Trojan.DownLoader12.2307

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%WINDIR%\explorer.exe' /pid=0xccc /log
'%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
'%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5F9B.tmp
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q7WZPODMNN8IDHOJZ5RX.temp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5D82.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E30.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E70.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
%TEMP%\etilqs_lbnvPklf1hYSkfw
%TEMP%\etilqs_w6H6bAvKTyMDRBU
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
%TEMP%\etilqs_sqww1uFQDxOw3ap
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\55EE.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\58DD.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5B3F.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
%APPDATA%\Roaming\Opera Software\Opera Stable\3ACE.tmp
<Служебный элемент>

Удаляет следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E60.tmp~RF75f5e.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E1F.tmp~RF75e45.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5F7A.tmp~RF75fac.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF76103.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5D72.tmp~RF75d99.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF714d7.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\55ED.tmp~RF758c9.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5B1F.tmp~RF75d2c.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\58DC.tmp~RF75aad.TMP

Перемещает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E70.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E60.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E60.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E60.tmp~RF75f5e.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E1F.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E1F.tmp~RF75e45.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5D72.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5D72.tmp~RF75d99.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E30.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E1F.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5F9B.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5F7A.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF76103.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5F7A.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5F7A.tmp~RF75fac.TMP
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q7WZPODMNN8IDHOJZ5RX.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
%APPDATA%\Roaming\Opera Software\Opera Stable\3ACE.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\55EE.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\55ED.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF714d7.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\55ED.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\55ED.tmp~RF758c9.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5B1F.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5B1F.tmp~RF75d2c.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5D82.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5D72.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5B3F.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5B1F.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\58DD.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\58DC.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\58DC.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\58DC.tmp~RF75aad.TMP