Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\One.exe'
- '%TEMP%\4i.exe'
Запускает на исполнение:
- '<SYSTEM32>\conhost.exe' --type=renderer --disable-direct-npapi-requests --lang=en-US --disable-client-side-phishing-detection --with-feature:enhanced-autofill --enable-threaded-compositing --enable-delegated-renderer ...
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\errorPageStrings[1]
- %TEMP%\etilqs_NyYEGfVhKwJ5IFd
- <Служебный элемент>
- %TEMP%\etilqs_vAIgDeT9lf4vrv7
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\ErrorPageTemplate[1]
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\errorPageStrings[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\info_48[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\background_gradient[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\bullet[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\background_gradient[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\info_48[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\bullet[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\ErrorPageTemplate[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\navcancl[2]
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
- %TEMP%\~DF0C414E8876E1F3C9.TMP
- %TEMP%\etilqs_fV1cr0oL8Y9R3Je
- %TEMP%\One.exe
- %TEMP%\4i.exe
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AE83.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AD78.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AF9E.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\SVKPWSR9GF3OM1C1UFJ7.temp
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\navcancl[1]
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\9A1E.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\76E4.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A631.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AC3E.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AA68.tmp
Удаляет следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AE72.tmp~RFdaf61.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AD67.tmp~RFdae0a.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AF8D.tmp~RFdb144.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFdb8f2.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AC2D.tmp~RFdad3f.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFd510c.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\9962.tmp~RFd9f4a.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A94E.tmp~RFdabe8.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A508.tmp~RFda7d2.TMP
Перемещает следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AE83.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AE72.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AE72.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AE72.tmp~RFdaf61.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AD67.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AD67.tmp~RFdae0a.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AC2D.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AC2D.tmp~RFdad3f.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AD78.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AD67.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AF9E.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AF8D.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFdb8f2.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AF8D.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AF8D.tmp~RFdb144.TMP
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\SVKPWSR9GF3OM1C1UFJ7.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
- %APPDATA%\Roaming\Opera Software\Opera Stable\76E4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\9A1E.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\9962.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFd510c.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\9962.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\9962.tmp~RFd9f4a.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A94E.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A94E.tmp~RFdabe8.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AC3E.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AC2D.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\AA68.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A94E.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A631.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A508.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A508.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A508.tmp~RFda7d2.TMP
Сетевая активность:
UDP:
- DNS ASK ap#.###sys.opera.com
- DNS ASK sl####i.yandex.ru
- DNS ASK bi##.#ikimedia.org
- DNS ASK www.re##hack.ru
- DNS ASK en.###ipedia.org
- DNS ASK re###.opera.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK 4i##chok.ru
- DNS ASK www.ic#.com
- DNS ASK www.google.com
- DNS ASK www.go##le.ru
- DNS ASK i.##0.ru
- DNS ASK si#####ck2.opera.com
Другое:
Ищет следующие окна:
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Roaming\Opera Software\Opera Stable'
