Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\waijo
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\split.avi
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\other\pawje.exe
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\partiallyfreezing.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\overflowiconlarge.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\overflowicon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\ondemandselectivesync.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\ondemandfilesdehydrate.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\ondemandfiles.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\loading_spinner.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\loading.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\kfm_folders_image.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\infoicon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\icebucket.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\globeicon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\folder_image_pictures.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\folder_image_documents.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\folder_image_desktop.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\foldericon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\finderextensionprompt.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\erroricon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\done_graphic.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\cloud.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\chevronup.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\chevron.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\checkmark_selected.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\checkmark_in_progress.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\checkmark_hovered.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\checkmark_finished.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\checkboxcomposite.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\paused.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\premiumicon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\recyclebin.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\resignin.svg.schw
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\prefs.js.schw
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\pkcs11.txt.schw
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\alternateservices.txt.schw
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\license.txt.schw
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\user.js.schw
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sitesecurityservicestate.txt.schw
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\prefs.js.schw
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\pkcs11.txt.schw
- %APPDATA%\mozilla\firefox\profiles\jkail15y.default\user.js.schw
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_192036284-msi_vc_red.msi.txt.schw
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_192019924-msi_vc_red.msi.txt.schw
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_191926081-msi_vc_red.msi.txt.schw
- %TEMP%\dd_vcredistui6d07.txt.schw
- %TEMP%\dd_ndp462-kb3151800-x86-x64-allos-enu_decompression_log.txt.schw
- %TEMP%\dd_vcredistmsi6d07.txt.schw
- %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.schw
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.postinstallationtask09_28_19_27_14_9743.txt.schw
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.discoverynotificationtask09_28_19_47_28_2155.txt.schw
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.discoverynotificationtask08_07_19_50_15_1236.txt.schw
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.discoverynotificationtask06_28_19_41_47_7628.txt.schw
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.discoverynotificationtask06_28_19_30_05_6174.txt.schw
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.discoverynotificationtask06_28_19_10_32_1495.txt.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\fabexmdl2.ttf.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\waterglass.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\warning-symbol_grey.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\stackedicecubes.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\signin.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\shield_icon.svg.schw
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\securitypreloadstate.txt.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\cancelicon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\acmdismissicon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\waterglass.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkmark_finished.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkboxcomposite.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\cancelicon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\acmdismissicon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\thirdpartynotices.txt.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\screenshotoptin.gif.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\autoplayoptin.gif.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\folder_image_pictures.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\folder_image_documents.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\folder_image_desktop.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\foldericon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\screenshotoptin.gif.schw
- %LOCALAPPDATA%\microsoft\internet explorer\domainsuggestions\en-us.1.schw
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.schw
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.schw
- %LOCALAPPDATA%\google\chrome\user data\default\google profile.ico.schw
- %LOCALAPPDATA%\connecteddevicesplatform\l.user\activitiescache.db.schw
- %LOCALAPPDATA%\iconcache.db.schw
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.png.schw
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp.schw
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-48.png.schw
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-40.png.schw
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-32.png.schw
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-192.png.schw
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.png.schw
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp.schw
- %APPDATA%\other\awiem.bat
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkmark_hovered.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkmark_in_progress.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkmark_selected.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\chevron.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\stackedicecubes.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\signin.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\shield_icon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\resignin.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\recyclebin.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\premiumicon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\paused.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\partiallyfreezing.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\overflowiconlarge.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\overflowicon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\ondemandselectivesync.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\ondemandfilesdehydrate.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\ondemandfiles.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\loading.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\loading_spinner.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\kfm_folders_image.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\infoicon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\icebucket.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\globeicon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\folder_image_pictures.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\folder_image_documents.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\folder_image_desktop.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\foldericon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\finderextensionprompt.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\erroricon.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\done_graphic.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\cloud.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\chevronup.svg.schw
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\warning-symbol_grey.svg.schw
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\sitesecurityservicestate.txt.schw
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_16.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_32.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_48.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_96.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_256.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_768.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_1280.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_1920.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_2560.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_sr.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_wide.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_exif.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_wide_alternate.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_custom_stream.db
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Создает и запускает на исполнение
- '%APPDATA%\other\pawje.exe'
- '%WINDIR%\syswow64\cmd.exe' /c %APPDATA%\Other\awiem.bat' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c %APPDATA%\Other\awiem.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN waijo /tr %APPDATA%\Other\pawje.exe
- '<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%...
- '<SYSTEM32>\searchfilterhost.exe' 0 772 776 784 8192 780
