Trojan.Encoder.24450

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\#How_Decrypt_Files.txt

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

удаляет теневые копии разделов.

Изменения в файловой системе:

Создает следующие файлы:

<STUBS_DIR>\so3d\#How_Decrypt_Files.txt
<STUBS_DIR>\spidernt\#How_Decrypt_Files.txt
<STUBS_DIR>\sro_client\#How_Decrypt_Files.txt
<STUBS_DIR>\sgbclient\#How_Decrypt_Files.txt
<STUBS_DIR>\skype\#How_Decrypt_Files.txt
<STUBS_DIR>\smc\#How_Decrypt_Files.txt
<STUBS_DIR>\trillian\#How_Decrypt_Files.txt
<STUBS_DIR>\TwelveSky2\#How_Decrypt_Files.txt
<STUBS_DIR>\UniStream\#How_Decrypt_Files.txt
<STUBS_DIR>\startclient7\#How_Decrypt_Files.txt
<STUBS_DIR>\tiny\#How_Decrypt_Files.txt
<STUBS_DIR>\translink\#How_Decrypt_Files.txt
<STUBS_DIR>\opera\#How_Decrypt_Files.txt
<STUBS_DIR>\outpost\#How_Decrypt_Files.txt
<STUBS_DIR>\pidgin\#How_Decrypt_Files.txt
<STUBS_DIR>\nod32\#How_Decrypt_Files.txt
<STUBS_DIR>\ntvdm\#How_Decrypt_Files.txt
<STUBS_DIR>\oncbcli\#How_Decrypt_Files.txt
<STUBS_DIR>\RagFree\#How_Decrypt_Files.txt
<STUBS_DIR>\rclient\#How_Decrypt_Files.txt
<STUBS_DIR>\safari\#How_Decrypt_Files.txt
<STUBS_DIR>\putty\#How_Decrypt_Files.txt
<STUBS_DIR>\qip\#How_Decrypt_Files.txt
<STUBS_DIR>\Ragexe\#How_Decrypt_Files.txt
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\#How_Decrypt_Files.txt
%WINDIR%\$NtUninstallWIC$\spuninst\#How_Decrypt_Files.txt
%WINDIR%\AppPatch\#How_Decrypt_Files.txt
<STUBS_DIR>\__cd75efb816b2cc__\#How_Decrypt_Files.txt
%WINDIR%\#How_Decrypt_Files.txt
%WINDIR%\$NtUninstallKB942288-v3$\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
<STUBS_DIR>\woool\#How_Decrypt_Files.txt
<STUBS_DIR>\wow\#How_Decrypt_Files.txt
<STUBS_DIR>\wsm\#How_Decrypt_Files.txt
<STUBS_DIR>\wclnt\#How_Decrypt_Files.txt
<STUBS_DIR>\webmoney\#How_Decrypt_Files.txt
<STUBS_DIR>\winbaram\#How_Decrypt_Files.txt
<STUBS_DIR>\zlclient\#How_Decrypt_Files.txt
<STUBS_DIR>\ZONEALARM\#How_Decrypt_Files.txt
<STUBS_DIR>\ZZ__cd75efb816b2cc__\#How_Decrypt_Files.txt
<STUBS_DIR>\YahooMessenger\#How_Decrypt_Files.txt
<STUBS_DIR>\ybclient\#How_Decrypt_Files.txt
<STUBS_DIR>\zapro\#How_Decrypt_Files.txt
<STUBS_DIR>\fsavgui\#How_Decrypt_Files.txt
<STUBS_DIR>\gc\#How_Decrypt_Files.txt
<STUBS_DIR>\ge\#How_Decrypt_Files.txt
<STUBS_DIR>\fsav\#How_Decrypt_Files.txt
<STUBS_DIR>\fsav32\#How_Decrypt_Files.txt
<STUBS_DIR>\fsavaui\#How_Decrypt_Files.txt
<STUBS_DIR>\gw\#How_Decrypt_Files.txt
<STUBS_DIR>\httplook\#How_Decrypt_Files.txt
<STUBS_DIR>\ICQ\#How_Decrypt_Files.txt
<STUBS_DIR>\googletalk\#How_Decrypt_Files.txt
<STUBS_DIR>\GUARD\#How_Decrypt_Files.txt
<STUBS_DIR>\GVOnline\#How_Decrypt_Files.txt
<STUBS_DIR>\Drwebupw\#How_Decrypt_Files.txt
<STUBS_DIR>\Drwebwcl\#How_Decrypt_Files.txt
<STUBS_DIR>\ecmd\#How_Decrypt_Files.txt
<STUBS_DIR>\drweb\#How_Decrypt_Files.txt
<STUBS_DIR>\Drweb32w\#How_Decrypt_Files.txt
<STUBS_DIR>\drweb386\#How_Decrypt_Files.txt
<STUBS_DIR>\elementclient\#How_Decrypt_Files.txt
<STUBS_DIR>\el_cli\#How_Decrypt_Files.txt
<STUBS_DIR>\firefox\#How_Decrypt_Files.txt
<STUBS_DIR>\egni\#How_Decrypt_Files.txt
<STUBS_DIR>\ekrn\#How_Decrypt_Files.txt
<STUBS_DIR>\elbank\#How_Decrypt_Files.txt
<STUBS_DIR>\MCAGENT\#How_Decrypt_Files.txt
<STUBS_DIR>\Mir3Game\#How_Decrypt_Files.txt
<STUBS_DIR>\miranda32\#How_Decrypt_Files.txt
<STUBS_DIR>\lotroclient\#How_Decrypt_Files.txt
<STUBS_DIR>\magent\#How_Decrypt_Files.txt
<STUBS_DIR>\maplestory\#How_Decrypt_Files.txt
<STUBS_DIR>\NAVAPW32\#How_Decrypt_Files.txt
<STUBS_DIR>\netxray\#How_Decrypt_Files.txt
<STUBS_DIR>\nod\#How_Decrypt_Files.txt
<STUBS_DIR>\mpftray\#How_Decrypt_Files.txt
<STUBS_DIR>\msn6\#How_Decrypt_Files.txt
<STUBS_DIR>\msnmsgr\#How_Decrypt_Files.txt
<STUBS_DIR>\intpro\#How_Decrypt_Files.txt
<STUBS_DIR>\iscc\#How_Decrypt_Files.txt
<STUBS_DIR>\ISClient\#How_Decrypt_Files.txt
<STUBS_DIR>\iexplore\#How_Decrypt_Files.txt
<STUBS_DIR>\inbank-start-ff\#How_Decrypt_Files.txt
<STUBS_DIR>\InphaseNXD\#How_Decrypt_Files.txt
<STUBS_DIR>\l2\#How_Decrypt_Files.txt
<STUBS_DIR>\lin\#How_Decrypt_Files.txt
<STUBS_DIR>\loadmain\#How_Decrypt_Files.txt
<STUBS_DIR>\java\#How_Decrypt_Files.txt
<STUBS_DIR>\javaw\#How_Decrypt_Files.txt
<STUBS_DIR>\kb_cli\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.Data.Services\3.5.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Client\3.5.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Design\3.5.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity\3.5.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity.Design\3.5.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\#How_Decrypt_Files.txt
%WINDIR%\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\#How_Decrypt_Files.txt
<STUBS_DIR>\dnf\#How_Decrypt_Files.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\#How_Decrypt_Files.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\#How_Decrypt_Files.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\#How_Decrypt_Files.txt
C:\Documents and Settings\NetworkService\Local Settings\History\#How_Decrypt_Files.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\#How_Decrypt_Files.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\#How_Decrypt_Files.txt
%APPDATA%\#How_Decrypt_Files.txt
%APPDATA%\Mozilla\Firefox\#How_Decrypt_Files.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\#How_Decrypt_Files.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\#How_Decrypt_Files.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\#How_Decrypt_Files.txt
%HOMEPATH%\#How_Decrypt_Files.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\#How_Decrypt_Files.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\#How_Decrypt_Files.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\#How_Decrypt_Files.txt
C:\Documents and Settings\LocalService\Local Settings\#How_Decrypt_Files.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\#How_Decrypt_Files.txt
C:\Documents and Settings\LocalService\Local Settings\History\#How_Decrypt_Files.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\#How_Decrypt_Files.txt
C:\Documents and Settings\NetworkService\#How_Decrypt_Files.txt
C:\Documents and Settings\NetworkService\Local Settings\#How_Decrypt_Files.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\#How_Decrypt_Files.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\#How_Decrypt_Files.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\#How_Decrypt_Files.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\#How_Decrypt_Files.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\#How_Decrypt_Files.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\#How_Decrypt_Files.txt
%HOMEPATH%\Local Settings\History\History.IE5\#How_Decrypt_Files.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\#How_Decrypt_Files.txt
%HOMEPATH%\Local Settings\<INETFILES>\#How_Decrypt_Files.txt
%HOMEPATH%\My Documents\My Music\#How_Decrypt_Files.txt
%HOMEPATH%\My Documents\My Pictures\#How_Decrypt_Files.txt
%HOMEPATH%\Recent\#How_Decrypt_Files.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\#How_Decrypt_Files.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\#How_Decrypt_Files.txt
%HOMEPATH%\My Documents\#How_Decrypt_Files.txt
%HOMEPATH%\Favorites\#How_Decrypt_Files.txt
%HOMEPATH%\Favorites\Links\#How_Decrypt_Files.txt
%HOMEPATH%\Local Settings\#How_Decrypt_Files.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\#How_Decrypt_Files.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\#How_Decrypt_Files.txt
%HOMEPATH%\Cookies\#How_Decrypt_Files.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\#How_Decrypt_Files.txt
<LS_APPDATA>\VMware\#How_Decrypt_Files.txt
%HOMEPATH%\Local Settings\History\#How_Decrypt_Files.txt
<LS_APPDATA>\#How_Decrypt_Files.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\#How_Decrypt_Files.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Documents\My Videos\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\DRM\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Start Menu\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Documents\My Pictures\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Start Menu\Programs\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\#How_Decrypt_Files.txt
%APPDATA%\Microsoft\Microsoft_Sam_Hash.ini
%TEMP%\tmp1.tmp
%TEMP%\tmp2.tmp
<Текущая директория>\Host64.exe
%APPDATA%\Microsoft\Protect\CREDHIST
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8a368098e2e7faab0b7a22f64ca0856c_23ef5514-3059-436f-a4a7-4cefaab20eb1
%ALLUSERSPROFILE%\Documents\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Documents\My Music\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\#How_Decrypt_Files.txt
C:\#How_Decrypt_Files.txt
<Текущая директория>\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Application Data\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Start Menu\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Start Menu\Programs\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\SendTo\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Templates\#How_Decrypt_Files.txt
C:\Documents and Settings\LocalService\#How_Decrypt_Files.txt
C:\Documents and Settings\LocalService\Cookies\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Application Data\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Cookies\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Local Settings\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\#How_Decrypt_Files.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Local Settings\History\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\#How_Decrypt_Files.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\#How_Decrypt_Files.txt
<STUBS_DIR>\aion\#How_Decrypt_Files.txt
<STUBS_DIR>\ash\#How_Decrypt_Files.txt
<STUBS_DIR>\ashAvast\#How_Decrypt_Files.txt
<STUBS_DIR>\360tray\#How_Decrypt_Files.txt
<STUBS_DIR>\ageofconan\#How_Decrypt_Files.txt
<SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
<STUBS_DIR>\AVGCTRL\#How_Decrypt_Files.txt
<STUBS_DIR>\AVP\#How_Decrypt_Files.txt
<STUBS_DIR>\AVP32\#How_Decrypt_Files.txt
<STUBS_DIR>\ashAvSrv\#How_Decrypt_Files.txt
<STUBS_DIR>\avgcc\#How_Decrypt_Files.txt
<STUBS_DIR>\AVGCC32\#How_Decrypt_Files.txt
C:\Far2\Plugins\TmpPanel\#How_Decrypt_Files.txt
C:\Far2\Plugins\WinSCP\#How_Decrypt_Files.txt
C:\Far2\PluginSDK\Headers.c\#How_Decrypt_Files.txt
C:\Far2\Plugins\MacroView\#How_Decrypt_Files.txt
C:\Far2\Plugins\Network\#How_Decrypt_Files.txt
C:\Far2\Plugins\ProcList\#How_Decrypt_Files.txt
<SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
%TEMP%\tmp3.tmp
<STUBS_DIR>\#How_Decrypt_Files.txt
C:\Far2\PluginSDK\Headers.pas\#How_Decrypt_Files.txt
C:\Muldrop\#How_Decrypt_Files.txt
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\#How_Decrypt_Files.txt
<STUBS_DIR>\ccapp\#How_Decrypt_Files.txt
<STUBS_DIR>\chrome\#How_Decrypt_Files.txt
<STUBS_DIR>\ClamWin\#How_Decrypt_Files.txt
<STUBS_DIR>\cbank\#How_Decrypt_Files.txt
<STUBS_DIR>\cbmain\#How_Decrypt_Files.txt
<STUBS_DIR>\cbsmain\#How_Decrypt_Files.txt
<STUBS_DIR>\clntw32\#How_Decrypt_Files.txt
<STUBS_DIR>\contactNG\#How_Decrypt_Files.txt
<STUBS_DIR>\dekaron\#How_Decrypt_Files.txt
<STUBS_DIR>\clbank\#How_Decrypt_Files.txt
<STUBS_DIR>\client7\#How_Decrypt_Files.txt
<STUBS_DIR>\clmain\#How_Decrypt_Files.txt
<STUBS_DIR>\bankcl\#How_Decrypt_Files.txt
<STUBS_DIR>\BBClient\#How_Decrypt_Files.txt
<STUBS_DIR>\bclient\#How_Decrypt_Files.txt
<STUBS_DIR>\AVPCC\#How_Decrypt_Files.txt
<STUBS_DIR>\AVPM\#How_Decrypt_Files.txt
<STUBS_DIR>\AVSYNMGR\#How_Decrypt_Files.txt
<STUBS_DIR>\bdsubmit\#How_Decrypt_Files.txt
<STUBS_DIR>\bk\#How_Decrypt_Files.txt
<STUBS_DIR>\cabalmain\#How_Decrypt_Files.txt
<STUBS_DIR>\bc_loader\#How_Decrypt_Files.txt
<STUBS_DIR>\bdagent\#How_Decrypt_Files.txt
<STUBS_DIR>\bdss\#How_Decrypt_Files.txt
C:\Far2\Addons\XLat\#How_Decrypt_Files.txt
C:\Far2\Addons\XLat\Russian\#How_Decrypt_Files.txt
C:\Far2\Documentation\eng\#How_Decrypt_Files.txt
C:\Far2\Addons\Macros\#How_Decrypt_Files.txt
C:\Far2\Addons\SetUp\#How_Decrypt_Files.txt
C:\Far2\Addons\Shell\#How_Decrypt_Files.txt
C:\Far2\Plugins\7-Zip\#How_Decrypt_Files.txt
C:\Far2\Plugins\Align\#How_Decrypt_Files.txt
C:\Far2\Plugins\arclite\#How_Decrypt_Files.txt
C:\Far2\Documentation\rus\#How_Decrypt_Files.txt
C:\Far2\Encyclopedia\#How_Decrypt_Files.txt
C:\Far2\FExcept\#How_Decrypt_Files.txt
%HOMEPATH%\Start Menu\Programs\Accessories\#How_Decrypt_Files.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\#How_Decrypt_Files.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\#How_Decrypt_Files.txt
%HOMEPATH%\SendTo\#How_Decrypt_Files.txt
%HOMEPATH%\Start Menu\#How_Decrypt_Files.txt
%HOMEPATH%\Start Menu\Programs\#How_Decrypt_Files.txt
C:\Far2\Addons\Colors\#How_Decrypt_Files.txt
C:\Far2\Addons\Colors\Custom Highlighting\#How_Decrypt_Files.txt
C:\Far2\Addons\Colors\Default Highlighting\#How_Decrypt_Files.txt
%HOMEPATH%\Templates\#How_Decrypt_Files.txt
C:\Far2\#How_Decrypt_Files.txt
C:\Far2\Addons\#How_Decrypt_Files.txt
C:\Far2\Plugins\ExtSearch\doc\#How_Decrypt_Files.txt
C:\Far2\Plugins\ExtSearch\keys\#How_Decrypt_Files.txt
C:\Far2\Plugins\ExtSearch\sources\#How_Decrypt_Files.txt
C:\Far2\Plugins\EditCase\#How_Decrypt_Files.txt
C:\Far2\Plugins\EMenu\#How_Decrypt_Files.txt
C:\Far2\Plugins\ExtSearch\#How_Decrypt_Files.txt
C:\Far2\Plugins\FTP\#How_Decrypt_Files.txt
C:\Far2\Plugins\FTP\lib\#How_Decrypt_Files.txt
C:\Far2\Plugins\HlfViewer\#How_Decrypt_Files.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\#How_Decrypt_Files.txt
C:\Far2\Plugins\FarCmds\#How_Decrypt_Files.txt
C:\Far2\Plugins\FileCase\#How_Decrypt_Files.txt
C:\Far2\Plugins\Colorer\bin\#How_Decrypt_Files.txt
C:\Far2\Plugins\Colorer\hrc\#How_Decrypt_Files.txt
C:\Far2\Plugins\Colorer\hrc\auto\#How_Decrypt_Files.txt
C:\Far2\Plugins\AutoWrap\#How_Decrypt_Files.txt
C:\Far2\Plugins\Brackets\#How_Decrypt_Files.txt
C:\Far2\Plugins\Colorer\#How_Decrypt_Files.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\#How_Decrypt_Files.txt
C:\Far2\Plugins\Compare\#How_Decrypt_Files.txt
C:\Far2\Plugins\DrawLine\#How_Decrypt_Files.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\#How_Decrypt_Files.txt
C:\Far2\Plugins\Colorer\hrd\#How_Decrypt_Files.txt
C:\Far2\Plugins\Colorer\hrd\console\#How_Decrypt_Files.txt

Удаляет следующие файлы:

%TEMP%\tmp2.tmp
%TEMP%\tmp3.tmp
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\8a368098e2e7faab0b7a22f64ca0856c_23ef5514-3059-436f-a4a7-4cefaab20eb1
%TEMP%\tmp1.tmp

Перемещает следующие системные файлы:

%WINDIR%\setupapi.log в %WINDIR%\C1-g24nU5KcQsVrE3D.Infinite
%WINDIR%\setupact.log в %WINDIR%\C7-UgpoJIDwZC7FyeUisZ.Infinite
%WINDIR%\setuplog.txt в %WINDIR%\C8-ZXi2e2SGCLPUodvZgMF.Infinite
%WINDIR%\spupdsvc.log в %WINDIR%\C7-3lQfx6kXc4gjI3LsJ2.Infinite
%WINDIR%\Soap Bubbles.bmp в %WINDIR%\C3-qQBgmIdslNH73dco.Infinite
%WINDIR%\sessmgr.setup.log в %WINDIR%\C8-1eNMF4c0LmvvCX0Epre.Infinite
%WINDIR%\regopt.log в %WINDIR%\C2-eu2Um4BD0bk59Y2.Infinite
%WINDIR%\Prairie Wind.bmp в %WINDIR%\C8-SZmVbG6YIvLRs0I6NQq.Infinite
%WINDIR%\Rhododendron.bmp в %WINDIR%\C1-9wTwpHn2N2vNueM.Infinite
%WINDIR%\Santa Fe Stucco.bmp в %WINDIR%\C4-oJ0N5HVTT7WJw0QAN.Infinite
%WINDIR%\River Sumida.bmp в %WINDIR%\C6-vnV0uKNpiecgMYiO25.Infinite
%WINDIR%\Zapotec.bmp в %WINDIR%\C8-EIaryLCCEqElC8xXNGq.Infinite
%WINDIR%\wmsetup.log в %WINDIR%\C0-kG0Pu8aPzQ4SQ2.Infinite
%WINDIR%\_default.pif в %WINDIR%\C4-20c53Ol1YSv5e2II.Infinite
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt в %WINDIR%\$NtUninstallWIC$\spuninst\C0-XogY3L1Zk3qp3g.Infinite
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt в %WINDIR%\$NtUninstallKB942288-v3$\spuninst\C8-ODITUG1oDEyfWnhpbOG.Infinite
%WINDIR%\WindowsUpdate.log в %WINDIR%\C4-yDqzaDK7TUGDGpBTb.Infinite
%WINDIR%\tsoc.log в %WINDIR%\C2-JeuK6Nv0B7ZLW33.Infinite
%WINDIR%\tabletoc.log в %WINDIR%\C3-pcSt39KMxgN3kwhd.Infinite
%WINDIR%\updspapi.log в %WINDIR%\C5-Vz9KH03p3myymQlAx.Infinite
%WINDIR%\wiaservc.log в %WINDIR%\C8-BMolV0kI9rZtovpiS4r.Infinite
%WINDIR%\wiadebug.log в %WINDIR%\C5-z3alKNdcHB0HYW7e2.Infinite
%WINDIR%\OEWABLog.txt в %WINDIR%\C8-yWL4X3Tl4V0974xbKiS.Infinite
%WINDIR%\FaxSetup.log в %WINDIR%\C3-SsHZY6FCswENiO5D.Infinite
%WINDIR%\DtcInstall.log в %WINDIR%\C7-f2FMT3fOXJX5GUiSxX.Infinite
%WINDIR%\FeatherTexture.bmp в %WINDIR%\C1-LOvni3NrdP91Iz.Infinite
%WINDIR%\Greenstone.bmp в %WINDIR%\C7-ix2SwD8IdHDvegqGsj.Infinite
%WINDIR%\Gone Fishing.bmp в %WINDIR%\C6-9Fx1n7xfy3pJks9lbB.Infinite
%WINDIR%\comsetup.log в %WINDIR%\C0-mVb9J6XkmqeRgt.Infinite
%WINDIR%\clock.avi в %WINDIR%\C7-8weUpF9nUSxaw7sIW6.Infinite
%WINDIR%\Blue Lace 16.bmp в %WINDIR%\C3-q3BphxxBvP6xi7A5.Infinite
%WINDIR%\cmsetacl.log в %WINDIR%\C1-JGtU12FSM9MCCUa.Infinite
%WINDIR%\COM+.log в %WINDIR%\C1-IS0hGrvwYRS9un.Infinite
%WINDIR%\Coffee Bean.bmp в %WINDIR%\C1-nJKv4FqFaYYVya.Infinite
%WINDIR%\netfxocm.log в %WINDIR%\C3-cmyB524psKyH35pV.Infinite
%WINDIR%\msmqinst.log в %WINDIR%\C5-jGKyu5vB7r6eSS8jx.Infinite
%WINDIR%\ntdtcsetup.log в %WINDIR%\C1-VIdPEyBTdnstcf.Infinite
%WINDIR%\ocmsn.log в %WINDIR%\C5-mB75MGN6CpkWqeEXs.Infinite
%WINDIR%\ocgen.log в %WINDIR%\C6-I0fcI3lIxQZC5Yt4pK.Infinite
%WINDIR%\msgsocm.log в %WINDIR%\C2-Xv7yiIpVFBg3C5O.Infinite
%WINDIR%\imsins.BAK в %WINDIR%\C8-noueHwLcGQWAUfH8gWF.Infinite
%WINDIR%\iis6.log в %WINDIR%\C1-uHGR81DyUxcYu5Z.Infinite
%WINDIR%\imsins.log в %WINDIR%\C7-HqM7LAxPUqhTGmcbkE.Infinite
%WINDIR%\MedCtrOC.log в %WINDIR%\C1-xD3XZBfsawIPIG.Infinite
%WINDIR%\KB942288-v3.log в %WINDIR%\C1-TBa6Wx46LW77WAL.Infinite

Перемещает следующие файлы:

%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C6-qiR1KudDOMikblVy5f.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C0-3vIfNIGzWYO4h4.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C1-Zha15Eyi7q8oDf.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C7-ivmhXzwzgFkeNZxIM.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C0-y1WZv8o6RajCJr.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\C7-aKC4zxbT4zqGpEymZMC.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\C2-rDgi8Fm5c3jt4Ef.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C1-fgVW8zLQ1GBr004.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C8-18Zsd9wTirUzPLvzdlB.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C3-CSnsov49aXucfkd4.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C6-A0sSpzvoKq7IwqOxHu.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C7-WCiPFpUO73B6q5IA14.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C6-VOzcVfBsILH1YNMza1.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C7-X1SC1zouuj609mDLQ7l.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C8-5mkXgvWdU2nueNn4mRA.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C0-eUozp3gG0HBWYB.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C2-u58aRr4iZV8j1Yc.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C2-tFOnhhjClnDfirg.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C3-vsrNB2MENC2oIGX5.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C5-ychHojTAj5YF3lmID.Infinite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\C6-YJlixrdnOJwswZUnVC.Infinite

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Сетевая активность:

Подключается к:

'ap#.##legram.org':443
'ic###azip.com':80
'wp#d':80

TCP:

Запросы HTTP GET:

http://ic###azip.com/
http://11#.#11.111.1/wpad.dat via wp#d

UDP:

DNS ASK ap#.##legram.org
DNS ASK ic###azip.com
DNS ASK wp#d

Другое:

Создает и запускает на исполнение:

'<Текущая директория>\Host64.exe'

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /C wevtutil.exe cl Application
'<SYSTEM32>\cmd.exe' /C wevtutil.exe cl Security
'<SYSTEM32>\cmd.exe' /C wevtutil.exe cl System
'<SYSTEM32>\cmd.exe' /C Bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /C vssadmin.exe delete shadows /all /Quiet
'<SYSTEM32>\cmd.exe' /C WMIC.exe shadowcopy delete
'<SYSTEM32>\cmd.exe' /C Bcdedit.exe /set {default} recoveryenabled no

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней