Trojan.Encoder.35429

Техническая информация

Вредоносные функции

Для затруднения выявления своего присутствия в системе

удаляет теневые копии разделов.

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\iisstart.html
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\weeklysheet1215.doc

Изменения в файловой системе

Создает следующие файлы

<Текущая директория>\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\wpd\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\wwansvc\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft help\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft toolkit\!=readmy=!.txt
%ALLUSERSPROFILE%\mozilla\logs\!=readmy=!.txt
%ALLUSERSPROFILE%\mozilla\!=readmy=!.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\!=readmy=!.txt
%ALLUSERSPROFILE%\oracle\java\javapath\!=readmy=!.txt
%ALLUSERSPROFILE%\oracle\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\!=readmy=!.txt
%ALLUSERSPROFILE%\oracle\java\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\rac\outbound\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\rac\temp\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\rac\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\search\data\temp\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\search\data\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\search\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\vault\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\localcopy\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\support\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows defender\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\!=readmy=!.txt
C:\users\public\favorites\!=readmy=!.txt
C:\users\public\music\sample music\!=readmy=!.txt
C:\users\public\music\!=readmy=!.txt
C:\users\public\pictures\sample pictures\!=readmy=!.txt
C:\users\public\pictures\!=readmy=!.txt
C:\users\public\recorded tv\sample media\!=readmy=!.txt
C:\users\public\recorded tv\!=readmy=!.txt
C:\users\public\videos\sample videos\!=readmy=!.txt
C:\users\public\videos\!=readmy=!.txt
C:\users\public\!=readmy=!.txt
%HOMEPATH%\contacts\!=readmy=!.txt
%HOMEPATH%\desktop\!=readmy=!.txt
%HOMEPATH%\documents\!=readmy=!.txt
%HOMEPATH%\downloads\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\!=readmy=!.txt
%HOMEPATH%\favorites\links\!=readmy=!.txt
%HOMEPATH%\favorites\microsoft websites\!=readmy=!.txt
%HOMEPATH%\favorites\msn websites\!=readmy=!.txt
%HOMEPATH%\favorites\windows live\!=readmy=!.txt
%HOMEPATH%\favorites\!=readmy=!.txt
%HOMEPATH%\links\!=readmy=!.txt
%HOMEPATH%\music\!=readmy=!.txt
%HOMEPATH%\pictures\!=readmy=!.txt
%HOMEPATH%\saved games\!=readmy=!.txt
%HOMEPATH%\searches\!=readmy=!.txt
%HOMEPATH%\videos\!=readmy=!.txt
%HOMEPATH%\voip\!=readmy=!.txt
C:\users\!=readmy=!.txt
C:\users\public\downloads\!=readmy=!.txt
C:\users\public\documents\!=readmy=!.txt
C:\users\public\libraries\!=readmy=!.txt
C:\users\public\desktop\!=readmy=!.txt
C:\users\default\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\!=readmy=!.txt
%ALLUSERSPROFILE%\sun\java\!=readmy=!.txt
%ALLUSERSPROFILE%\sun\!=readmy=!.txt
%ALLUSERSPROFILE%\!=readmy=!.txt
C:\users\default\desktop\!=readmy=!.txt
C:\users\default\downloads\!=readmy=!.txt
C:\users\default\documents\!=readmy=!.txt
C:\users\default\favorites\!=readmy=!.txt
C:\users\default\links\!=readmy=!.txt
C:\users\default\music\!=readmy=!.txt
C:\users\default\pictures\!=readmy=!.txt
C:\users\default\saved games\!=readmy=!.txt
C:\users\default\videos\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\!=readmy=!.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\!=readmy=!.txt
%ALLUSERSPROFILE%\sun\java\java update\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\office\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\!=readmy=!.txt
C:\far2\pluginsdk\headers.c\!=readmy=!.txt
C:\far2\pluginsdk\headers.pas\!=readmy=!.txt
C:\far2\pluginsdk\!=readmy=!.txt
C:\far2\!=readmy=!.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\!=readmy=!.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\!=readmy=!.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\!=readmy=!.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\!=readmy=!.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\!=readmy=!.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\!=readmy=!.txt
C:\msocache\all users\!=readmy=!.txt
C:\msocache\!=readmy=!.txt
C:\perflogs\!=readmy=!.txt
C:\perflogs\admin\!=readmy=!.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\!=readmy=!.txt
C:\far2\plugins\proclist\!=readmy=!.txt
C:\far2\plugins\macroview\!=readmy=!.txt
C:\far2\plugins\!=readmy=!.txt
C:\far2\plugins\network\!=readmy=!.txt
C:\far2\plugins\hlfviewer\!=readmy=!.txt
C:\far2\encyclopedia\tap\!=readmy=!.txt
D:\!=readmy=!.txt
D:\$recycle.bin\!=readmy=!.txt
C:\far2\addons\colors\custom_highlighting\!=readmy=!.txt
C:\far2\addons\colors\default_highlighting\!=readmy=!.txt
C:\far2\addons\colors\!=readmy=!.txt
C:\far2\addons\macros\!=readmy=!.txt
C:\far2\addons\setup\!=readmy=!.txt
C:\far2\addons\shell\!=readmy=!.txt
C:\far2\addons\xlat\russian\!=readmy=!.txt
C:\far2\addons\xlat\!=readmy=!.txt
C:\far2\addons\!=readmy=!.txt
C:\far2\documentation\eng\!=readmy=!.txt
C:\far2\documentation\rus\!=readmy=!.txt
C:\recovery\!=readmy=!.txt
%HOMEPATH%\!=readmy=!.txt
C:\far2\documentation\!=readmy=!.txt
C:\far2\fexcept\!=readmy=!.txt
C:\far2\plugins\align\!=readmy=!.txt
C:\far2\plugins\arclite\!=readmy=!.txt
C:\far2\plugins\autowrap\!=readmy=!.txt
C:\far2\plugins\brackets\!=readmy=!.txt
C:\far2\plugins\compare\!=readmy=!.txt
C:\far2\plugins\drawline\!=readmy=!.txt
C:\far2\plugins\editcase\!=readmy=!.txt
C:\far2\plugins\emenu\!=readmy=!.txt
C:\far2\plugins\farcmds\!=readmy=!.txt
C:\far2\plugins\filecase\!=readmy=!.txt
C:\far2\plugins\ftp\lib\!=readmy=!.txt
C:\far2\plugins\ftp\!=readmy=!.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\!=readmy=!.txt
C:\far2\encyclopedia\!=readmy=!.txt
%HOMEPATH%\favorites\links for united states\!=readmy=!.txt
C:\totalcmd\language\!=readmy=!.txt
%ALLUSERSPROFILE%\adobe\arm\s\10428\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\event viewer\views\applicationviewsrootnode\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\event viewer\views\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\event viewer\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\identitycrl\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\ilscache\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\media player\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\mf\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\!=readmy=!.txt
C:\far2\plugins\tmppanel\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\8.0\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\netframework\breadcrumbstore\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\netframework\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\network\connections\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\network\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\ehome\logs\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\ehome\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\drm\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\drm\server\!=readmy=!.txt
%ALLUSERSPROFILE%\adobe\arm\s\!=readmy=!.txt
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\!=readmy=!.txt
%ALLUSERSPROFILE%\adobe\arm\!=readmy=!.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\!=readmy=!.txt
%ALLUSERSPROFILE%\adobe\!=readmy=!.txt
%ALLUSERSPROFILE%\adobe\setup\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\assistance\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\!=readmy=!.txt
C:\totalcmd\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\crypto\keys\!=readmy=!.txt
%ALLUSERSPROFILE%\adobe\arm\reader_15.008.20082\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\crypto\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\device stage\!=readmy=!.txt
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\devicesync\!=readmy=!.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\!=readmy=!.txt
C:\!=readmy=!.txt

Изменяет следующие файлы

D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
C:\far2\addons\colors\default_highlighting\greenmile.reg
C:\far2\addons\colors\default_highlighting\farcolors242.reg
C:\far2\addons\colors\default_highlighting\dn_like.reg
C:\far2\addons\colors\default_highlighting\descript.ion
C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg
C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg
C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg
C:\far2\addons\colors\default_highlighting\black_from_myodov.reg
C:\far2\addons\colors\default_highlighting\black_from_july.reg
C:\far2\addons\colors\custom_highlighting\vaxcolors.reg
C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg
C:\far2\addons\colors\custom_highlighting\nc5pal2.reg
C:\far2\addons\colors\default_highlighting\import_colors.bat
C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg
C:\far2\addons\colors\custom_highlighting\hell.reg
C:\far2\addons\colors\custom_highlighting\greenmile.reg
C:\far2\addons\colors\custom_highlighting\farcolors242.reg
C:\far2\addons\colors\custom_highlighting\dn_like.reg
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg
C:\far2\addons\colors\custom_highlighting\descript.ion
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg
C:\far2\addons\colors\custom_highlighting\black_from_july.reg
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg
D:\install.log
C:\far2\addons\colors\custom_highlighting\import_colors.bat
C:\far2\addons\colors\default_highlighting\hell.reg

Изменяет множество файлов.

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Другое

Создает и запускает на исполнение

'<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней