Техническая информация
Изменения в файловой системе
Подменяет следующие исполняемые файлы
- <Полный путь к файлу>
- %ProgramFiles%\Microsoft Office\Office14\MSOUC.EXE
- %ProgramFiles%\Microsoft Office\Office14\MSOSYNC.EXE
- %ProgramFiles%\Microsoft Office\Office14\MSOHTMED.EXE
- %ProgramFiles%\Microsoft Office\Office14\MSACCESS.EXE
- %ProgramFiles%\Microsoft Office\Office14\misc.exe
- %ProgramFiles%\Microsoft Office\Office14\INFOPATH.EXE
- %ProgramFiles%\Microsoft Office\Office14\MSQRY32.EXE
- %ProgramFiles%\Microsoft Office\Office14\MSPUB.EXE
- %ProgramFiles%\Microsoft Office\Office14\GROOVE.EXE
- %ProgramFiles%\Microsoft Office\Office14\GRAPH.EXE
- %ProgramFiles%\Microsoft Office\Office14\excelcnv.exe
- %ProgramFiles%\Microsoft Office\Office14\EXCEL.EXE
- %ProgramFiles%\Microsoft Office\Office14\CNFNOT32.EXE
- %ProgramFiles%\Microsoft Office\Office14\CLVIEW.EXE
- %ProgramFiles%\Microsoft Office\Office14\IEContentService.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\java.exe
- %ProgramFiles%\Microsoft Office\Office14\MSTORDB.EXE
- %ProgramFiles%\Microsoft Office\Office14\XLICONS.EXE
- %ProgramFiles%\Microsoft Office\Office14\WORDICON.EXE
- %ProgramFiles%\Microsoft Office\Office14\Wordconv.exe
- %ProgramFiles%\Microsoft Office\Office14\WINWORD.EXE
- %ProgramFiles%\Microsoft Office\Office14\VPREVIEW.EXE
- %ProgramFiles%\Microsoft Office\Office14\SETLANG.EXE
- %ProgramFiles%\Microsoft Office\Office14\SELFCERT.EXE
- %ProgramFiles%\Microsoft Office\Office14\SCANPST.EXE
- %ProgramFiles%\Microsoft Office\Office14\PPTICO.EXE
- %ProgramFiles%\Microsoft Office\Office14\POWERPNT.EXE
- %ProgramFiles%\Microsoft Office\Office14\OUTLOOK.EXE
- %ProgramFiles%\Microsoft Office\Office14\ONENOTEM.EXE
- %ProgramFiles%\Microsoft Office\Office14\ONENOTE.EXE
- %ProgramFiles%\Microsoft Office\Office14\OIS.EXE
- %ProgramFiles%\Microsoft Office\Office14\NAMECONTROLSERVER.EXE
- %ProgramFiles%\Microsoft Office\Office14\BCSSync.exe
- %ProgramFiles%\Microsoft Office\Office14\GROOVEMN.EXE
- %ProgramFiles%\Microsoft Office\Office14\ACCICONS.EXE
- %ProgramFiles%\Java\jre1.8.0_45\bin\unpack200.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\tnameserv.exe
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\Oarpmany.exe
- %CommonProgramFiles%\Microsoft Shared\Source Engine\OSE.EXE
- %CommonProgramFiles%\Microsoft Shared\Smart Tag\SmartTagInstall.exe
- %CommonProgramFiles%\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
- %CommonProgramFiles%\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\Office Setup Controller\ODeploy.exe
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\MSOXMLED.EXE
- %ProgramFiles%\Java\jre1.8.0_45\bin\jabswitch.exe
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\MSOICONS.EXE
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\LICLUA.EXE
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\FLTLDR.EXE
- %CommonProgramFiles%\Microsoft Shared\EQUATION\EQNEDT32.EXE
- %CommonProgramFiles%\Microsoft Shared\DW\DWTRIG20.EXE
- %CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE
- %ProgramFiles%\Microsoft Office\Office14\1033\ONELEV.EXE
- %ProgramFiles%\Microsoft Office\Office14\MSTORE.EXE
- %ProgramFiles%\Java\jre1.8.0_45\bin\java-rmi.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\javaw.exe
- %CommonProgramFiles%\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\ssvagent.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\servertool.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\rmiregistry.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\rmid.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\policytool.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\pack200.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\orbd.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\ktab.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\klist.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\kinit.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\keytool.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\jp2launcher.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\jjs.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\javaws.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\javacpl.exe
- %ProgramFiles%\Mozilla Firefox\crashreporter.exe
Самоудаляется.
Другое
Ищет следующие окна
- ClassName: '' WindowName: 'Label1'
- ClassName: '' WindowName: '<SYSTEM32>\cmd.exe'
- ClassName: '' WindowName: 'Administrator: <SYSTEM32>\cmd.exe'
- ClassName: '' WindowName: '??? znkzz’virus QQ 621370902'
Создает и запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' ' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe'
