Техническая информация
Вредоносные функции
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
- iexplore.exe
Изменения в файловой системе
Создает следующие файлы
- <Текущая директория>\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\5\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\49\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\50\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\51\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\52\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\53\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\54\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\55\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\56\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\57\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\47\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\48\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\58\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\60\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\61\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\63\how to restore your files.txt
- %TEMP%\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\62\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\8\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\7\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\9\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\host\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\muffin\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\59\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\6\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\46\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\45\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\44\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\22\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\23\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\24\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\25\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\26\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\27\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\28\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\29\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\3\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\31\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\30\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\21\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\35\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\34\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\36\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\37\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\38\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\4\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\40\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\41\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\42\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\43\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\33\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\security\how to restore your files.txt
- %APPDATA%\how to restore your files.txt
- m:\how to restore your files.txt
- %APPDATA%\identities\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\temporary\how to restore your files.txt
- %HOMEPATH%\contacts\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\hmz1jddi.default\how to restore your files.txt
- %HOMEPATH%\desktop\how to restore your files.txt
- %HOMEPATH%\documents\how to restore your files.txt
- %HOMEPATH%\downloads\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\default\how to restore your files.txt
- %HOMEPATH%\favorites\how to restore your files.txt
- %HOMEPATH%\favorites\microsoft websites\how to restore your files.txt
- %HOMEPATH%\favorites\windows live\how to restore your files.txt
- %HOMEPATH%\favorites\msn websites\how to restore your files.txt
- %HOMEPATH%\music\how to restore your files.txt
- %HOMEPATH%\links\how to restore your files.txt
- %HOMEPATH%\saved games\how to restore your files.txt
- %HOMEPATH%\pictures\how to restore your files.txt
- %HOMEPATH%\searches\how to restore your files.txt
- %HOMEPATH%\videos\how to restore your files.txt
- D:\how to restore your files.txt
- %HOMEPATH%\favorites\links\how to restore your files.txt
- %HOMEPATH%\favorites\links for united states\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\minidumps\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions\how to restore your files.txt
- %APPDATA%\media center programs\how to restore your files.txt
- %APPDATA%\microsoft\how to restore your files.txt
- %APPDATA%\microsoft\credentials\how to restore your files.txt
- %APPDATA%\microsoft\crypto\how to restore your files.txt
- %APPDATA%\microsoft\crypto\rsa\how to restore your files.txt
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\how to restore your files.txt
- %APPDATA%\microsoft\protect\how to restore your files.txt
- %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\how to restore your files.txt
- %APPDATA%\microsoft\systemcertificates\my\how to restore your files.txt
- %APPDATA%\microsoft\systemcertificates\how to restore your files.txt
- %APPDATA%\microsoft\systemcertificates\my\certificates\how to restore your files.txt
- %APPDATA%\identities\{1bc91121-7903-48ee-bf78-1bc7ca4b5761}\how to restore your files.txt
- %APPDATA%\microsoft\systemcertificates\my\crls\how to restore your files.txt
- %APPDATA%\thunderbird\how to restore your files.txt
- %APPDATA%\thunderbird\crash reports\events\how to restore your files.txt
- %APPDATA%\thunderbird\pending pings\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\how to restore your files.txt
- %APPDATA%\thunderbird\crash reports\how to restore your files.txt
- %APPDATA%\telegram desktop\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\events\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\how to restore your files.txt
- %APPDATA%\microsoft\systemcertificates\my\ctls\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\20\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\2\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\media player\how to restore your files.txt
- C:\users\public\libraries\how to restore your files.txt
- C:\users\public\music\how to restore your files.txt
- C:\users\public\pictures\how to restore your files.txt
- C:\users\public\music\sample music\how to restore your files.txt
- C:\users\public\pictures\sample pictures\how to restore your files.txt
- C:\users\public\recorded tv\sample media\how to restore your files.txt
- C:\users\public\videos\how to restore your files.txt
- C:\users\public\videos\sample videos\how to restore your files.txt
- C:\users\public\recorded tv\how to restore your files.txt
- %HOMEPATH%\appdata\how to restore your files.txt
- C:\users\public\downloads\how to restore your files.txt
- C:\users\public\favorites\how to restore your files.txt
- %LOCALAPPDATA%\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\credentials\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds cache\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds\feeds for united states~\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds cache\15ivkcr3\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds cache\6fwa5ftw\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds cache\xwtafhng\how to restore your files.txt
- %HOMEPATH%\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\how to restore your files.txt
- C:\users\public\desktop\how to restore your files.txt
- C:\users\default\how to restore your files.txt
- C:\users\public\documents\how to restore your files.txt
- C:\how to restore your files.txt
- C:\msocache\how to restore your files.txt
- C:\perflogs\how to restore your files.txt
- C:\recovery\how to restore your files.txt
- C:\perflogs\admin\how to restore your files.txt
- C:\users\how to restore your files.txt
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\how to restore your files.txt
- C:\users\default\appdata\local\how to restore your files.txt
- C:\users\default\appdata\how to restore your files.txt
- C:\users\default\appdata\local\microsoft\how to restore your files.txt
- C:\users\default\appdata\local\temp\how to restore your files.txt
- C:\kms\how to restore your files.txt
- C:\users\default\appdata\roaming\media center programs\how to restore your files.txt
- C:\users\default\desktop\how to restore your files.txt
- C:\users\default\documents\how to restore your files.txt
- C:\users\default\appdata\roaming\how to restore your files.txt
- C:\users\default\downloads\how to restore your files.txt
- C:\users\default\favorites\how to restore your files.txt
- C:\users\default\links\how to restore your files.txt
- C:\users\default\music\how to restore your files.txt
- C:\users\default\pictures\how to restore your files.txt
- C:\users\default\saved games\how to restore your files.txt
- C:\users\default\videos\how to restore your files.txt
- C:\users\public\how to restore your files.txt
- C:\users\default\appdata\roaming\microsoft\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds cache\bbs9hw0e\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\media player\sync playlists\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\18\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\safebrowsing\google4\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\hmz1jddi.default\how to restore your files.txt
- %LOCALAPPDATA%low\how to restore your files.txt
- %LOCALAPPDATA%low\microsoft\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\startupcache\how to restore your files.txt
- %LOCALAPPDATA%low\oracle\how to restore your files.txt
- %LOCALAPPDATA%low\oracle\java\how to restore your files.txt
- %LOCALAPPDATA%low\oracle\java\au\how to restore your files.txt
- %LOCALAPPDATA%low\sun\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\safebrowsing\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\entries\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\0\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\10\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\11\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\12\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\13\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\14\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\15\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\16\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\17\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\doomed\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\office\groove\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\office\groove\system\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\office\groove\user\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows mail\backup\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows mail\backup\new\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows media\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows media\12.0\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows sidebar\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows mail\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows mail\stationery\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\office\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows sidebar\gadgets\how to restore your files.txt
- %LOCALAPPDATA%\programs\how to restore your files.txt
- %LOCALAPPDATA%\programs\common\how to restore your files.txt
- %TEMP%\hsperfdata_user\how to restore your files.txt
- %TEMP%\low\how to restore your files.txt
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_10.0.30319\how to restore your files.txt
- %TEMP%\microsoft .net framework 4 setup_4.0.30319\how to restore your files.txt
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\how to restore your files.txt
- %TEMP%\opera installer\how to restore your files.txt
- %TEMP%\wpdnse\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\how to restore your files.txt
- %LOCALAPPDATA%\microsoft help\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\19\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\how to restore your files.txt
Перемещает следующие файлы
- %TEMP%\adobesfx.log в %TEMP%\adobesfx.log.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite.babyk
- %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json в %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\parent.lock в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\parent.lock.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d.babyk
- %APPDATA%\thunderbird\crash reports\installtime20210406220621 в %APPDATA%\thunderbird\crash reports\installtime20210406220621.babyk
- %TEMP%\opera installer\opera_installer_20230912173243.log в %TEMP%\opera installer\opera_installer_20230912173243.log.babyk
- %TEMP%\opera installer\opera_installer_20230912173246.log в %TEMP%\opera installer\opera_installer_20230912173246.log.babyk
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47 в %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47.babyk
- %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\3e7a4b63-cd41-4806-916a-59fd454c04f2 в %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\3e7a4b63-cd41-4806-916a-59fd454c04f2.babyk
- %APPDATA%\microsoft\protect\credhist в %APPDATA%\microsoft\protect\credhist.babyk
- %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a в %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a.babyk
- %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred в %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred.babyk
- %APPDATA%\telegram desktop\telegram.exe в %APPDATA%\telegram desktop\telegram.exe.babyk
- %APPDATA%\telegram desktop\unins000.exe в %APPDATA%\telegram desktop\unins000.exe.babyk
- %APPDATA%\thunderbird\installs.ini в %APPDATA%\thunderbird\installs.ini.babyk
- %APPDATA%\thunderbird\profiles.ini в %APPDATA%\thunderbird\profiles.ini.babyk
- %APPDATA%\telegram desktop\updater.exe в %APPDATA%\telegram desktop\updater.exe.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4 в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c.babyk
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.babyk
Изменяет следующие файлы
- C:\kms\kms_vl_all_aio_debug.log.babyk
- C:\users\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv.babyk
- C:\users\public\videos\sample videos\wildlife.wmv.babyk
- C:\users\public\pictures\sample pictures\tulips.jpg.babyk
- C:\users\public\pictures\sample pictures\koala.jpg.babyk
- C:\users\public\pictures\sample pictures\penguins.jpg.babyk
- C:\users\public\pictures\sample pictures\lighthouse.jpg.babyk
- C:\users\public\pictures\sample pictures\jellyfish.jpg.babyk
- C:\users\public\pictures\sample pictures\hydrangeas.jpg.babyk
- C:\users\public\pictures\sample pictures\chrysanthemum.jpg.babyk
- C:\users\public\pictures\sample pictures\desert.jpg.babyk
- C:\users\public\music\sample music\sleep away.mp3.babyk
- C:\users\public\music\sample music\maid with the flaxen hair.mp3.babyk
- C:\users\public\music\sample music\kalimba.mp3.babyk
- C:\users\public\libraries\recordedtv.library-ms.babyk
- C:\users\public\desktop\steam.lnk.babyk
- C:\users\public\desktop\mozilla thunderbird.lnk.babyk
- C:\users\public\desktop\opera.lnk.babyk
- C:\users\public\desktop\firefox.lnk.babyk
- C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.babyk
- C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.babyk
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\winre.wim.babyk
- C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.babyk
- C:\users\public\desktop\acrobat reader dc.lnk.babyk
- C:\users\default\ntuser.dat.log2.babyk
- C:\users\default\ntuser.dat.log1.babyk
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\boot.sdi.babyk
- C:\kms\kms_vl_all_aio.cmd.babyk
- %LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\microsoft at home~.feed-ms.babyk
- %LOCALAPPDATA%\microsoft\feeds cache\15ivkcr3\fwlink[1].babyk
Изменяет множество файлов.
Самоперемещается
- из <Полный путь к файлу> в <Полный путь к файлу>.babyk
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet (со скрытым окном)
