_superfish_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\47_resources_background.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\105_corticas_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\142_intext_fa_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\102_dealply_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\138_getdeal_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\171_arcadi2_sourceid_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\174_arcadi_serp_dynamic_id_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\107_coupish_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\1_base.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\104_jollywallet_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\123_intext_adv_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\97_resourceapiwrapper.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\103_intext_5_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\141_corticas_ru_m.js.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\9_search_engine_hook.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\119_similar_web_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\124_superfish_no_search_no_coupons_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\22_resources.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\135_arcadi3_m.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\127_revizer_p_m.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\78_crossriderinfo.js
%ProgramFiles(x86)%\shop-up\installer.log

Deletes the following files

%WINDIR%\tasks\temp_shop-up-enabler.job
%TEMP%\nsh2119.tmp\stdutils.dll
%TEMP%\nsh2119.tmp\rmxuq.exe
%TEMP%\nsh2119.tmp\pccodkpau.tmp
%TEMP%\nsw2cbc.tmp\userinfo.dll
%TEMP%\nsw2cbc.tmp\temp_file_before.tmp
%TEMP%\nsw2cbc.tmp\temp_file_after.tmp
%TEMP%\nsh2119.tmp\system.dll
%TEMP%\nsw2cbc.tmp\system.dll
%TEMP%\nsw2cbc.tmp\nsisos.dll
%TEMP%\nsw2cbc.tmp\nsislog.dll
%TEMP%\nsw2cbc.tmp\md5dll.dll
%TEMP%\nsw2cbc.tmp\installerutils.dll
%TEMP%\nsw2cbc.tmp\execdos.dll
<SYSTEM32>\tasks\temp_shop-up-enabler
%TEMP%\nsw2cbc.tmp\stdutils.dll
%TEMP%\nsh2119.tmp\wrapperutils.dll

Network activity

TCP

HTTP GET requests

http://st###.#rvstatsdata.com/installer.gif?ac###################################################################################################################################################...
http://st###.#yncstatsdata.com/monetization.gif?ev###############################################################################################################################################...
http://er####.srvstatsdata.com/ie-error.gif?ac###################################################################################################################################################...
http://st###.#rvstatsdata.com/stats.gif?ac#######################################################################################################################################################...
http://st###.#rvstatsdata.com/apps.gif?ac########################################################################################################################################################...

UDP

DNS ASK st###.#rvstatsdata.com
DNS ASK st###.#yncstatsdata.com
DNS ASK er####.srvstatsdata.com
DNS ASK ap######ic.crossrider.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%TEMP%\nsh2119.tmp\rmxuq.exe'
'%ProgramFiles(x86)%\shop-up\shop-up-chromeinstaller.exe' /installcrx /agentregpath='Shop-Up' /extensionfilepath='%ProgramFiles(x86)%\Shop-Up\42822.crx' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifi...
'%ProgramFiles(x86)%\shop-up\shop-up-firefoxinstaller.exe' /installxpi /agentregpath='Shop-Up' /extensionfilepath='%ProgramFiles(x86)%\Shop-Up\42822.xpi' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifi...
'%ProgramFiles(x86)%\shop-up\shop-up-codedownloader.exe' /installapp /agentregpath='Shop-Up' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifier=fc0b09802f528515ac95ff9331d66c6e /installerversion=1_29_...
'%ProgramFiles(x86)%\shop-up\shop-up-helper.exe' /externallog='%TEMP%\Shop-UpInstaller_1598743539.log'
'%ProgramFiles(x86)%\shop-up\shop-up-bg.exe' /executebg /externallog='%TEMP%\Shop-UpInstaller_1598743539.log'
'%ProgramFiles(x86)%\shop-up\shop-up-enabler.exe' /enablebho /agentregpath='Shop-Up' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifier=fc0b09802f528515ac95ff9331d66c6e /installerversion=1_29_1...
'%ProgramFiles(x86)%\shop-up\shop-up-chromeinstaller.exe' /installcrx /agentregpath='Shop-Up' /extensionfilepath='%ProgramFiles(x86)%\Shop-Up\42822.crx' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifi...' (with hidden window)
'%ProgramFiles(x86)%\shop-up\shop-up-firefoxinstaller.exe' /installxpi /agentregpath='Shop-Up' /extensionfilepath='%ProgramFiles(x86)%\Shop-Up\42822.xpi' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifi...' (with hidden window)
'%ProgramFiles(x86)%\shop-up\shop-up-codedownloader.exe' /installapp /agentregpath='Shop-Up' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifier=fc0b09802f528515ac95ff9331d66c6e /installerversion=1_29_...' (with hidden window)
'%ProgramFiles(x86)%\shop-up\shop-up-helper.exe' /externallog='%TEMP%\Shop-UpInstaller_1598743539.log'' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho.dll"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho64.dll"' (with hidden window)
'%ProgramFiles(x86)%\shop-up\shop-up-bg.exe' /executebg /externallog='%TEMP%\Shop-UpInstaller_1598743539.log'' (with hidden window)
'%ProgramFiles(x86)%\shop-up\shop-up-enabler.exe' /enablebho /agentregpath='Shop-Up' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifier=fc0b09802f528515ac95ff9331d66c6e /installerversion=1_29_1...' (with hidden window)

Executes the following

'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho64.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho64.dll"

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial