Trojan.DownLoader11.57913

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
'%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\HMOUVHZH9SXENPTJS85X.temp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2832.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2AB4.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2EDB.tmp
<Служебный элемент>
%TEMP%\etilqs_0XhsSZfqF1RQg22
%TEMP%\etilqs_12JlH1HPXm66jhS
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
%TEMP%\etilqs_l9cJzIiCFbi94du
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\1FE3.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2004.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\22C4.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\18DE.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1B8E.tmp

Удаляет следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2A74.tmp~RFc2dc3.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2822.tmp~RFc2912.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2EAB.tmp~RFc2f1b.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFc35cf.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\22A4.tmp~RFc24de.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFbf99a.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\18DD.tmp~RFc1adf.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1FE4.tmp~RFc2126.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1B10.tmp~RFc1f23.TMP

Перемещает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2AB4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2A74.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2A74.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2A74.tmp~RFc2dc3.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2822.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2822.tmp~RFc2912.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\22A4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\22A4.tmp~RFc24de.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2832.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2822.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2EDB.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2EAB.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFc35cf.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2EAB.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2EAB.tmp~RFc2f1b.TMP
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\HMOUVHZH9SXENPTJS85X.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\18DE.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\18DD.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\18DD.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\18DD.tmp~RFc1adf.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFbf99a.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1B8E.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1B10.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1FE4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1FE4.tmp~RFc2126.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\22C4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\22A4.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2004.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1FE4.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1B10.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1B10.tmp~RFc1f23.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\1FE3.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences