Техническая информация
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\sdszfo.docx
Изменения в файловой системе
Перемещает следующие файлы
- %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt в %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.ransommine
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt.ransommine
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt.ransommine
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt.ransommine
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\trrblacklist.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\trrblacklist.txt.ransommine
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt.ransommine
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\securitypreloadstate.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\securitypreloadstate.txt.ransommine
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt.ransommine
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt.ransommine
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt.ransommine
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt.ransommine
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt.ransommine
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt.ransommine
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt.ransommine
- %APPDATA%\microsoft\windows\themes\transcodedwallpaper.jpg в %APPDATA%\microsoft\windows\themes\transcodedwallpaper.jpg.ransommine
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt.ransommine
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt.ransommine
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt.ransommine
- %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt в %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt.ransommine
- %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt в %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt.ransommine
- %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt в %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt.ransommine
- %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt в %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt.ransommine
- %TEMP%\dd_vcredistui7a3c.txt в %TEMP%\dd_vcredistui7a3c.txt.ransommine
- %TEMP%\dd_vcredistmsi7a3c.txt в %TEMP%\dd_vcredistmsi7a3c.txt.ransommine
- %TEMP%\dd_setuputility.txt в %TEMP%\dd_setuputility.txt.ransommine
- %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt в %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.ransommine
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt.ransommine
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt.ransommine
Изменяет следующие файлы
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\secondarytile.png
- %LOCALAPPDATA%\microsoft\windows mail\stationery\psychedelic.jpg
- %LOCALAPPDATA%\microsoft\windows mail\stationery\pretty_peacock.jpg
- %LOCALAPPDATA%\microsoft\windows mail\stationery\pine_lumber.jpg
- %LOCALAPPDATA%\microsoft\windows mail\stationery\peacock.jpg
- %LOCALAPPDATA%\microsoft\windows mail\stationery\orangecircles.jpg
- %LOCALAPPDATA%\microsoft\windows mail\stationery\notebook.jpg
- %LOCALAPPDATA%\microsoft\windows mail\stationery\monet.jpg
- %LOCALAPPDATA%\microsoft\windows mail\stationery\handprints.jpg
- %LOCALAPPDATA%\microsoft\windows mail\stationery\greenbubbles.jpg
- %LOCALAPPDATA%\microsoft\windows mail\stationery\garden.jpg
- %LOCALAPPDATA%\microsoft\windows mail\stationery\blue_gradient.jpg
- %LOCALAPPDATA%\microsoft\windows mail\stationery\bears.jpg
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\favicon[1].ico
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png
- %LOCALAPPDATA%\google\chrome\user data\default\google profile.ico
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\splash-620x300.png
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\smalllogo.png
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\logo.png
- %LOCALAPPDATA%\microsoft\windows mail\stationery\roses.jpg
- %LOCALAPPDATA%\microsoft\windows mail\stationery\sand_paper.jpg
Изменяет множество файлов.
Другое
Ищет следующие окна
- ClassName: '' WindowName: 'Minecraft 1.11.2'
