Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\TeraCopy.SFVFile\Shell\Open\command] '' = '"%PROGRAM_FILES%\TeraCopy\TeraCopy.exe" Check "%1"'
- [<HKLM>\SOFTWARE\Classes\TeraCopy.MD5File\Shell\Open\command] '' = '"%PROGRAM_FILES%\TeraCopy\TeraCopy.exe" Check "%1"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\is-F73D9.tmp\1.tmp' /SL5="$200E2,2405758,56832,<SYSTEM32>\1.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '<SYSTEM32>\1.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\TeraCopy\TeraCopyExt64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\TeraCopy\TeraCopyExt.dll"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\TeraCopy\locale\kbd\LC_MESSAGES\is-KJA7N.tmp
- %PROGRAM_FILES%\TeraCopy\locale\ko\LC_MESSAGES\is-P36NO.tmp
- %PROGRAM_FILES%\TeraCopy\locale\ja\LC_MESSAGES\is-UC93O.tmp
- %PROGRAM_FILES%\TeraCopy\locale\id\LC_MESSAGES\is-BAAKG.tmp
- %PROGRAM_FILES%\TeraCopy\locale\it\LC_MESSAGES\is-TNSM0.tmp
- %PROGRAM_FILES%\TeraCopy\locale\pt_BR\LC_MESSAGES\is-UN48K.tmp
- %PROGRAM_FILES%\TeraCopy\locale\pt_PT\LC_MESSAGES\is-66E8I.tmp
- %PROGRAM_FILES%\TeraCopy\locale\pl_PL\LC_MESSAGES\is-AV80S.tmp
- %PROGRAM_FILES%\TeraCopy\locale\nb\LC_MESSAGES\is-HMFL6.tmp
- %PROGRAM_FILES%\TeraCopy\locale\nl\LC_MESSAGES\is-IV8AJ.tmp
- %PROGRAM_FILES%\TeraCopy\locale\he_IL\LC_MESSAGES\is-5JDQS.tmp
- %PROGRAM_FILES%\TeraCopy\locale\el_GR\LC_MESSAGES\is-KEQBV.tmp
- %PROGRAM_FILES%\TeraCopy\locale\en\LC_MESSAGES\is-HTBT9.tmp
- %PROGRAM_FILES%\TeraCopy\locale\de\LC_MESSAGES\is-726N5.tmp
- %PROGRAM_FILES%\TeraCopy\locale\cs\LC_MESSAGES\is-IHMA7.tmp
- %PROGRAM_FILES%\TeraCopy\locale\da\LC_MESSAGES\is-JNV7R.tmp
- %PROGRAM_FILES%\TeraCopy\locale\fi_FI\LC_MESSAGES\is-10R0A.tmp
- %PROGRAM_FILES%\TeraCopy\locale\fr\LC_MESSAGES\is-FUUS6.tmp
- %PROGRAM_FILES%\TeraCopy\locale\fa_IR\LC_MESSAGES\is-CR936.tmp
- %PROGRAM_FILES%\TeraCopy\locale\es\LC_MESSAGES\is-M4O24.tmp
- %PROGRAM_FILES%\TeraCopy\locale\es_AR\LC_MESSAGES\is-6P31J.tmp
- %PROGRAM_FILES%\TeraCopy\unins000.msg
- %PROGRAM_FILES%\TeraCopy\unins000.dat
- %PROGRAM_FILES%\TeraCopy\TeraCopy.url
- %ALLUSERSPROFILE%\Start Menu\Programs\TeraCopy\Uninstall TeraCopy.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TeraCopy\TeraCopy Help.lnk
- %TEMP%\aut4.tmp
- %HOMEPATH%\Desktop\Uploded.net Premium Al Beklemeden İndir.url
- %HOMEPATH%\Desktop\TeraCopy.lnk
- %TEMP%\aut3.tmp
- %APPDATA%\TeraCopy\license
- %ALLUSERSPROFILE%\Start Menu\Programs\TeraCopy\TeraCopy on the Web.lnk
- %PROGRAM_FILES%\TeraCopy\locale\sv_SE\LC_MESSAGES\is-324ES.tmp
- %PROGRAM_FILES%\TeraCopy\locale\th_TH\LC_MESSAGES\is-BCCH2.tmp
- %PROGRAM_FILES%\TeraCopy\locale\sl_SI\LC_MESSAGES\is-H076S.tmp
- %PROGRAM_FILES%\TeraCopy\locale\ro_RO\LC_MESSAGES\is-DBO6E.tmp
- %PROGRAM_FILES%\TeraCopy\locale\ru\LC_MESSAGES\is-K89J4.tmp
- %PROGRAM_FILES%\TeraCopy\locale\zh_Hant\LC_MESSAGES\is-R8V86.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\TeraCopy\TeraCopy.lnk
- %PROGRAM_FILES%\TeraCopy\locale\zh_Hans\LC_MESSAGES\is-DS5QT.tmp
- %PROGRAM_FILES%\TeraCopy\locale\tr_TR\LC_MESSAGES\is-F59V7.tmp
- %PROGRAM_FILES%\TeraCopy\locale\vi_VN\LC_MESSAGES\is-H9EM9.tmp
- %PROGRAM_FILES%\TeraCopy\is-89N4G.tmp
- %PROGRAM_FILES%\TeraCopy\is-C4VE8.tmp
- %PROGRAM_FILES%\TeraCopy\is-2RO5D.tmp
- %PROGRAM_FILES%\TeraCopy\is-D0M33.tmp
- %PROGRAM_FILES%\TeraCopy\is-BL97E.tmp
- %PROGRAM_FILES%\TeraCopy\is-AEFR6.tmp
- %PROGRAM_FILES%\TeraCopy\is-A4ATT.tmp
- %PROGRAM_FILES%\TeraCopy\is-6EC4T.tmp
- %PROGRAM_FILES%\TeraCopy\is-AEK68.tmp
- %PROGRAM_FILES%\TeraCopy\is-VKS2G.tmp
- %PROGRAM_FILES%\TeraCopy\is-5SDE3.tmp
- <SYSTEM32>\1.exe
- %TEMP%\is-F73D9.tmp\1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\ghgmgmm
- %PROGRAM_FILES%\TeraCopy\is-R0AGN.tmp
- %PROGRAM_FILES%\TeraCopy\is-2B40N.tmp
- %PROGRAM_FILES%\TeraCopy\is-6T5FV.tmp
- %TEMP%\is-C5T4M.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\TeraCopy\is-NDAIR.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-MCQFI.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-QQ7VO.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-N4BCV.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-E98DA.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-EOEHN.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-CFSAP.tmp
- %PROGRAM_FILES%\TeraCopy\locale\ar\LC_MESSAGES\is-71NR5.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-PCD3I.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-INU10.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-Q9GOC.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-DPIA2.tmp
- %PROGRAM_FILES%\TeraCopy\is-PS3J4.tmp
- %PROGRAM_FILES%\TeraCopy\is-ERQOQ.tmp
- %PROGRAM_FILES%\TeraCopy\is-03JNK.tmp
- %PROGRAM_FILES%\TeraCopy\is-IN5BN.tmp
- %PROGRAM_FILES%\TeraCopy\is-7PGI0.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-0II5I.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-9EQ19.tmp
- %PROGRAM_FILES%\TeraCopy\is-H2GUM.tmp
- %PROGRAM_FILES%\TeraCopy\is-4OU2H.tmp
- %PROGRAM_FILES%\TeraCopy\is-3O3LB.tmp
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\1.exe
Удаляет следующие файлы:
- %TEMP%\is-F73D9.tmp\1.tmp
- %TEMP%\is-C5T4M.tmp\_isetup\_shfoldr.dll
- <SYSTEM32>\1.exe
- %TEMP%\aut4.tmp
- %TEMP%\aut3.tmp
- %TEMP%\ghgmgmm
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %PROGRAM_FILES%\TeraCopy\TeraCopyExt64.dll
- %PROGRAM_FILES%\TeraCopy\TeraCopyExt.dll
Перемещает следующие файлы:
- %PROGRAM_FILES%\TeraCopy\locale\fa_IR\LC_MESSAGES\is-CR936.tmp в %PROGRAM_FILES%\TeraCopy\locale\fa_IR\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\fi_FI\LC_MESSAGES\is-10R0A.tmp в %PROGRAM_FILES%\TeraCopy\locale\fi_FI\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\es\LC_MESSAGES\is-M4O24.tmp в %PROGRAM_FILES%\TeraCopy\locale\es\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\es_AR\LC_MESSAGES\is-6P31J.tmp в %PROGRAM_FILES%\TeraCopy\locale\es_AR\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\id\LC_MESSAGES\is-BAAKG.tmp в %PROGRAM_FILES%\TeraCopy\locale\id\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\it\LC_MESSAGES\is-TNSM0.tmp в %PROGRAM_FILES%\TeraCopy\locale\it\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\fr\LC_MESSAGES\is-FUUS6.tmp в %PROGRAM_FILES%\TeraCopy\locale\fr\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\he_IL\LC_MESSAGES\is-5JDQS.tmp в %PROGRAM_FILES%\TeraCopy\locale\he_IL\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\ar\LC_MESSAGES\is-71NR5.tmp в %PROGRAM_FILES%\TeraCopy\locale\ar\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\cs\LC_MESSAGES\is-IHMA7.tmp в %PROGRAM_FILES%\TeraCopy\locale\cs\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\Images\is-PCD3I.tmp в %PROGRAM_FILES%\TeraCopy\Images\Star.png
- %PROGRAM_FILES%\TeraCopy\Images\is-CFSAP.tmp в %PROGRAM_FILES%\TeraCopy\Images\TC.png
- %PROGRAM_FILES%\TeraCopy\locale\el_GR\LC_MESSAGES\is-KEQBV.tmp в %PROGRAM_FILES%\TeraCopy\locale\el_GR\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\en\LC_MESSAGES\is-HTBT9.tmp в %PROGRAM_FILES%\TeraCopy\locale\en\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\da\LC_MESSAGES\is-JNV7R.tmp в %PROGRAM_FILES%\TeraCopy\locale\da\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\de\LC_MESSAGES\is-726N5.tmp в %PROGRAM_FILES%\TeraCopy\locale\de\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\ja\LC_MESSAGES\is-UC93O.tmp в %PROGRAM_FILES%\TeraCopy\locale\ja\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\sv_SE\LC_MESSAGES\is-324ES.tmp в %PROGRAM_FILES%\TeraCopy\locale\sv_SE\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\th_TH\LC_MESSAGES\is-BCCH2.tmp в %PROGRAM_FILES%\TeraCopy\locale\th_TH\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\ru\LC_MESSAGES\is-K89J4.tmp в %PROGRAM_FILES%\TeraCopy\locale\ru\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\sl_SI\LC_MESSAGES\is-H076S.tmp в %PROGRAM_FILES%\TeraCopy\locale\sl_SI\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\zh_Hans\LC_MESSAGES\is-DS5QT.tmp в %PROGRAM_FILES%\TeraCopy\locale\zh_Hans\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\zh_Hant\LC_MESSAGES\is-R8V86.tmp в %PROGRAM_FILES%\TeraCopy\locale\zh_Hant\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\tr_TR\LC_MESSAGES\is-F59V7.tmp в %PROGRAM_FILES%\TeraCopy\locale\tr_TR\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\vi_VN\LC_MESSAGES\is-H9EM9.tmp в %PROGRAM_FILES%\TeraCopy\locale\vi_VN\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\nb\LC_MESSAGES\is-HMFL6.tmp в %PROGRAM_FILES%\TeraCopy\locale\nb\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\nl\LC_MESSAGES\is-IV8AJ.tmp в %PROGRAM_FILES%\TeraCopy\locale\nl\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\kbd\LC_MESSAGES\is-KJA7N.tmp в %PROGRAM_FILES%\TeraCopy\locale\kbd\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\ko\LC_MESSAGES\is-P36NO.tmp в %PROGRAM_FILES%\TeraCopy\locale\ko\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\pt_PT\LC_MESSAGES\is-66E8I.tmp в %PROGRAM_FILES%\TeraCopy\locale\pt_PT\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\ro_RO\LC_MESSAGES\is-DBO6E.tmp в %PROGRAM_FILES%\TeraCopy\locale\ro_RO\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\pl_PL\LC_MESSAGES\is-AV80S.tmp в %PROGRAM_FILES%\TeraCopy\locale\pl_PL\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\locale\pt_BR\LC_MESSAGES\is-UN48K.tmp в %PROGRAM_FILES%\TeraCopy\locale\pt_BR\LC_MESSAGES\default.mo
- %PROGRAM_FILES%\TeraCopy\is-AEK68.tmp в %PROGRAM_FILES%\TeraCopy\PowerOff.cmd
- %PROGRAM_FILES%\TeraCopy\is-VKS2G.tmp в %PROGRAM_FILES%\TeraCopy\Readme.txt
- %PROGRAM_FILES%\TeraCopy\is-89N4G.tmp в %PROGRAM_FILES%\TeraCopy\License.txt
- %PROGRAM_FILES%\TeraCopy\is-C4VE8.tmp в %PROGRAM_FILES%\TeraCopy\Portable.txt
- %PROGRAM_FILES%\TeraCopy\is-A4ATT.tmp в %PROGRAM_FILES%\TeraCopy\tcm.exe
- %PROGRAM_FILES%\TeraCopy\is-IN5BN.tmp в %PROGRAM_FILES%\TeraCopy\TeraCopy Help.chm
- %PROGRAM_FILES%\TeraCopy\is-6EC4T.tmp в %PROGRAM_FILES%\TeraCopy\sorttable.js
- %PROGRAM_FILES%\TeraCopy\is-AEFR6.tmp в %PROGRAM_FILES%\TeraCopy\tclinks.exe
- %PROGRAM_FILES%\TeraCopy\is-R0AGN.tmp в %PROGRAM_FILES%\TeraCopy\TeraCopyExt64.dll
- %PROGRAM_FILES%\TeraCopy\is-2B40N.tmp в %PROGRAM_FILES%\TeraCopy\Complete.wav
- %PROGRAM_FILES%\TeraCopy\is-NDAIR.tmp в %PROGRAM_FILES%\TeraCopy\unins000.exe
- %PROGRAM_FILES%\TeraCopy\is-6T5FV.tmp в %PROGRAM_FILES%\TeraCopy\TeraCopyExt.dll
- %PROGRAM_FILES%\TeraCopy\is-BL97E.tmp в %PROGRAM_FILES%\TeraCopy\Directory Opus.txt
- %PROGRAM_FILES%\TeraCopy\is-2RO5D.tmp в %PROGRAM_FILES%\TeraCopy\Error.wav
- %PROGRAM_FILES%\TeraCopy\is-5SDE3.tmp в %PROGRAM_FILES%\TeraCopy\DefaultHandler.reg
- %PROGRAM_FILES%\TeraCopy\is-D0M33.tmp в %PROGRAM_FILES%\TeraCopy\DefaultHandlerOff.reg
- %PROGRAM_FILES%\TeraCopy\is-7PGI0.tmp в %PROGRAM_FILES%\TeraCopy\TeraCopy.dll
- %PROGRAM_FILES%\TeraCopy\Images\is-EOEHN.tmp в %PROGRAM_FILES%\TeraCopy\Images\Explorer.png
- %PROGRAM_FILES%\TeraCopy\Images\is-N4BCV.tmp в %PROGRAM_FILES%\TeraCopy\Images\Favorite.png
- %PROGRAM_FILES%\TeraCopy\Images\is-DPIA2.tmp в %PROGRAM_FILES%\TeraCopy\Images\Copy.png
- %PROGRAM_FILES%\TeraCopy\Images\is-E98DA.tmp в %PROGRAM_FILES%\TeraCopy\Images\DOpus.png
- %PROGRAM_FILES%\TeraCopy\Images\is-INU10.tmp в %PROGRAM_FILES%\TeraCopy\Images\Move.png
- %PROGRAM_FILES%\TeraCopy\Images\is-Q9GOC.tmp в %PROGRAM_FILES%\TeraCopy\Images\Remove.png
- %PROGRAM_FILES%\TeraCopy\Images\is-MCQFI.tmp в %PROGRAM_FILES%\TeraCopy\Images\Last.png
- %PROGRAM_FILES%\TeraCopy\Images\is-QQ7VO.tmp в %PROGRAM_FILES%\TeraCopy\Images\MarkFavorite.png
- %PROGRAM_FILES%\TeraCopy\is-ERQOQ.tmp в %PROGRAM_FILES%\TeraCopy\TeraCopyExt.dll
- %PROGRAM_FILES%\TeraCopy\is-4OU2H.tmp в %PROGRAM_FILES%\TeraCopy\TeraCopyExt64.dll
- %PROGRAM_FILES%\TeraCopy\is-03JNK.tmp в %PROGRAM_FILES%\TeraCopy\TeraCopy.exe
- %PROGRAM_FILES%\TeraCopy\is-PS3J4.tmp в %PROGRAM_FILES%\TeraCopy\TeraCopy64.dll
- %PROGRAM_FILES%\TeraCopy\Images\is-0II5I.tmp в %PROGRAM_FILES%\TeraCopy\Images\Browse.png
- %PROGRAM_FILES%\TeraCopy\Images\is-9EQ19.tmp в %PROGRAM_FILES%\TeraCopy\Images\Center.png
- %PROGRAM_FILES%\TeraCopy\is-3O3LB.tmp в %PROGRAM_FILES%\TeraCopy\Total Commander.txt
- %PROGRAM_FILES%\TeraCopy\is-H2GUM.tmp в %PROGRAM_FILES%\TeraCopy\Whatsnew.txt
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
