Trojan.DownLoader11.64194

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%WINDIR%\explorer.exe'
'%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
'%WINDIR%\explorer.exe' /s , "http://www.he##123.net/"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\XILOF4BCO2B73QCEI8VM.temp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2E6D.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2C76.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2D53.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
%TEMP%\etilqs_HHAQdijLre5PoZi
%TEMP%\etilqs_xxUQ6wwSceu6Wx1
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2B8A.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
%TEMP%\etilqs_CHH7T5b8Z98Zr0m
%APPDATA%\Roaming\Opera Software\Opera Stable\2723.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\27A2.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\205E.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1EB7.tmp

Удаляет следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2D32.tmp~RFc2e11.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2C66.tmp~RFc2d18.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2E5D.tmp~RFc2efb.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFc3255.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2B5A.tmp~RFc2c2e.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFc0109.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1E97.tmp~RFc202d.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2772.tmp~RFc2876.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\204E.tmp~RFc21f1.TMP

Перемещает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2D53.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2D32.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2D32.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2D32.tmp~RFc2e11.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2C66.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2C66.tmp~RFc2d18.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2B5A.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2B5A.tmp~RFc2c2e.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2C76.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2C66.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2E6D.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2E5D.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFc3255.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2E5D.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2E5D.tmp~RFc2efb.TMP
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\XILOF4BCO2B73QCEI8VM.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1EB7.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1E97.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1E97.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\1E97.tmp~RFc202d.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFc0109.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\205E.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\204E.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2772.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2772.tmp~RFc2876.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2B8A.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2B5A.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\27A2.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\2772.tmp
%APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\204E.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\204E.tmp~RFc21f1.TMP
%APPDATA%\Roaming\Opera Software\Opera Stable\2723.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences