Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\conhost.exe' --type=utility --channel="1024.5.1351680076\299291249" --lang=en-US --with-feature:enhanced-autofill --ignored=" --type=renderer " /prefetch:-645351001
Modifies file system :
Creates the following files:
- %APPDATA%\Roaming\Opera Software\Opera Stable\6E10.tmp
- %HOMEPATH%\Downloads\en:Zone.Identifier
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
- %HOMEPATH%\Downloads\11EC.tmp
- %TEMP%\etilqs_33chGyIaBgEKX8E
- <Auxiliary element>
- %HOMEPATH%\Downloads\20.jpg:Zone.Identifier
- %TEMP%\etilqs_EUCYdxaY1V7MWFI
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D8E.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D2F.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8E3C.tmp
- %TEMP%\etilqs_BDBlS1YPlcWDRfV
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\QPLJWHA8AF6IGZ95IN6S.temp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8AD6.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8B64.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8CBF.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8C12.tmp
- %HOMEPATH%\Downloads\EFE.tmp
- %TEMP%\nsiC39E.tmp\Inetc.dll
- %TEMP%\nsiC39E.tmp\nsProcess.dll
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\iplookup[1].php
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\RhijZbP[1]
- %TEMP%\nsiC39E.tmp\i.rar
- %TEMP%\nsiC39E.tmp\System.dll
- %TEMP%\nssC39D.tmp
- %PROGRAM_FILES%\SetupInstall\Uninstall.exe
- %TEMP%\nsiC39E.tmp\1.ico
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SetupInstall\uninst.lnk
- %TEMP%\nsiC39E.tmp\3.ico
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
- %APPDATA%\Roaming\Opera Software\Opera Stable\914.tmp
- %TEMP%\etilqs_7VVJfQeCW9CcXVl
- %TEMP%\nsiC39E.tmp\ExecCmd.dll
- %HOMEPATH%\Desktop\Intrenet Explorer.lnk
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
Deletes the following files:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8CBE.tmp~RF98d02.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8C11.tmp~RF98c47.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D1E.tmp~RF98d50.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8E3B.tmp~RF98ef6.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D6E.tmp~RF98e1b.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8B63.tmp~RF98bca.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF7e0cc.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF98526.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8A96.tmp~RF98b4e.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
Moves the following files:
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8C11.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8C11.tmp~RF98c47.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8CBF.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8CBE.tmp
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8CBE.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8CBE.tmp~RF98d02.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8B64.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8B63.tmp
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8B63.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8B63.tmp~RF98bca.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8C12.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8C11.tmp
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D2F.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D1E.tmp
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8E3C.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8E3B.tmp
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8E3B.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8E3B.tmp~RF98ef6.TMP
- from %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\QPLJWHA8AF6IGZ95IN6S.temp to %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D1E.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D1E.tmp~RF98d50.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D8E.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D6E.tmp
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D6E.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D6E.tmp~RF98e1b.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8A96.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8A96.tmp~RF98b4e.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\914.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
- from %HOMEPATH%\Downloads\EFE.tmp to %HOMEPATH%\Downloads\20.jpg.opdownload
- from %HOMEPATH%\Downloads\11EC.tmp to %HOMEPATH%\Downloads\en.opdownload
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT to %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF7e0cc.TMP
- from %HOMEPATH%\Downloads\20.jpg.opdownload to %HOMEPATH%\Downloads\20.jpg
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT to %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF98526.TMP
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8AD6.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8A96.tmp
- from %HOMEPATH%\Downloads\en.opdownload to %HOMEPATH%\Downloads\en
- from %APPDATA%\Roaming\Opera Software\Opera Stable\6E10.tmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Local State
- from %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp to %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
Network activity:
Connects to:
- 'k.####hantea-tw.com':80
- '93.##8.134.11':80
- 'www.ic#.com':80
- 'ap#.###sys.opera.com':443
- 'au######te.geo.opera.com':443
- 'bi##.#ikimedia.org':80
- 't.#n':80
- 'in#.###ol.sina.com.cn':80
- 'si#####ck2.opera.com':80
- 'i.##0.ru':80
- 'www.go##le.ru':80
TCP:
HTTP GET requests:
- bi##.#ikimedia.org/favicon/wikipedia.ico
- i.##0.ru/2011/icons/rambler.ico
- 93.##8.134.11/favicon.ico
- www.ic#.com/en
- k.####hantea-tw.com/<Auxiliary name>.exe/20.jpg
- t.#n/RhijZbP
- in#.###ol.sina.com.cn/iplookup/iplookup.php
- si#####ck2.opera.com/?ho###############################################
- www.go##le.ru/favicon.ico
- si#####ck2.opera.com/?ho#######################################################
UDP:
- DNS ASK sl####i.yandex.ru
- DNS ASK bi##.#ikimedia.org
- DNS ASK i.##0.ru
- DNS ASK ap#.###sys.opera.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK au######te.geo.opera.com
- DNS ASK www.go##le.ru
- DNS ASK www.google.com
- DNS ASK t.#n
- DNS ASK in#.###ol.sina.com.cn
- DNS ASK www.ic#.com
- DNS ASK k.####hantea-tw.com
- DNS ASK si#####ck2.opera.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Roaming\Opera Software\Opera Stable'