Техническая информация
Для обеспечения автозапуска и распространения
Изменяет следующие исполняемые системные файлы
- <SYSTEM32>\taskhost.exe
Вредоносные функции
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\rundll32.exe
- <SYSTEM32>\dwm.exe
Изменения в файловой системе
Создает следующие файлы
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304839888e02_d4602615-9d50-4880-be41-678935e93eaa
- C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\windows\templates\ryukreadme.txt
- C:\documents and settings\default\desktop\ryukreadme.txt
- C:\documents and settings\default\documents\ryukreadme.txt
- C:\documents and settings\default\documents\my music\ryukreadme.txt
- C:\documents and settings\default\documents\my pictures\ryukreadme.txt
- C:\documents and settings\default\documents\my videos\ryukreadme.txt
- C:\documents and settings\default\downloads\ryukreadme.txt
- C:\documents and settings\default\favorites\ryukreadme.txt
- C:\documents and settings\default\links\ryukreadme.txt
- volume{c693706e-3f85-11ed-82a9-806e6f6e6963}\system volume information\tracking.log.tmp
- C:\documents and settings\default\ntuser.dat
- C:\documents and settings\default\ntuser.dat.log
- C:\documents and settings\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf
- C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\ryukreadme.txt
- C:\documents and settings\default\ntuser.dat.log1
- C:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\windows\recent\ryukreadme.txt
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages...
- C:\documents and settings\default\ryukreadme.txt
- C:\documents and settings\default\appdata\ryukreadme.txt
- C:\documents and settings\default\appdata\local\ryukreadme.txt
- C:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\applicati...
- C:\documents and settings\default\appdata\roaming\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\media center programs\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\shows desktop.lnk
- C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\window switcher.lnk
- C:\documents and settings\default\appdata\roaming\microsoft\windows\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\windows\cookies\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\windows\network shortcuts\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\windows\printer shortcuts\ryukreadme.txt
- C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini
- C:\documents and settings\default\appdata\roaming\microsoft\windows\sendto\ryukreadme.txt
- C:\documents and settings\public\ryukreadme.txt
- C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\wi...
- C:\documents and settings\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms
- C:\documents and settings\public\downloads\ryukreadme.txt
- C:\documents and settings\public\downloads\desktop.ini
- C:\documents and settings\public\libraries\ryukreadme.txt
- C:\documents and settings\public\libraries\recordedtv.library-ms
- C:\documents and settings\public\libraries\desktop.ini
- C:\documents and settings\public\recorded tv\ryukreadme.txt
- C:\documents and settings\public\recorded tv\sample media\ryukreadme.txt
- C:\documents and settings\public\recorded tv\sample media\desktop.ini
- C:\documents and settings\user\ryukreadme.txt
- C:\documents and settings\user\appdata\ryukreadme.txt
- C:\documents and settings\user\appdata\local\ryukreadme.txt
- C:\documents and settings\public\recorded tv\desktop.ini
- C:\documents and settings\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv
- C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application ...
- C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\fe...
- C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\in...
- C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\me...
- C:\documents and settings\public\desktop.ini
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\package...
- C:\documents and settings\desktop.ini
- C:\documents and settings\default\start menu\programs\accessories\windows explorer.lnk
- C:\documents and settings\default\start menu\programs\accessories\accessibility\ease of access.lnk
- C:\documents and settings\default\sendto\fax recipient.lnk
- C:\documents and settings\default\start menu\programs\accessories\accessibility\magnify.lnk
- C:\documents and settings\default\start menu\programs\accessories\command prompt.lnk
- C:\documents and settings\default\start menu\programs\accessories\accessibility\narrator.lnk
- C:\documents and settings\default\start menu\programs\accessories\system tools\computer.lnk
- C:\documents and settings\default\start menu\programs\accessories\notepad.lnk
- C:\documents and settings\default\start menu\programs\accessories\accessibility\desktop.ini
- C:\documents and settings\default\start menu\programs\accessories\system tools\private character editor.lnk
- C:\documents and settings\default\start menu\programs\accessories\system tools\control panel.lnk
- C:\documents and settings\default\start menu\programs\maintenance\desktop.ini
- C:\documents and settings\default\start menu\programs\accessories\desktop.ini
- C:\documents and settings\default\start menu\programs\accessories\run.lnk
- C:\documents and settings\default\start menu\programs\accessories\accessibility\on-screen keyboard.lnk
- C:\documents and settings\default\start menu\programs\accessories\system tools\desktop.ini
- C:\documents and settings\default\start menu\programs\maintenance\help.lnk
- C:\documents and settings\default\sendto\desktop.ini
- C:\documents and settings\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms
- C:\documents and settings\default\saved games\ryukreadme.txt
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\package...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\a...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\star...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\assistance\...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\device stag...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\search\data...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\42d5bec...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{13a4ee...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{37b8f9...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{42667d...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{6cd9e9...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{929fbd...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{9d29fc...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{a749d8...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{b17552...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{bd95a8...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{cf2bea...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{e699e0...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{ec9807...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\pack...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f1b0fb...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\micr...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\appl...
- D:\ryukreadme.txt
- D:\$recycle.bin\ryukreadme.txt
- D:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\ryukreadme.txt
- C:\ryukreadme.txt
- C:\documents and settings\ryukreadme.txt
- C:\documents and settings\all users\ryukreadme.txt
- C:\documents and settings\all users\adobe\ryukreadme.txt
- C:\documents and settings\all users\adobe\arm\ryukreadme.txt
- C:\documents and settings\all users\adobe\arm\s\ryukreadme.txt
- C:\documents and settings\all users\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\ryukreadme.txt
- C:\documents and settings\all users\adobe\setup\ryukreadme.txt
- C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini
- C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini
- C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\ryukreadme.txt
- C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi
- C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1501020056.msp
- C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\docu...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x64_528c9...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\m...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\microsoft office\microsoft office 2...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\package...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\package...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\package...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\6d14e4b1...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\machinekeys\08e57...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\search\data\applications\win...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender\definition ...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\42d5bec7ddfbd49e76467529...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{13a4ee12-23ea-3371-91ee...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{42667d2e-b054-46c1-9d46...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{6cd9e9ed-906d-4196-8dc3...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{9d29fc96-9eee-4253-943f...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{a749d8e6-b613-3be3-8f5f...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{e699e009-1c3c-4e50-9b57...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{ec9807de-b577-47b1-a024...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{bd95a8cd-1d9f-35ad-981a...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{cf2bea3c-26ea-32f8-aa9b...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{f1b0fb3a-e0ea-47a6-9383...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\microsoft office\m...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\windows\wer\reportqueue\noncritical_x64_4017a...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f8cfeb...
- C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\microso...
Перемещает следующие файлы
- C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini в C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.ryk
- C:\documents and settings\default\start menu\programs\accessories\command prompt.lnk в C:\documents and settings\default\start menu\programs\accessories\command prompt.lnk.ryk
- C:\documents and settings\default\start menu\programs\accessories\accessibility\narrator.lnk в C:\documents and settings\default\start menu\programs\accessories\accessibility\narrator.lnk.ryk
- C:\documents and settings\default\start menu\programs\accessories\accessibility\magnify.lnk в C:\documents and settings\default\start menu\programs\accessories\accessibility\magnify.lnk.ryk
- C:\documents and settings\default\start menu\programs\accessories\accessibility\desktop.ini в C:\documents and settings\default\start menu\programs\accessories\accessibility\desktop.ini.ryk
- C:\documents and settings\default\start menu\programs\accessories\system tools\computer.lnk в C:\documents and settings\default\start menu\programs\accessories\system tools\computer.lnk.ryk
- C:\documents and settings\default\start menu\programs\accessories\accessibility\ease of access.lnk в C:\documents and settings\default\start menu\programs\accessories\accessibility\ease of access.lnk.ryk
- C:\documents and settings\default\start menu\programs\accessories\notepad.lnk в C:\documents and settings\default\start menu\programs\accessories\notepad.lnk.ryk
- C:\documents and settings\default\sendto\fax recipient.lnk в C:\documents and settings\default\sendto\fax recipient.lnk.ryk
- C:\documents and settings\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms в C:\documents and settings\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.ryk
- C:\documents and settings\default\ntuser.dat.log1 в C:\documents and settings\default\ntuser.dat.log1.ryk
- C:\documents and settings\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf в C:\documents and settings\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.ryk
- C:\documents and settings\default\ntuser.dat.log в C:\documents and settings\default\ntuser.dat.log.ryk
- C:\documents and settings\default\ntuser.dat в C:\documents and settings\default\ntuser.dat.ryk
- volume{c693706e-3f85-11ed-82a9-806e6f6e6963}\system volume information\tracking.log.tmp в volume{c693706e-3f85-11ed-82a9-806e6f6e6963}\system volume information\tracking.log
- C:\documents and settings\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms в C:\documents and settings\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.ryk
- C:\documents and settings\default\start menu\programs\accessories\system tools\control panel.lnk в C:\documents and settings\default\start menu\programs\accessories\system tools\control panel.lnk.ryk
- C:\documents and settings\default\start menu\programs\accessories\desktop.ini в C:\documents and settings\default\start menu\programs\accessories\desktop.ini.ryk
- C:\documents and settings\default\start menu\programs\accessories\run.lnk в C:\documents and settings\default\start menu\programs\accessories\run.lnk.ryk
- C:\documents and settings\public\recorded tv\desktop.ini в C:\documents and settings\public\recorded tv\desktop.ini.ryk
- C:\documents and settings\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv в C:\documents and settings\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv.ryk
- C:\documents and settings\public\recorded tv\sample media\desktop.ini в C:\documents and settings\public\recorded tv\sample media\desktop.ini.ryk
- C:\documents and settings\public\libraries\desktop.ini в C:\documents and settings\public\libraries\desktop.ini.ryk
- C:\documents and settings\public\libraries\recordedtv.library-ms в C:\documents and settings\public\libraries\recordedtv.library-ms.ryk
- C:\documents and settings\public\downloads\desktop.ini в C:\documents and settings\public\downloads\desktop.ini.ryk
- C:\documents and settings\public\desktop.ini в C:\documents and settings\public\desktop.ini.ryk
- C:\documents and settings\desktop.ini в C:\documents and settings\desktop.ini.ryk
- C:\documents and settings\default\start menu\programs\accessories\windows explorer.lnk в C:\documents and settings\default\start menu\programs\accessories\windows explorer.lnk.ryk
- C:\documents and settings\default\start menu\programs\maintenance\help.lnk в C:\documents and settings\default\start menu\programs\maintenance\help.lnk.ryk
- C:\documents and settings\default\start menu\programs\accessories\system tools\desktop.ini в C:\documents and settings\default\start menu\programs\accessories\system tools\desktop.ini.ryk
- C:\documents and settings\default\sendto\desktop.ini в C:\documents and settings\default\sendto\desktop.ini.ryk
- C:\documents and settings\default\start menu\programs\accessories\accessibility\on-screen keyboard.lnk в C:\documents and settings\default\start menu\programs\accessories\accessibility\on-screen keyboard.lnk.ryk
- C:\documents and settings\default\start menu\programs\maintenance\desktop.ini в C:\documents and settings\default\start menu\programs\maintenance\desktop.ini.ryk
- C:\documents and settings\default\start menu\programs\accessories\system tools\private character editor.lnk в C:\documents and settings\default\start menu\programs\accessories\system tools\private character editor.lnk.ryk
- C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini в C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini.ryk
- C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application ... в C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application ...
- C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\shows desktop.lnk в C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\shows desktop.lnk.ryk
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\package... в C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\package...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender\definition ... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender\definition ...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\6d14e4b1... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\rsa\s-1-5-18\6d14e4b1...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\m... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\m...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\assistance\... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\assistance\...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\a... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\a...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\star... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\star...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\microsoft office\m... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\microsoft office\m...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\pack... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\pack...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\docu... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\docu...
- C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab в C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.ryk
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\appl... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\appl...
- C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1501020056.msp в C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1501020056.msp.ryk
- C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi в C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.ryk
- C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini в C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.ryk
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\micr... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\micr...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages... в C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\package... в C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\package...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\package... в C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\package...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages... в C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\package... в C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\package...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages... в C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages... в C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\package... в C:\documents and settings\all users\application data\application data\application data\application data\application data\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\package...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\microsoft office\microsoft office 2... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\microsoft office\microsoft office 2...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11...
- C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12... в C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12...
- C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\window switcher.lnk в C:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\window switcher.lnk.ryk
- C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\me... в C:\documents and settings\user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\me...
Изменяет следующие файлы
- D:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini
- D:\system volume information\tracking.log
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
