Техническая информация
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\fi51.doc
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei9162\cryptodome\cipher\_arc4.cp37-win_amd64.pyd
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\796x230brands2020[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\aa1uh08[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\aag9xjb[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\aagtlsq[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\aahc9vw[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbigttt[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbrgdep[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbufy9v[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbukakc[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbummg1[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuo1ii[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuo1vz[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuqv6j[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuqvk2[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbur0mo[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bburmkm[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuszol[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\2_1__583[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuz3fx[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuyylk[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuyfjs[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuycab[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuxpzb[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuxjre[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuxlsq[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuxevs[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuwszi[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuwknv[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuwfyv[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbuwe5h[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bbutdqa[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\aafegoy[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\y90[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuz6un[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuz3bh[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuycnv[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuyevi[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuyf9e[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuyjt3[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuykez[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuz46t[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\homepage-intro-bike[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\y300[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\aac0frj[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\aade8tz[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bb8jywb[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbn9kvz[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbubusw[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbugi8s[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuj4f2[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuq9ng[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuqvcd[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuytwm[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuypej[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuyeer[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuy1cg[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuxbtw[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbux9ih[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuwj2j[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbux3pl[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuwaqy[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuvwr8[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuuydc[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbutmft[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbusfcz[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bburxvs[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bbuz1ts[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\garden.jpg.enc
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.bak.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\aah7ldq[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\shadesofblue.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\small_news.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\softblue.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\stars.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\tanspecks.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\white_chocolate.jpg.enc
- %APPDATA%\icqm\icq\html\bg\error\exclamation.jpg.enc
- %APPDATA%\icqm\icq\html\cz\error\exclamation.jpg.enc
- %APPDATA%\icqm\icq\html\de\error\exclamation.jpg.enc
- %APPDATA%\icqm\icq\html\en\error\exclamation.jpg.enc
- %APPDATA%\icqm\icq\html\kz\error\exclamation.jpg.enc
- %APPDATA%\icqm\icq\html\pt\error\exclamation.jpg.enc
- %APPDATA%\icqm\icq\html\ru\error\exclamation.jpg.enc
- %APPDATA%\icqm\icq\html\tr\error\exclamation.jpg.enc
- %APPDATA%\icqm\icq\html\ua\error\exclamation.jpg.enc
- %APPDATA%\icqm\icq\html\uz\error\exclamation.jpg.enc
- %APPDATA%\mail.ru\agent\mra\html\bg\error\exclamation.jpg.enc
- %TEMP%\_mei9162\base_library.zip.enc
- %HOMEPATH%\desktop\fi51.doc.enc
- %HOMEPATH%\desktop\join.avi.enc
- %HOMEPATH%\desktop\correct.avi.enc
- %APPDATA%\microsoft\windows\themes\transcodedwallpaper.jpg.enc
- %APPDATA%\mail.ru\agent\mra\html\uz\error\exclamation.jpg.enc
- %APPDATA%\mail.ru\agent\mra\html\tr\error\exclamation.jpg.enc
- %APPDATA%\mail.ru\agent\mra\html\ua\error\exclamation.jpg.enc
- %APPDATA%\mail.ru\agent\mra\html\ru\error\exclamation.jpg.enc
- %APPDATA%\mail.ru\agent\mra\html\pt\error\exclamation.jpg.enc
- %APPDATA%\mail.ru\agent\mra\html\kz\error\exclamation.jpg.enc
- %APPDATA%\mail.ru\agent\mra\html\en\error\exclamation.jpg.enc
- %APPDATA%\mail.ru\agent\mra\html\de\error\exclamation.jpg.enc
- %APPDATA%\mail.ru\agent\mra\html\cz\error\exclamation.jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\aafwcrx[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuyc5q[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\roses.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\psychedelic.jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbllu8r[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbqmmou[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbub6o1[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbugxxc[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuj3tl[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbumf59[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuq7ch[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbur7bl[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bburjeg[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuwmgm[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuxbel[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuxjup[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuxobx[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuxyym[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuy5ey[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuyhay[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuympo[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\pine_lumber.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\peacock.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\orangecircles.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\notebook.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\monet.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\handprints.jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\aafobng[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\greenbubbles.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\blue_gradient.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\bears.jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuz11l[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuyw6y[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuyvs0[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bbuyugu[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\pretty_peacock.jpg.enc
- %LOCALAPPDATA%\microsoft\windows mail\stationery\sand_paper.jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuybrz[1].jpg.enc
- %APPDATA%\telegram desktop\log.txt.enc
- %TEMP%\_mei9162\cryptodome\util\_strxor.cp37-win_amd64.pyd
- %TEMP%\_mei9162\vcruntime140.dll
- %TEMP%\_mei9162\_bz2.pyd
- %TEMP%\_mei9162\_ctypes.pyd
- %TEMP%\_mei9162\_hashlib.pyd
- %TEMP%\_mei9162\_lzma.pyd
- %TEMP%\_mei9162\_socket.pyd
- %TEMP%\_mei9162\_ssl.pyd
- %TEMP%\_mei9162\libcrypto-1_1.dll
- %TEMP%\_mei9162\libssl-1_1.dll
- %TEMP%\_mei9162\main.exe.manifest
- %TEMP%\_mei9162\pyexpat.pyd
- %TEMP%\_mei9162\python37.dll
- %TEMP%\_mei9162\select.pyd
- %TEMP%\_mei9162\unicodedata.pyd
- %TEMP%\_mei9162\include\pyconfig.h
- %TEMP%\_mei9162\base_library.zip
- %TEMP%\dd_setuputility.txt.enc
- %TEMP%\dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt.enc
- %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\f[3].txt.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\f[2].txt.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\f[1].txt.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\connect[1].txt.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\c4-5ab719-91cdfbc1[1].txt.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\f[2].txt.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\f[1].txt.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\connect[1].txt.enc
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.enc
- %LOCALAPPDATA%\google\chrome\user data\chrome_shutdown_ms.txt.enc
- %ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5c82.tmp.appcompat.txt.enc
- %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt.enc
- %TEMP%\_mei9162\cryptodome\util\_cpuid_c.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\publickey\_ec_ws.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\protocol\_scrypt.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_salsa20.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_chacha20.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_aes.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_aesni.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_arc2.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_blowfish.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_cast.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_cbc.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_cfb.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_ctr.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_des.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_des3.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_ecb.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_eksblowfish.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_ocb.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_ofb.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_blake2b.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_poly1305.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_keccak.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_ghash_portable.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_ghash_clmul.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_sha512.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_sha384.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_sha224.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_sha256.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_sha1.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_ripemd160.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_md5.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_md4.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_md2.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_blake2s.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\math\_modexp.cp37-win_amd64.pyd
- %APPDATA%\microsoft\windows\cookies\user@scorecardresearch[3].txt.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuxswl[1].jpg.enc
- %TEMP%\dd_wcf_ca_smci_20200611_031101_060.txt.enc
- %ALLUSERSPROFILE%\microsoft\windows nt\msscan\welcomescan.jpg.enc
- C:\users\public\music\sample music\albumartsmall.jpg.enc
- C:\users\public\music\sample music\albumart_{5fa05d35-a682-4af6-96f7-0773e42d4d16}_large.jpg.enc
- C:\users\public\music\sample music\albumart_{5fa05d35-a682-4af6-96f7-0773e42d4d16}_small.jpg.enc
- C:\users\public\music\sample music\folder.jpg.enc
- C:\users\public\pictures\sample pictures\chrysanthemum.jpg.enc
- C:\users\public\pictures\sample pictures\desert.jpg.enc
- C:\users\public\pictures\sample pictures\hydrangeas.jpg.enc
- C:\users\public\pictures\sample pictures\jellyfish.jpg.enc
- C:\users\public\pictures\sample pictures\koala.jpg.enc
- C:\users\public\pictures\sample pictures\lighthouse.jpg.enc
- C:\users\public\pictures\sample pictures\penguins.jpg.enc
- C:\users\public\pictures\sample pictures\tulips.jpg.enc
- %LOCALAPPDATA%\microsoft\media player\art cache\localmls\{e0b059b4-a85d-44bf-91bb-c9f4d9056b6e}.jpg.enc
- %LOCALAPPDATA%\microsoft\media player\art cache\localmls\{f4a8fc3a-8cdf-4002-b302-ab80b8408a6e}.jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbgcqj0[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbitlpw[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbux3vw[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuwpxg[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuwkxi[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuw2el[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuvpx4[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuv6aq[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuol3s[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuscuy[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuleo1[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbu6lok[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbqqgih[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbmjpoi[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbmjdzf[1].jpg.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbm6e1t[1].jpg.enc
- %TEMP%\dd_wcf_ca_smci_20200611_031056_919.txt.enc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bbuya1q[1].jpg.enc
- %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.enc
- %APPDATA%\mra\update\ver.txt.enc
- %TEMP%\fxsapidebuglogfile.txt.enc
- %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txt.enc
- %TEMP%\microsoft .net framework 4.7.1 setup_20200610_200621826-msi_netfx_full_x64.msi.txt.enc
- %TEMP%\webinstaller\qnzuposrqouvfisa\data.txt.enc
- %APPDATA%\icq-profile\update\ver.txt.enc
- %APPDATA%\icqm\icq\smiles\skin.txt.enc
- %APPDATA%\mail.ru\agent\mra\smiles\skin.txt.enc
- %APPDATA%\microsoft\windows\cookies\user@246059135.log.optimizely[1].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@adnxs[1].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@adobe[1].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@adobe[3].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@bing[1].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@bing[2].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@c.bing[1].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@c.bing[2].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@c.msn[1].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@c.msn[2].txt.enc
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt.enc
- %APPDATA%\microsoft\windows\cookies\user@yandex[2].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@yandex[1].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@www.msn[3].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@www.msn[2].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@www.bing[1].txt.enc
- %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt.enc
- %APPDATA%\microsoft\windows\cookies\user@sportiv[2].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@scorecardresearch[2].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@onlinestores.metaservices.microsoft[1].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@msn[2].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@msn[1].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@mozilla[2].txt.enc
- %APPDATA%\microsoft\windows\cookies\user@demdex[2].txt.enc
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt.enc
- %APPDATA%\opera software\opera stable\bookmarks.bak.enc
Удаляет следующие файлы
- %TEMP%\_mei9162\base_library.zip
- %TEMP%\_mei9162\cryptodome\hash\_sha224.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_sha256.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_sha384.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_sha512.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\math\_modexp.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\protocol\_scrypt.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\publickey\_ec_ws.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\util\_cpuid_c.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\util\_strxor.cp37-win_amd64.pyd
- %TEMP%\_mei9162\include\pyconfig.h
- %TEMP%\_mei9162\cryptodome\cipher\_raw_des3.cp37-win_amd64.pyd
- %TEMP%\_mei9162\libcrypto-1_1.dll
- %TEMP%\_mei9162\main.exe.manifest
- %TEMP%\_mei9162\pyexpat.pyd
- %TEMP%\_mei9162\python37.dll
- %TEMP%\_mei9162\select.pyd
- %TEMP%\_mei9162\unicodedata.pyd
- %TEMP%\_mei9162\vcruntime140.dll
- %TEMP%\_mei9162\_bz2.pyd
- %TEMP%\_mei9162\_ctypes.pyd
- %TEMP%\_mei9162\_hashlib.pyd
- %TEMP%\_mei9162\_lzma.pyd
- %TEMP%\_mei9162\cryptodome\hash\_ripemd160.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_sha1.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_poly1305.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_md5.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_md4.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_arc4.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_chacha20.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_aes.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_aesni.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_arc2.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_blowfish.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_cast.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_cbc.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_cfb.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_ctr.cp37-win_amd64.pyd
- %TEMP%\_mei9162\_socket.pyd
- %TEMP%\_mei9162\libssl-1_1.dll
- %TEMP%\_mei9162\cryptodome\cipher\_raw_des.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_eksblowfish.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_ocb.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_raw_ofb.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\cipher\_salsa20.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_blake2b.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_blake2s.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_ghash_clmul.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_ghash_portable.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_keccak.cp37-win_amd64.pyd
- %TEMP%\_mei9162\cryptodome\hash\_md2.cp37-win_amd64.pyd
- %TEMP%\_mei9162\base_library.zip.enc
- %TEMP%\_mei9162\cryptodome\cipher\_raw_ecb.cp37-win_amd64.pyd
- %TEMP%\_mei9162\_ssl.pyd
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
