Trojan.DownLoader12.16402

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
'%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\1IN4YKPYIYGWOZ6ELHEV.temp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1ABF.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\16F3.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1946.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
%TEMP%\etilqs_PBY6u7HiNU0VyD2
%TEMP%\etilqs_wmPs1cALusbH30D
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1607.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
%TEMP%\etilqs_t9WWClfCk8Cgthf
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\12B9.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\14BE.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E35.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
%APPDATA%\Roaming\Opera Software\Opera Stable\D519.tmp

Удаляет следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\189A.tmp~RFd19b7.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\16B4.tmp~RFd1747.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1A02.tmp~RFd1b3d.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFd20a9.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\15B8.tmp~RFd164d.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFcb00c.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\9F0.tmp~RFd1093.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\148E.tmp~RFd1515.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\121C.tmp~RFd13ce.TMP

Перемещает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1946.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\189A.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\189A.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\189A.tmp~RFd19b7.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\16B4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\16B4.tmp~RFd1747.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\15B8.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\15B8.tmp~RFd164d.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\16F3.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\16B4.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1ABF.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1A02.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFd20a9.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1A02.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1A02.tmp~RFd1b3d.TMP
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\1IN4YKPYIYGWOZ6ELHEV.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
%APPDATA%\Roaming\Opera Software\Opera Stable\D519.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E35.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\9F0.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFcb00c.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\9F0.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\9F0.tmp~RFd1093.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\148E.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\148E.tmp~RFd1515.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1607.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\15B8.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\14BE.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\148E.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\12B9.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\121C.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\121C.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\121C.tmp~RFd13ce.TMP