Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\0_help_decrypt_files.txt
- %APPDATA%\microsoft\windows\start menu\programs\startup\0_help_decrypt_files2.html
Создает следующие файлы на съемном носителе
- <Имя диска съемного носителя>:\hypothyroidism_slides.pptx
- <Имя диска съемного носителя>:\samieee_obiee_presentation.pptx
- <Имя диска съемного носителя>:\waterresourcesag.pptx
- <Имя диска съемного носителя>:\asaprojectcompetition.pptx
- <Имя диска съемного носителя>:\roozenedowebinar.pptx
- <Имя диска съемного носителя>:\stoc13_ml_quoc_le.pptx
- <Имя диска съемного носителя>:\indogerman2010.pptx
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\delete.avi
Изменения в файловой системе
Создает следующие файлы
- %HOMEPATH%\desktop\0_help_decrypt_files.html
- %HOMEPATH%\music\0_help_decrypt_files2.txt
- %HOMEPATH%\pictures\0_help_decrypt_files2.txt
- %HOMEPATH%\documents\0_help_decrypt_files2.txt
- %APPDATA%\0_help_decrypt_files2.txt
- %HOMEPATH%\music\0_help_decrypt_files.txt
- %HOMEPATH%\pictures\0_help_decrypt_files.txt
- %HOMEPATH%\documents\0_help_decrypt_files.txt
- %APPDATA%\0_help_decrypt_files.txt
- %HOMEPATH%\desktop\0_help_decrypt_files2.txt
- %HOMEPATH%\videos\0_help_decrypt_files.html
- %HOMEPATH%\music\0_help_decrypt_files.html
- %HOMEPATH%\pictures\0_help_decrypt_files.html
- %HOMEPATH%\documents\0_help_decrypt_files2.html
- %HOMEPATH%\desktop\0_help_decrypt_files2.html
- %HOMEPATH%\desktop\0_help_decrypt_files.txt
- %HOMEPATH%\videos\0_help_decrypt_files.txt
- %HOMEPATH%\videos\0_help_decrypt_files2.txt
Перемещает следующие файлы
- %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt в %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.styx
- %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json в %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3561288849sdhlie.sqlite в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2918063365piupsah.sqlite в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2918063365piupsah.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.s... в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.s...
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\manifest.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\manifest.json.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\state.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\state.json.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\xulstore.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\xulstore.json.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\user.js в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\user.js.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\trrblacklist.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\trrblacklist.txt.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\times.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\times.json.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\shield-preference-experiments.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\shield-preference-experiments.json.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessioncheckpoints.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessioncheckpoints.json.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\securitypreloadstate.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\securitypreloadstate.txt.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\prefs.js в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\prefs.js.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\session-state.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\session-state.json.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\handlers.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\handlers.json.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extensions.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extensions.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\places.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\places.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\handlers.json в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\handlers.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\formhistory.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\formhistory.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\favicons.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\favicons.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extensions.json в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extensions.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extension-preferences.json в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extension-preferences.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cookies.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cookies.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\content-prefs.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\content-prefs.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\containers.json в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\containers.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\broadcast-listeners.json в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\broadcast-listeners.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\permissions.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\permissions.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addons.json в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addons.json.styx
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt.styx
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt.styx
- %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt в %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt.styx
- %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt в %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt.styx
- %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt в %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt.styx
- %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt в %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt.styx
- %TEMP%\dd_vcredistui7a3c.txt в %TEMP%\dd_vcredistui7a3c.txt.styx
- %TEMP%\dd_vcredistmsi7a3c.txt в %TEMP%\dd_vcredistmsi7a3c.txt.styx
- %TEMP%\dd_setuputility.txt в %TEMP%\dd_setuputility.txt.styx
- %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt в %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.styx
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\state.json в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\state.json.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\containers.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\containers.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\broadcast-listeners.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\broadcast-listeners.json.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json.styx
- %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js в %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js.styx
- %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\times.json в %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\times.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extension-preferences.json в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extension-preferences.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\session-state.json в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\session-state.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\webappsstore.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\webappsstore.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\user.js в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\user.js.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\times.json в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\times.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage.sqlite в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage.sqlite.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\shield-preference-experiments.json в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\shield-preference-experiments.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessioncheckpoints.json в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessioncheckpoints.json.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt.styx
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt.styx
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.styx
Изменяет следующие файлы
- C:\kms\kms_vl_all_aio.cmd
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.xml
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\cmd.exe' vssadmin.exe delete shadows /all / quiet' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' vssadmin.exe delete shadows /all / quiet
- '<SYSTEM32>\notepad.exe' %HOMEPATH%\Desktop\0_HELP_DECRYPT_FILES2.txt
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "%HOMEPATH%\Desktop\0_HELP_DECRYPT_FILES.html"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\0_HELP_DECRYPT_FILES.html"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\0_HELP_DECRYPT_FILES.html" /crash-reporter-parent-id=1508
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1508.0.896729647\311253690" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
