Trojan.DownLoader12.3088

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
'%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\R8L1TMTU8D5XGLVGX8JW.temp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3A0D.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3B09.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3FAC.tmp
%TEMP%\etilqs_JW4Pgi1KCzT1uU5
%TEMP%\etilqs_muMNhMAcdevfdgy
<Служебный элемент>
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
%TEMP%\etilqs_fL3bjiwgdWJTPuS
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\3057.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\35E4.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3875.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\22DC.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\25EA.tmp

Удаляет следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3A7B.tmp~RF83f21.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\39ED.tmp~RF83a41.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3F9C.tmp~RF84134.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF84807.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3826.tmp~RF838ac.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF808c6.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\228D.tmp~RF82396.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3132.tmp~RF837a3.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\24C1.tmp~RF82ecd.TMP

Перемещает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3B09.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3A7B.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3A7B.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3A7B.tmp~RF83f21.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\39ED.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\39ED.tmp~RF83a41.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3826.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3826.tmp~RF838ac.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3A0D.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\39ED.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3FAC.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3F9C.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF84807.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3F9C.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3F9C.tmp~RF84134.TMP
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\R8L1TMTU8D5XGLVGX8JW.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\22DC.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\228D.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\228D.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\228D.tmp~RF82396.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF808c6.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\25EA.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\24C1.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3132.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3132.tmp~RF837a3.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3875.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3826.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\35E4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3132.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\24C1.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\24C1.tmp~RF82ecd.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\3057.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences