Trojan.DownLoader12.27838

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
'%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\79712A6AMBU09A2V5LHC.temp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\32F0.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3231.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3271.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
%TEMP%\etilqs_K2cn6tYVbp9CKaI
%TEMP%\etilqs_oaHJp3IaUgRxXdg
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\31A2.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
%TEMP%\etilqs_HKa2cCIUlbP4FS0
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3057.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3104.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2A8B.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
%APPDATA%\Roaming\Opera Software\Opera Stable\208A.tmp

Удаляет следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3260.tmp~RFc32d2.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\31D2.tmp~RFc3246.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\32DF.tmp~RFc3301.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFc34c5.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3192.tmp~RFc31aa.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFbfb6e.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2A5B.tmp~RFc2aa8.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\30F4.tmp~RFc315c.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3017.tmp~RFc30b0.TMP

Перемещает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3271.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3260.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3260.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3260.tmp~RFc32d2.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\31D2.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\31D2.tmp~RFc3246.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3192.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3192.tmp~RFc31aa.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3231.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\31D2.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\32F0.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\32DF.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFc34c5.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\32DF.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\32DF.tmp~RFc3301.TMP
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\79712A6AMBU09A2V5LHC.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
%APPDATA%\Roaming\Opera Software\Opera Stable\208A.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2A8B.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2A5B.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFbfb6e.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2A5B.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2A5B.tmp~RFc2aa8.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\30F4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\30F4.tmp~RFc315c.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\31A2.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3192.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3104.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\30F4.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3057.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3017.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3017.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3017.tmp~RFc30b0.TMP