Trojan.DownLoader12.23162

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
'%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\VW403JSCS0T8AA7BOH6D.temp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CD38.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CE63.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
%TEMP%\etilqs_8JxDrvgxfHqzojC
%TEMP%\etilqs_4HkG4OG89Cl8igt
%APPDATA%\Roaming\Opera Software\Opera Stable\D546.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CBEF.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
%TEMP%\etilqs_dwr8YEzub4XhBOc
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C6DC.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C9CB.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C563.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C33F.tmp

Удаляет следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CCDA.tmp~RFccd9a.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CBDE.tmp~RFccc43.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CDB6.tmp~RFcceb3.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFcd336.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C853.tmp~RFcca9e.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFcaef4.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C300.tmp~RFcc503.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C6CB.tmp~RFcc7c1.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C514.tmp~RFcc6b8.TMP

Перемещает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CCDA.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CCDA.tmp~RFccd9a.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CE63.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CDB6.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CD38.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CCDA.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CBEF.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CBDE.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CBDE.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CBDE.tmp~RFccc43.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CDB6.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CDB6.tmp~RFcceb3.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFcd336.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\D546.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\VW403JSCS0T8AA7BOH6D.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C33F.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C300.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C300.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C300.tmp~RFcc503.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFcaef4.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C563.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C514.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C9CB.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C853.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C853.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C853.tmp~RFcca9e.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C6CB.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C6CB.tmp~RFcc7c1.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C514.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C514.tmp~RFcc6b8.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C6DC.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C6CB.tmp