Trojan.DownLoader12.27590

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\taskhost.exe'
'%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
'%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\TIJFUPBQ57EPKGGZ1NZN.temp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8E58.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8BC5.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D1E.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
%TEMP%\etilqs_JijOcztS25mPAXO
%TEMP%\etilqs_bfWMcLU1ckmOBG8
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8A5C.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
%TEMP%\etilqs_qpUWwfUOGOHvchN
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6D75.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6E42.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6BDE.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
%APPDATA%\Roaming\Opera Software\Opera Stable\40F5.tmp

Удаляет следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8C90.tmp~RF88dae.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8B95.tmp~RF88c57.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8E38.tmp~RF88eb7.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF892cc.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8A1C.tmp~RF88b1f.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF81b8b.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6BAE.tmp~RF86d33.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6E22.tmp~RF8896a.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6D65.tmp~RF86dfe.TMP

Перемещает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8D1E.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8C90.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8C90.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8C90.tmp~RF88dae.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8B95.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8B95.tmp~RF88c57.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8A1C.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8A1C.tmp~RF88b1f.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8BC5.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8B95.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8E58.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8E38.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF892cc.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8E38.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8E38.tmp~RF88eb7.TMP
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\TIJFUPBQ57EPKGGZ1NZN.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
%APPDATA%\Roaming\Opera Software\Opera Stable\40F5.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6BDE.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6BAE.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF81b8b.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6BAE.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6BAE.tmp~RF86d33.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6E22.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6E22.tmp~RF8896a.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8A5C.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\8A1C.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6E42.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6E22.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6D75.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6D65.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6D65.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6D65.tmp~RF86dfe.TMP