Trojan.DownLoader11.62950

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
'%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y3AF2EVCXNWBFQSQ6SCX.temp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E435.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DF9F.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E2CC.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
%TEMP%\etilqs_p21ykBXqmFftVP6
%TEMP%\etilqs_fLh5f8oejbc8i21
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DEC2.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
%TEMP%\etilqs_Tl8kCwdXs9P9KE8
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D923.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DDC7.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\D470.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CF60.tmp

Удаляет следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E2AC.tmp~RFce3aa.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DF40.tmp~RFce031.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E424.tmp~RFce465.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFce5fb.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DE83.tmp~RFcded9.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFcadbc.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CEE2.tmp~RFcd538.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DD2A.tmp~RFcde0f.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D599.tmp~RFcdc1b.TMP

Перемещает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E2CC.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E2AC.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E2AC.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E2AC.tmp~RFce3aa.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DF40.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DF40.tmp~RFce031.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DE83.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DE83.tmp~RFcded9.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DF9F.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DF40.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E435.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E424.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFce5fb.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E424.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E424.tmp~RFce465.TMP
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y3AF2EVCXNWBFQSQ6SCX.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CF60.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CEE2.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CEE2.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CEE2.tmp~RFcd538.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFcadbc.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\D470.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DD2A.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DD2A.tmp~RFcde0f.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DEC2.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DE83.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DDC7.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DD2A.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D923.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D599.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D599.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D599.tmp~RFcdc1b.TMP