Техническая информация
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\region-north-karelia.jpg
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\parnas_01.jpg
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\3.jpg
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\210252809.jpg
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\13.jpg
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\weeklysheet1215.doc
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\luffy.jpg
- %HOMEPATH%\desktop\readme.txt
Перемещает следующие файлы
- %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json в %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.mdl
- %TEMP%\wmsetup.log в %TEMP%\wmsetup.log.mdl
- %TEMP%\setupexe(202309121734336dc).log в %TEMP%\setupexe(202309121734336dc).log.mdl
- %TEMP%\opera_crashreporter.log в %TEMP%\opera_crashreporter.log.mdl
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt.mdl
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt.mdl
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt.mdl
- %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt в %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt.mdl
- %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt в %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt.mdl
- %TEMP%\jusched.log в %TEMP%\jusched.log.mdl
- %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log.mdl
- %TEMP%\javadeployreg.log в %TEMP%\javadeployreg.log.mdl
- %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt в %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt.mdl
- %TEMP%\dd_vcredist_x86_20230912172350.log в %TEMP%\dd_vcredist_x86_20230912172350.log.mdl
- %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log.mdl
- %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log.mdl
- %TEMP%\dd_vcredist_x86_20230912172322.log в %TEMP%\dd_vcredist_x86_20230912172322.log.mdl
- %TEMP%\dd_vcredist_x86_20230912172224.log в %TEMP%\dd_vcredist_x86_20230912172224.log.mdl
- %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log.mdl
- %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log.mdl
- %TEMP%\dd_vcredist_x86_20230912172157.log в %TEMP%\dd_vcredist_x86_20230912172157.log.mdl
- %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt в %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt.mdl
- %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log.mdl
- %TEMP%\opera installer\opera_installer_20230912173243.log в %TEMP%\opera installer\opera_installer_20230912173243.log.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js.mdl
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json в %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json.mdl
- %TEMP%\opera installer\opera_installer_20230912173246.log в %TEMP%\opera installer\opera_installer_20230912173246.log.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt.mdl
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js в %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json.mdl
- %TEMP%\dd_vcredist_x86_20230912171936.log в %TEMP%\dd_vcredist_x86_20230912171936.log.mdl
- %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log.mdl
- %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log.mdl
- %TEMP%\dd_setuputility.txt в %TEMP%\dd_setuputility.txt.mdl
- %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt в %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.mdl
- %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt в %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt.mdl
- %TEMP%\chrome_installer.log в %TEMP%\chrome_installer.log.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt.mdl
- %TEMP%\dd_vcredistmsi12db.txt в %TEMP%\dd_vcredistmsi12db.txt.mdl
- %TEMP%\aspnetsetup_00001.log в %TEMP%\aspnetsetup_00001.log.mdl
- %TEMP%\aspnetsetup_00000.log в %TEMP%\aspnetsetup_00000.log.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.mdl
- %TEMP%\adobesfx.log в %TEMP%\adobesfx.log.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.mdl
- %TEMP%\adobearm.log в %TEMP%\adobearm.log.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.mdl
- %TEMP%\dd_vcredistui12db.txt в %TEMP%\dd_vcredistui12db.txt.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.mdl
- %TEMP%\dd_vcredist_amd64_20230912171641.log в %TEMP%\dd_vcredist_amd64_20230912171641.log.mdl
- %TEMP%\dd_vcredist_x86_20230912171759.log в %TEMP%\dd_vcredist_x86_20230912171759.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912172134.log в %TEMP%\dd_vcredist_amd64_20230912172134.log.mdl
- %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log.mdl
- %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log.mdl
- %TEMP%\dd_vcredist_x86_20230912171710.log в %TEMP%\dd_vcredist_x86_20230912171710.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912172315.log в %TEMP%\dd_vcredist_amd64_20230912172315.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.mdl
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.mdl
- %TEMP%\dd_vcredist_amd64_20230912172247.log в %TEMP%\dd_vcredist_amd64_20230912172247.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912172034.log в %TEMP%\dd_vcredist_amd64_20230912172034.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912171824.log в %TEMP%\dd_vcredist_amd64_20230912171824.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912171735.log в %TEMP%\dd_vcredist_amd64_20230912171735.log.mdl
- %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt.mdl
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json в %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json.mdl
Изменяет следующие файлы
- %HOMEPATH%\desktop\13.jpeg
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt
- %TEMP%\aspnetsetup_00001.log
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js
- %TEMP%\aspnetsetup_00000.log
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt
- %TEMP%\adobesfx.log
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json
- %TEMP%\adobearm.log
- %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss00002.log
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss00001.log
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss.log
- %ALLUSERSPROFILE%\microsoft\windows defender\support\mplog-07132009-221054.log
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\update-config.json
- %ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\update-config.json
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\3.jpg
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\210252809.jpg
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\13.jpg
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json
- %TEMP%\chrome_installer.log
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Ищет следующие окна
- ClassName: 'SystemTray_Main' WindowName: ''
