Trojan.DownLoader12.27748

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
'%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1033.tmp
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\LJD1L1CCZBJ9GS1F4F0O.temp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
%TEMP%\etilqs_bp7zzX2hKTCbTMs
%APPDATA%\Roaming\Opera Software\Opera Stable\3014.tmp
%TEMP%\etilqs_Y0eUfDLvgeBNUJC
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\15EE.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\ED9.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
%TEMP%\etilqs_Gy9eI3ecjG9WrZp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BBA.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C96.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A8F.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\7ED.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\927.tmp

Удаляет следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E6B.tmp~RF80fb8.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C95.tmp~RF80d96.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FD4.tmp~RF810a2.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF814b8.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\B6B.tmp~RF80c10.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF7ef4d.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\369.tmp~RF80914.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A6F.tmp~RF80ac9.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\916.tmp~RF809df.TMP

Перемещает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1033.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FD4.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FD4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\FD4.tmp~RF810a2.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E6B.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E6B.tmp~RF80fb8.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C95.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C95.tmp~RF80d96.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\ED9.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E6B.tmp
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\LJD1L1CCZBJ9GS1F4F0O.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
%APPDATA%\Roaming\Opera Software\Opera Stable\15EE.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
%APPDATA%\Roaming\Opera Software\Opera Stable\3014.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Local State
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF814b8.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C96.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C95.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\7ED.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\369.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\369.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\369.tmp~RF80914.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF7ef4d.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\927.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\916.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BBA.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\B6B.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\B6B.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\B6B.tmp~RF80c10.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A6F.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A6F.tmp~RF80ac9.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\916.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\916.tmp~RF809df.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A8F.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\A6F.tmp