Trojan.DownLoader12.1906

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
'%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\CCZY78QFZ349FIML8KYA.temp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\10EF.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DC0.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\F09.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
%TEMP%\etilqs_LuCNx4DgSHcbKCC
%TEMP%\etilqs_XcyNRRo4WBsiuHW
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BF9.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
%TEMP%\etilqs_kiIaan9AOEWiUep
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\216.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A52.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FE6C.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
%APPDATA%\Roaming\Opera Software\Opera Stable\DEBA.tmp

Удаляет следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\ECA.tmp~RFd1026.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D71.tmp~RFd0e90.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1062.tmp~RFd11db.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFd167c.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BBA.tmp~RFd0c4f.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFcb74d.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FE4C.tmp~RFcffc1.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6B9.tmp~RFd0b07.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\12B.tmp~RFd04ff.TMP

Перемещает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\F09.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\ECA.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\ECA.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\ECA.tmp~RFd1026.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D71.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D71.tmp~RFd0e90.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BBA.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BBA.tmp~RFd0c4f.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DC0.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D71.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\10EF.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1062.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFd167c.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1062.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1062.tmp~RFd11db.TMP
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\CCZY78QFZ349FIML8KYA.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
%APPDATA%\Roaming\Opera Software\Opera Stable\DEBA.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FE6C.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FE4C.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFcb74d.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FE4C.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FE4C.tmp~RFcffc1.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6B9.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6B9.tmp~RFd0b07.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BF9.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BBA.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A52.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6B9.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\216.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\12B.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\12B.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\12B.tmp~RFd04ff.TMP