Техническая информация
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ituneshelpunavailable.htm
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\howto-index.html
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\trivial-merge.html
Изменения в файловой системе
Создает следующие файлы
- D:\!!faq for decryption!!.txt
- C:\far2\plugins\hlfviewer\!!faq for decryption!!.txt
- C:\far2\plugins\macroview\!!faq for decryption!!.txt
- C:\far2\plugins\network\!!faq for decryption!!.txt
- C:\far2\plugins\proclist\!!faq for decryption!!.txt
- C:\far2\plugins\tmppanel\!!faq for decryption!!.txt
- C:\far2\pluginsdk\headers.c\!!faq for decryption!!.txt
- C:\far2\pluginsdk\headers.pas\!!faq for decryption!!.txt
- C:\far2\!!faq for decryption!!.txt
- <Текущая директория>\!!faq for decryption!!.txt
- C:\totalcmd\language\!!faq for decryption!!.txt
- C:\users\public\music\sample music\!!faq for decryption!!.txt
- %HOMEPATH%\favorites\windows live\!!faq for decryption!!.txt
- C:\users\public\pictures\sample pictures\!!faq for decryption!!.txt
- C:\users\public\recorded tv\sample media\!!faq for decryption!!.txt
- C:\users\public\videos\sample videos\!!faq for decryption!!.txt
- %HOMEPATH%\contacts\!!faq for decryption!!.txt
- %HOMEPATH%\desktop\!!faq for decryption!!.txt
- %HOMEPATH%\downloads\!!faq for decryption!!.txt
- %HOMEPATH%\favorites\links\!!faq for decryption!!.txt
- %HOMEPATH%\favorites\links for united states\!!faq for decryption!!.txt
- %HOMEPATH%\favorites\microsoft websites\!!faq for decryption!!.txt
- %HOMEPATH%\favorites\msn websites\!!faq for decryption!!.txt
- C:\far2\plugins\ftp\!!faq for decryption!!.txt
- C:\totalcmd\!!faq for decryption!!.txt
- C:\far2\plugins\ftp\lib\!!faq for decryption!!.txt
- C:\far2\documentation\rus\!!faq for decryption!!.txt
- C:\far2\addons\colors\custom_highlighting\!!faq for decryption!!.txt
- C:\far2\addons\colors\default_highlighting\!!faq for decryption!!.txt
- C:\far2\addons\colors\!!faq for decryption!!.txt
- C:\far2\addons\macros\!!faq for decryption!!.txt
- C:\far2\addons\setup\!!faq for decryption!!.txt
- C:\far2\addons\shell\!!faq for decryption!!.txt
- C:\far2\addons\xlat\russian\!!faq for decryption!!.txt
- C:\far2\addons\xlat\!!faq for decryption!!.txt
- C:\far2\addons\!!faq for decryption!!.txt
- C:\far2\documentation\eng\!!faq for decryption!!.txt
- C:\far2\encyclopedia\tap\!!faq for decryption!!.txt
- C:\far2\plugins\farcmds\!!faq for decryption!!.txt
- C:\far2\encyclopedia\!!faq for decryption!!.txt
- C:\far2\fexcept\!!faq for decryption!!.txt
- C:\far2\plugins\align\!!faq for decryption!!.txt
- C:\far2\plugins\arclite\!!faq for decryption!!.txt
- C:\far2\plugins\autowrap\!!faq for decryption!!.txt
- C:\far2\plugins\brackets\!!faq for decryption!!.txt
- C:\far2\plugins\compare\!!faq for decryption!!.txt
- C:\far2\plugins\drawline\!!faq for decryption!!.txt
- C:\far2\plugins\editcase\!!faq for decryption!!.txt
- C:\far2\plugins\emenu\!!faq for decryption!!.txt
- C:\far2\plugins\filecase\!!faq for decryption!!.txt
- %HOMEPATH%\links\!!faq for decryption!!.txt
Самоудаляется.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' del <Полный путь к файлу> >> NUL
