Trojan.Hosts.50179

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ixp000.tmp\coolorus.exe
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\mimetype
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\async\lib\async.js
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\async\package.json
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\extract-opts\out\lib\extract-opts.js
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\extract-opts\package.json
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\getmac\bin\getmac-node
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\getmac\out\lib\getmac.js
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\getmac\package.json
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\node-uuid\bin\uuid
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\node-uuid\package.json
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\node-uuid\uuid.js
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\punycode\license-mit.txt
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\punycode\package.json
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\punycode\punycode.js
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\querystring\decode.js
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\querystring\encode.js
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\querystring\index.js
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\querystring\package.json
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\typechecker\cyclic.js
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\typechecker\out\lib\typechecker.js
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\typechecker\package.json
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\url\package.json
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\url\test.js
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\meta-inf\signatures.xml
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\url\url.js
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\locale\zh_cn\messages.properties
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\locale\pt_br\messages.properties
%TEMP%\ixp000.tmp\csxs.exe
%TEMP%\ixp000.tmp\host.exe
%TEMP%\ixp000.tmp\instal~1.exe
%TEMP%\7b08.tmp\instalador.bat
%TEMP%\840d.tmp\host.bat
%TEMP%\849a.tmp\csxs.bat
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\.ds_store
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\assets\icon.png
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\assets\icondark.png
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\assets\icondark_x2.png
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\assets\icon_x2.png
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\csxs\manifest.xml
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\font\menlo-regular-webfont.woff
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\font\menlo-regular-webfont.woff2
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\index.html
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\jsx\phxs.jsx
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\locale\bg_bg\messages.properties
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\locale\cs_cz\messages.properties
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\locale\de_de\messages.properties
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\locale\es_es\messages.properties
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\locale\fr_fr\messages.properties
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\locale\ja_jp\messages.properties
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\locale\messages.properties
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\locale\ru_ru\messages.properties
%CommonProgramFiles(x86)%\adobe\cep\extensions\coolorus\node_modules\url\util.js

Удаляет следующие файлы

%TEMP%\7b08.tmp\instalador.bat
%TEMP%\ixp000.tmp\instal~1.exe
%TEMP%\ixp000.tmp\host.exe
%TEMP%\ixp000.tmp\csxs.exe
%TEMP%\ixp000.tmp\coolorus.exe
%TEMP%\840d.tmp\host.bat
%TEMP%\849a.tmp\csxs.bat

Изменяет файл HOSTS.

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\ixp000.tmp\instal~1.exe'
'%TEMP%\ixp000.tmp\coolorus.exe'
'%TEMP%\ixp000.tmp\csxs.exe'
'%TEMP%\ixp000.tmp\host.exe'
'%TEMP%\ixp000.tmp\instal~1.exe' ' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7B08.tmp\instalador.bat" %TEMP%\IXP000.TMP\INSTAL~1.EXE"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\849A.tmp\CSXS.bat" CSXS.exe"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\840D.tmp\host.bat" host.exe"' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7B08.tmp\instalador.bat" %TEMP%\IXP000.TMP\INSTAL~1.EXE"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\849A.tmp\CSXS.bat" CSXS.exe"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\840D.tmp\host.bat" host.exe"
'%WINDIR%\syswow64\reg.exe' query "HKU\S-1-5-19\Environment"
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Adobe\CSXS.10" /v "LogLevel" /t REG_SZ /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Adobe\CSXS.10" /v "PlayerDebugMode" /t REG_SZ /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Adobe\CSXS.9.4" /v "LogLevel" /t REG_SZ /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Adobe\CSXS.9.4" /v "PlayerDebugMode" /t REG_SZ /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Adobe\CSXS.9" /v "LogLevel" /t REG_SZ /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Adobe\CSXS.9" /v "PlayerDebugMode" /t REG_SZ /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Adobe\CSXS.8" /v "LogLevel" /t REG_SZ /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Adobe\CSXS.8" /v "PlayerDebugMode" /t REG_SZ /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Adobe\CSXS.7" /v "LogLevel" /t REG_SZ /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Adobe\CSXS.7" /v "PlayerDebugMode" /t REG_SZ /d "1" /f