Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие файлы на съемном носителе
- <Имя диска съемного носителя>:\middaugh_keynote.pptx
- <Имя диска съемного носителя>:\gruenspecht_02172016.pptx
- <Имя диска съемного носителя>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
- <Имя диска съемного носителя>:\roozenedowebinar.pptx
- <Имя диска съемного носителя>:\system volume information\wpsettings.dat
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\adadsi.html
- %APPDATA%\thunderbird\profiles.ini
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\prefs.js
- %HOMEPATH%\desktop\encrypted_files.txt
Перемещает следующие файлы
- %TEMP%\adobearm.log в %TEMP%\adobearm.log.crypted
- %APPDATA%\opera software\opera stable\history-journal в %APPDATA%\opera software\opera stable\history-journal.crypted
- %APPDATA%\opera software\opera stable\jump list icons\6f34.tmp в %APPDATA%\opera software\opera stable\jump list icons\6f34.tmp.crypted
- %APPDATA%\opera software\opera stable\jump list icons\6f35.tmp в %APPDATA%\opera software\opera stable\jump list icons\6f35.tmp.crypted
- %APPDATA%\opera software\opera stable\jump list icons\6f36.tmp в %APPDATA%\opera software\opera stable\jump list icons\6f36.tmp.crypted
- %APPDATA%\opera software\opera stable\jump list icons\6f37.tmp в %APPDATA%\opera software\opera stable\jump list icons\6f37.tmp.crypted
- %APPDATA%\opera software\opera stable\jump list icons\6f38.tmp в %APPDATA%\opera software\opera stable\jump list icons\6f38.tmp.crypted
- %APPDATA%\opera software\opera stable\jump list icons\6f58.tmp в %APPDATA%\opera software\opera stable\jump list icons\6f58.tmp.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\user.js в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\user.js.crypted
- %APPDATA%\opera software\opera stable\jump list icons\6f59.tmp в %APPDATA%\opera software\opera stable\jump list icons\6f59.tmp.crypted
- %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage в %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage.crypted
- %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage-journal в %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage-journal.crypted
- %APPDATA%\opera software\opera stable\login data в %APPDATA%\opera software\opera stable\login data.crypted
- %APPDATA%\opera software\opera stable\login data-journal в %APPDATA%\opera software\opera stable\login data-journal.crypted
- %APPDATA%\opera software\opera stable\network persistent state в %APPDATA%\opera software\opera stable\network persistent state.crypted
- %APPDATA%\opera software\opera stable\opera_autoupdate.log в %APPDATA%\opera software\opera stable\opera_autoupdate.log.crypted
- %APPDATA%\opera software\opera stable\preferences в %APPDATA%\opera software\opera stable\preferences.crypted
- %APPDATA%\opera software\opera stable\ssdfp3452.0.1677946767 в %APPDATA%\opera software\opera stable\ssdfp3452.0.1677946767.crypted
- %APPDATA%\opera software\opera stable\favicons в %APPDATA%\opera software\opera stable\favicons.crypted
- %APPDATA%\opera software\opera stable\local state в %APPDATA%\opera software\opera stable\local state.crypted
- %APPDATA%\opera software\opera stable\history в %APPDATA%\opera software\opera stable\history.crypted
- %APPDATA%\opera software\opera stable\favicons-journal в %APPDATA%\opera software\opera stable\favicons-journal.crypted
- %APPDATA%\opera software\opera stable\extension state\manifest-000001 в %APPDATA%\opera software\opera stable\extension state\manifest-000001.crypted
- %APPDATA%\opera software\opera stable\extension state\log в %APPDATA%\opera software\opera stable\extension state\log.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\.metadata-v2.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.crypted
- %APPDATA%\opera software\opera stable\ssdfp3452.6.1348684681 в %APPDATA%\opera software\opera stable\ssdfp3452.6.1348684681.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\times.json в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\times.json.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\upgrade.jsonlz4-20210823123856 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\upgrade.jsonlz4-20210823123856.crypted
- %APPDATA%\mozilla\firefox\profiles.ini в %APPDATA%\mozilla\firefox\profiles.ini.crypted
- %APPDATA%\opera software\opera stable\cookies в %APPDATA%\opera software\opera stable\cookies.crypted
- %APPDATA%\opera software\opera stable\cookies-journal в %APPDATA%\opera software\opera stable\cookies-journal.crypted
- %APPDATA%\opera software\opera stable\current session в %APPDATA%\opera software\opera stable\current session.crypted
- %APPDATA%\opera software\opera stable\d438.tmp в %APPDATA%\opera software\opera stable\d438.tmp.crypted
- %APPDATA%\opera software\opera stable\default_partner_content.json в %APPDATA%\opera software\opera stable\default_partner_content.json.crypted
- %APPDATA%\opera software\opera stable\extension state\000003.log в %APPDATA%\opera software\opera stable\extension state\000003.log.crypted
- %APPDATA%\opera software\opera stable\extension state\current в %APPDATA%\opera software\opera stable\extension state\current.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\shield-preference-experiments.json в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\shield-preference-experiments.json.crypted
- %APPDATA%\opera software\opera stable\extension state\lock в %APPDATA%\opera software\opera stable\extension state\lock.crypted
- %APPDATA%\opera software\opera stable\bookmarks в %APPDATA%\opera software\opera stable\bookmarks.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sitesecurityservicestate.txt.crypted
- %APPDATA%\opera software\opera stable\transportsecurity в %APPDATA%\opera software\opera stable\transportsecurity.crypted
- %APPDATA%\opera software\opera stable\web data-journal в %APPDATA%\opera software\opera stable\web data-journal.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\history.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\history.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\openpgp.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\openpgp.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\permissions.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\permissions.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\pkcs11.txt в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\pkcs11.txt.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\places.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\places.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\prefs.js в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\prefs.js.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\saved-telemetry-pings\7c60a762-ce1a-4213-a806-472d9b56a5d3 в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\saved-telemetry-pings\7c60a762-ce1a-4213-a806-472d9b56a5d3.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\saved-telemetry-pings\cfac4984-9ad3-4e2b-b0c2-a02f3ed65e98 в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\saved-telemetry-pings\cfac4984-9ad3-4e2b-b0c2-a02f3ed65e98.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\extensions.json в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\extensions.json.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\saved-telemetry-pings\e973cedb-0948-4fd0-8858-de529a873a0c в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\saved-telemetry-pings\e973cedb-0948-4fd0-8858-de529a873a0c.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\securitypreloadstate.txt в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\securitypreloadstate.txt.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\sessioncheckpoints.json в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\sessioncheckpoints.json.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\sitesecurityservicestate.txt в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\sitesecurityservicestate.txt.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage\permanent\chrome\.metadata-v2.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\times.json в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\times.json.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\webappsstore.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\webappsstore.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\formhistory.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\formhistory.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\global-messages-db.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\global-messages-db.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\favicons.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\favicons.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\extension-preferences.json в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\extension-preferences.json.crypted
- %TEMP%\wctebb3.tmp в %TEMP%\wctebb3.tmp.crypted
- %APPDATA%\thunderbird\crash reports\installtime20210406220621 в %APPDATA%\thunderbird\crash reports\installtime20210406220621.crypted
- %APPDATA%\thunderbird\installs.ini в %APPDATA%\thunderbird\installs.ini.crypted
- %APPDATA%\thunderbird\profiles\mt2yxlwj.default\times.json в %APPDATA%\thunderbird\profiles\mt2yxlwj.default\times.json.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\abook.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\abook.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\addons.json в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\addons.json.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\addonstartup.json.lz4 в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\addonstartup.json.lz4.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\alternateservices.txt в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\alternateservices.txt.crypted
- %APPDATA%\opera software\opera stable\update_prefs.json в %APPDATA%\opera software\opera stable\update_prefs.json.crypted
- %APPDATA%\opera software\opera stable\web data в %APPDATA%\opera software\opera stable\web data.crypted
- %APPDATA%\opera software\opera stable\visited links в %APPDATA%\opera software\opera stable\visited links.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\blist.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\blist.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\archived\2022-09\1664420269989.cfac4984-9ad3-4e2b-b0c2-a02f3ed65e98.new-profile.jsonlz4 в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\archived\2022-09\1664420269989.cfac4984-9ad3-4e2b-b0c2-a02f3ed65e98.new-profile.jsonlz4.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\archived\2022-09\1664420270572.7c60a762-ce1a-4213-a806-472d9b56a5d3.main.jsonlz4 в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\archived\2022-09\1664420270572.7c60a762-ce1a-4213-a806-472d9b56a5d3.main.jsonlz4.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\archived\2022-09\1664420270573.e973cedb-0948-4fd0-8858-de529a873a0c.first-shutdown.jsonlz4 в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\archived\2022-09\1664420270573.e973cedb-0948-4fd0-8858-de529a873a0c.first-shutdown.jsonlz4.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\session-state.json в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\session-state.json.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\state.json в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\state.json.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\directorytree.json в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\directorytree.json.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\enigmail.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\enigmail.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\compatibility.ini в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\compatibility.ini.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\cookies.sqlite в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\cookies.sqlite.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\crashes\store.json.mozlz4 в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\crashes\store.json.mozlz4.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\recovery.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\recovery.jsonlz4.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\recovery.baklz4 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\recovery.baklz4.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\previous.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\previous.jsonlz4.crypted
- %TEMP%\dd_vcredist_amd64_20220928192454.log в %TEMP%\dd_vcredist_amd64_20220928192454.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192236.log в %TEMP%\dd_vcredist_x86_20220928192236.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192236_0_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20220928192236_0_vcruntimeminimum_x86.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192236_1_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20220928192236_1_vcruntimeadditional_x86.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192307.log в %TEMP%\dd_vcredist_x86_20220928192307.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192307_0_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20220928192307_0_vcruntimeminimum_x86.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192307_1_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20220928192307_1_vcruntimeadditional_x86.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192338.log в %TEMP%\dd_vcredist_x86_20220928192338.log.crypted
- %TEMP%\javadeployreg.log в %TEMP%\javadeployreg.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192338_000_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20220928192338_000_vcruntimeminimum_x86.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192417.log в %TEMP%\dd_vcredist_x86_20220928192417.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192417_000_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20220928192417_000_vcruntimeminimum_x86.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192417_001_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20220928192417_001_vcruntimeadditional_x86.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192428.log в %TEMP%\dd_vcredist_x86_20220928192428.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192505.log в %TEMP%\dd_vcredist_x86_20220928192505.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192505_000_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20220928192505_000_vcruntimeminimum_x86.log.crypted
- %TEMP%\dd_vcredist_x86_20220928192505_001_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20220928192505_001_vcruntimeadditional_x86.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192439.log в %TEMP%\dd_vcredist_amd64_20220928192439.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192407.log в %TEMP%\dd_vcredist_amd64_20220928192407.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192439_001_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20220928192439_001_vcruntimeadditional_x64.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192354_001_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20220928192354_001_vcruntimeadditional_x64.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192354_000_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20220928192354_000_vcruntimeminimum_x64.log.crypted
- %TEMP%\adobesfx.log в %TEMP%\adobesfx.log.crypted
- %TEMP%\aria-debug-3984.log в %TEMP%\aria-debug-3984.log.crypted
- %TEMP%\aria-debug-4480.log в %TEMP%\aria-debug-4480.log.crypted
- %TEMP%\chrome_installer.log в %TEMP%\chrome_installer.log.crypted
- %TEMP%\content\4240-1672-powershell.exe-14-23-35-494.dump в %TEMP%\content\4240-1672-powershell.exe-14-23-35-494.dump.crypted
- %TEMP%\content\4240-1672-powershell.exe-14-23-35-567.dump в %TEMP%\content\4240-1672-powershell.exe-14-23-35-567.dump.crypted
- %TEMP%\dd_ndp462-kb3151800-x86-x64-allos-enu_decompression_log.txt в %TEMP%\dd_ndp462-kb3151800-x86-x64-allos-enu_decompression_log.txt.crypted
- %TEMP%\dd_vcredistmsi6d07.txt в %TEMP%\dd_vcredistmsi6d07.txt.crypted
- %TEMP%\dd_vcredist_x86_20220928192519.log в %TEMP%\dd_vcredist_x86_20220928192519.log.crypted
- %TEMP%\dd_vcredistui6d07.txt в %TEMP%\dd_vcredistui6d07.txt.crypted
- %TEMP%\dd_vcredist_x86_20220928192338_001_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20220928192338_001_vcruntimeadditional_x86.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192052_0_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20220928192052_0_vcruntimeminimum_x64.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192251.log в %TEMP%\dd_vcredist_amd64_20220928192251.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192251_0_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20220928192251_0_vcruntimeminimum_x64.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192251_1_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20220928192251_1_vcruntimeadditional_x64.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192323.log в %TEMP%\dd_vcredist_amd64_20220928192323.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192323_000_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20220928192323_000_vcruntimeminimum_x64.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192323_001_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20220928192323_001_vcruntimeadditional_x64.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192354.log в %TEMP%\dd_vcredist_amd64_20220928192354.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192052.log в %TEMP%\dd_vcredist_amd64_20220928192052.log.crypted
- %TEMP%\aria-debug-3752.log в %TEMP%\aria-debug-3752.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192052_1_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20220928192052_1_vcruntimeadditional_x64.log.crypted
- %TEMP%\dd_vcredist_amd64_20220928192439_000_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20220928192439_000_vcruntimeminimum_x64.log.crypted
- %TEMP%\jusched.log в %TEMP%\jusched.log.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273787.f30a84a1-1e03-4e9c-82d2-cc25a2de2285.event.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273787.f30a84a1-1e03-4e9c-82d2-cc25a2de2285.event.jsonlz4.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273890.ef50c0d6-c7b7-4b83-9eab-158d565b3460.first-shutdown.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273890.ef50c0d6-c7b7-4b83-9eab-158d565b3460.first-shutdown.jsonlz4.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\session-state.json в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\session-state.json.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\state.json в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\state.json.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\extension-preferences.json в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\extension-preferences.json.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\extensions.json в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\extensions.json.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\license.txt в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\license.txt.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273695.8f28423a-eb63-498c-b4cf-6b59560738b5.new-profile.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273695.8f28423a-eb63-498c-b4cf-6b59560738b5.new-profile.jsonlz4.crypted
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_191926081-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_191926081-msi_vc_red.msi.txt.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273885.4083ce93-ca4d-4a59-8edf-1582589874a7.main.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273885.4083ce93-ca4d-4a59-8edf-1582589874a7.main.jsonlz4.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\prefs.js в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\prefs.js.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\4083ce93-ca4d-4a59-8edf-1582589874a7 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\4083ce93-ca4d-4a59-8edf-1582589874a7.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\8f28423a-eb63-498c-b4cf-6b59560738b5 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\8f28423a-eb63-498c-b4cf-6b59560738b5.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\ef50c0d6-c7b7-4b83-9eab-158d565b3460 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\ef50c0d6-c7b7-4b83-9eab-158d565b3460.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\f30a84a1-1e03-4e9c-82d2-cc25a2de2285 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\f30a84a1-1e03-4e9c-82d2-cc25a2de2285.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\search.json.mozlz4 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\search.json.mozlz4.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessioncheckpoints.json в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessioncheckpoints.json.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\handlers.json в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\handlers.json.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\pkcs11.txt.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\search.json.mozlz4 в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\search.json.mozlz4.crypted
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\xulstore.json в %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\xulstore.json.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\compatibility.ini в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\compatibility.ini.crypted
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_192036284-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_192036284-msi_vc_red.msi.txt.crypted
- %TEMP%\opera installer\opera_installer_20220928193645.log в %TEMP%\opera installer\opera_installer_20220928193645.log.crypted
- %TEMP%\opera installer\opera_installer_20220928193650.log в %TEMP%\opera installer\opera_installer_20220928193650.log.crypted
- %TEMP%\opera installer\opera_installer_20220928193703.log в %TEMP%\opera installer\opera_installer_20220928193703.log.crypted
- %TEMP%\opera_crashreporter.log в %TEMP%\opera_crashreporter.log.crypted
- %TEMP%\setupexe(202209281941061420).log в %TEMP%\setupexe(202209281941061420).log.crypted
- %TEMP%\structuredquery.log в %TEMP%\structuredquery.log.crypted
- %TEMP%\tmp620.tmp в %TEMP%\tmp620.tmp.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\containers.json в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\containers.json.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\crashes\store.json.mozlz4 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\crashes\store.json.mozlz4.crypted
- %TEMP%\tmpf827.tmp в %TEMP%\tmpf827.tmp.crypted
- %APPDATA%\mozilla\firefox\crash reports\installtime20210823123856 в %APPDATA%\mozilla\firefox\crash reports\installtime20210823123856.crypted
- %APPDATA%\mozilla\firefox\installs.ini в %APPDATA%\mozilla\firefox\installs.ini.crypted
- %APPDATA%\mozilla\firefox\profiles\jkail15y.default\times.json в %APPDATA%\mozilla\firefox\profiles\jkail15y.default\times.json.crypted
- %APPDATA%\mozilla\firefox\profiles\jkail15y.default\user.js в %APPDATA%\mozilla\firefox\profiles\jkail15y.default\user.js.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\addons.json в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\addons.json.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\addonstartup.json.lz4 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\addonstartup.json.lz4.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\bookmarkbackups\bookmarks-2024-03-11_11_jdggz7aqnesichxf13zoqq==.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\bookmarkbackups\bookmarks-2024-03-11_11_jdggz7aqnesichxf13zoqq==.jsonlz4.crypted
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\broadcast-listeners.json в %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\broadcast-listeners.json.crypted
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_192019924-msi_vc_red.msi.txt в %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_192019924-msi_vc_red.msi.txt.crypted
- %TEMP%\wmsetup.log в %TEMP%\wmsetup.log.crypted
- %APPDATA%\thunderbird\profiles.ini в %APPDATA%\thunderbird\profiles.ini.crypted
Изменяет следующие файлы
- C:\kms\kms_vl_all_aio_debug.log
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.xml
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.xml
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.xml
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.xml
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.xml
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.xml
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
