Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\desktop.ini
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\# # DECRYPT MY FILE # #.bmp
Создает следующие файлы на съемном носителе:
- <Имя диска съемного носителя>:\# # DECRYPT MY FILE # #.txt
- <Имя диска съемного носителя>:\# # DECRYPT MY FILE # #.vbs
- <Имя диска съемного носителя>:\# # DECRYPT MY FILE # #.bmp
- <Имя диска съемного носителя>:\KEY.KEY
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\KEY.KEY
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\Local Settings\History\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\NetworkService\Local Settings\History\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\NetworkService\Local Settings\History\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\NetworkService\Local Settings\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\NetworkService\Local Settings\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\NetworkService\Local Settings\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\NetworkService\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\NetworkService\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\LocalService\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Templates\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Templates\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Templates\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\Local Settings\History\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\Local Settings\History\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\LocalService\Local Settings\History\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\LocalService\Local Settings\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\Local Settings\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\LocalService\Local Settings\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\Cookies\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\LocalService\Cookies\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\LocalService\Cookies\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\LocalService\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Mozilla\Firefox\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Mozilla\Firefox\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Microsoft\Windows\Themes\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Microsoft\Windows\Themes\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Microsoft\Windows\Themes\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Microsoft\Speech\Files\UserLexicons\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Microsoft\Protect\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Microsoft\Speech\Files\UserLexicons\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\b4949e42-3d4b-4bbf-9b57-cfaa9735e8cc
- %APPDATA%\Microsoft\Protect\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Microsoft\Speech\Files\UserLexicons\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Microsoft\Protect\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Mozilla\Firefox\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\# # DECRYPT MY FILE # #.bmp
- %HOMEPATH%\Favorites\# # DECRYPT MY FILE # #.txt
- %HOMEPATH%\Cookies\# # DECRYPT MY FILE # #.bmp
- %HOMEPATH%\Cookies\# # DECRYPT MY FILE # #.vbs
- %HOMEPATH%\Cookies\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\# # DECRYPT MY FILE # #.txt
- <SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
- %TEMP%\tmp3.tmp
- <SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Microsoft\Media Player\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Microsoft\Media Player\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Microsoft\Media Player\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\# # DECRYPT MY FILE # #.txt
- %HOMEPATH%\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\# # DECRYPT MY FILE # #.vbs
- %HOMEPATH%\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Microsoft\Internet Explorer\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Microsoft\Internet Explorer\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Microsoft\Internet Explorer\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\# # DECRYPT MY FILE # #.txt
- %HOMEPATH%\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Microsoft\Address Book\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\Microsoft\Address Book\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\Microsoft\Address Book\# # DECRYPT MY FILE # #.txt
- %APPDATA%\# # DECRYPT MY FILE # #.bmp
- %APPDATA%\# # DECRYPT MY FILE # #.vbs
- %APPDATA%\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\# # DECRYPT MY FILE # #.bmp
- %HOMEPATH%\Favorites\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Start Menu\Programs\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Start Menu\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Documents\My Pictures\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Documents\My Pictures\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Documents\My Music\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Documents\My Music\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Documents\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Documents\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Documents\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Documents\My Music\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\DRM\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Start Menu\Programs\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Start Menu\Programs\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Start Menu\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Start Menu\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Start Menu\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\DRM\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\DRM\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Documents\My Videos\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Documents\My Videos\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Documents\My Videos\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Documents\My Pictures\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Application Data\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Application Data\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Application Data\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\# # DECRYPT MY FILE # #.txt
- <Текущая директория>\# # DECRYPT MY FILE # #.bmp
- <Текущая директория>\# # DECRYPT MY FILE # #.vbs
- <Текущая директория>\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Microsoft\Protect\CREDHIST
- C:\# # DECRYPT MY FILE # #.bmp
- C:\# # DECRYPT MY FILE # #.vbs
- C:\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %HOMEPATH%\Desktop\KEY.KEY
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\# # DECRYPT MY FILE # #.txt
- %TEMP%\# # DECRYPT MY FILE # #.bmp
- %TEMP%\# # DECRYPT MY FILE # #.vbs
- %TEMP%\# # DECRYPT MY FILE # #.txt
- %HOMEPATH%\Desktop\# # DECRYPT MY FILE # #.bmp
- %HOMEPATH%\Desktop\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\# # DECRYPT MY FILE # #.bmp
- %HOMEPATH%\Desktop\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\# # DECRYPT MY FILE # #.txt
- C:\KEY.KEY
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Local Settings\History\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Local Settings\History\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Local Settings\History\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Start Menu\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Start Menu\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\SendTo\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\SendTo\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\SendTo\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Local Settings\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\# # DECRYPT MY FILE # #.txt
- %APPDATA%\Microsoft\Speech\Files\UserLexicons\SP_6C05D35E1F254CC8B08545970057A449.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\# # DECRYPT MY FILE # #.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\# # DECRYPT MY FILE # #.vbs
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\# # DECRYPT MY FILE # #.bmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Local Settings\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Local Settings\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Cookies\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Cookies\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Cookies\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\# # DECRYPT MY FILE # #.vbs
- %TEMP%\tmp2.tmp
- %TEMP%\tmp1.tmp
- C:\Documents and Settings\Default User\Application Data\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\Application Data\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\Application Data\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\# # DECRYPT MY FILE # #.bmp
- C:\Documents and Settings\Default User\# # DECRYPT MY FILE # #.vbs
- C:\Documents and Settings\Default User\# # DECRYPT MY FILE # #.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\# # DECRYPT MY FILE # #.txt
- %HOMEPATH%\Favorites\# # DECRYPT MY FILE # #.bmp
Удаляет следующие файлы:
- %TEMP%\tmp1.tmp
- %TEMP%\tmp2.tmp
- %TEMP%\tmp3.tmp
Перемещает следующие файлы:
- <Полный путь к файлу> в <Полный путь к файлу>.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite.XiaoBa
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.XiaoBa
- %APPDATA%\winscp.rnd в %APPDATA%\winscp.rnd.XiaoBa
- %APPDATA%\Microsoft\Address Book\%USERNAME%.wab в %APPDATA%\Microsoft\Address Book\%USERNAME%.wab.XiaoBa
- %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~ в %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~.XiaoBa
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1 в %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1.XiaoBa
- %APPDATA%\Microsoft\Internet Explorer\brndlog.txt в %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.XiaoBa
- %APPDATA%\Microsoft\Internet Explorer\Desktop.htt в %APPDATA%\Microsoft\Internet Explorer\Desktop.htt.XiaoBa
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.XiaoBa
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk.XiaoBa
- %APPDATA%\Microsoft\Media Player\0007F0B7.wpl в %APPDATA%\Microsoft\Media Player\0007F0B7.wpl.XiaoBa
- %APPDATA%\Microsoft\Protect\CREDHIST в %APPDATA%\Microsoft\Protect\CREDHIST.XiaoBa
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\b4949e42-3d4b-4bbf-9b57-cfaa9735e8cc в %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\b4949e42-3d4b-4bbf-9b57-cfaa9735e8cc.XiaoBa
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred в %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred.XiaoBa
- %APPDATA%\Microsoft\Speech\Files\UserLexicons\SP_6C05D35E1F254CC8B08545970057A449.dat в %APPDATA%\Microsoft\Speech\Files\UserLexicons\SP_6C05D35E1F254CC8B08545970057A449.dat.XiaoBa
- %APPDATA%\Microsoft\Windows\Themes\Custom.theme в %APPDATA%\Microsoft\Windows\Themes\Custom.theme.XiaoBa
- %APPDATA%\Mozilla\Firefox\profiles.ini в %APPDATA%\Mozilla\Firefox\profiles.ini.XiaoBa
- %APPDATA%\desktop.ini в %APPDATA%\desktop.ini.XiaoBa
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk.XiaoBa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css.XiaoBa
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое:
Ищет следующие окна:
- ClassName: 'CicLoaderWndClass' WindowName: ''
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe'
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadow /all /quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -q...
- '<SYSTEM32>\notepad.exe' %TEMP%\# # DECRYPT MY FILE # #.txt
- '<SYSTEM32>\wscript.exe' "%TEMP%\# # DECRYPT MY FILE # #.vbs"
