Trojan.DownLoader12.26643

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
'%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\1MYY5E6IIKBC9YQ6G50E.temp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DA17.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D40B.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\D499.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
%TEMP%\etilqs_knYPNTGFqc28Sjh
%TEMP%\etilqs_ZFzkr0gSR6BHxUc
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CE4F.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
%TEMP%\etilqs_3fAc8MLfvyADZMc
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C749.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C8B2.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C5A2.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BBC1.tmp

Удаляет следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D3BC.tmp~RFcd8a2.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CD35.tmp~RFcd1de.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D9E7.tmp~RFcda66.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFcddef.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C8A1.tmp~RFcc908.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFcae38.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BB91.tmp~RFcc37d.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C6AC.tmp~RFcc792.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C44A.tmp~RFcc679.TMP

Перемещает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D3BC.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D3BC.tmp~RFcd8a2.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\D499.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D40B.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D3BC.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CE4F.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CD35.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CD35.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CD35.tmp~RFcd1de.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\DA17.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D9E7.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFcddef.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D9E7.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D9E7.tmp~RFcda66.TMP
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\1MYY5E6IIKBC9YQ6G50E.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BBC1.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BB91.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BB91.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BB91.tmp~RFcc37d.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFcae38.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C5A2.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C44A.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C8B2.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C8A1.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C8A1.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C8A1.tmp~RFcc908.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C6AC.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C6AC.tmp~RFcc792.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C44A.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C44A.tmp~RFcc679.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C749.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C6AC.tmp