Trojan.Encoder.41291

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\Falconcy.sys] 'ImagePath' = '<Текущая директория>\Falconcy.sys'

Создает следующие сервисы

'Falconcy.sys' <Текущая директория>\Falconcy.sys

Модифицирует главную загрузочную запись (MBR).

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\13.jpg
%HOMEPATH%\desktop\2.jpg
%HOMEPATH%\desktop\210252809.jpeg
%HOMEPATH%\desktop\3.jpeg
%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\1189.jpg
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\iisstart.htm
%HOMEPATH%\desktop\pushkin.jpg
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\trivial-merge.html
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\1189.jpeg

Изменения в файловой системе

Создает следующие файлы

<Текущая директория>\falconcy.sys

Присваивает атрибут 'скрытый' для следующих файлов

<Полный путь к файлу>

Удаляет следующие файлы

%WINDIR%\bfsvc.exe
%WINDIR%\syswow64\dinput.dll
%WINDIR%\syswow64\dimsroam.dll
%WINDIR%\syswow64\dimsjob.dll
%WINDIR%\syswow64\difxapi.dll
%WINDIR%\syswow64\diantz.exe
%WINDIR%\syswow64\dialer.exe
%WINDIR%\syswow64\dhcpsapi.dll
%WINDIR%\syswow64\dhcpqec.dll
%WINDIR%\syswow64\dhcpcsvc6.dll
%WINDIR%\syswow64\dhcpcsvc.dll
%WINDIR%\syswow64\dhcpcore6.dll
%WINDIR%\syswow64\dhcpcore.dll
%WINDIR%\syswow64\dhcpcmonitor.dll
%WINDIR%\syswow64\dfsshlex.dll
%WINDIR%\syswow64\dfshim.dll
%WINDIR%\syswow64\dfscli.dll
%WINDIR%\syswow64\dfrgui.exe
%WINDIR%\syswow64\devrtl.dll
%WINDIR%\syswow64\devobj.dll
%WINDIR%\syswow64\devmgr.dll
%WINDIR%\syswow64\deviceuxres.dll
%WINDIR%\syswow64\deviceproperties.exe
%WINDIR%\syswow64\devicepairingwizard.exe
%WINDIR%\syswow64\devicepairingproxy.dll
%WINDIR%\syswow64\devicepairinghandler.dll
%WINDIR%\syswow64\devicepairingfolder.dll
%WINDIR%\syswow64\devicepairing.dll
%WINDIR%\syswow64\devicedisplaystatusmanager.dll
%WINDIR%\syswow64\devicemetadataparsers.dll
%WINDIR%\syswow64\dinput8.dll
%WINDIR%\syswow64\diskcopy.dll
%WINDIR%\syswow64\dnscacheugc.exe
%WINDIR%\syswow64\dnsapi.dll
%WINDIR%\syswow64\dmvdsitf.dll
%WINDIR%\syswow64\dmutil.dll
%WINDIR%\syswow64\dmusic.dll
%WINDIR%\syswow64\dmsynth.dll
%WINDIR%\syswow64\dmstyle.dll
%WINDIR%\syswow64\dmscript.dll
%WINDIR%\syswow64\dmrc.dll
%WINDIR%\syswow64\dmocx.dll
%WINDIR%\syswow64\dmloader.dll
%WINDIR%\syswow64\dmintf.dll
%WINDIR%\syswow64\dmime.dll
%WINDIR%\syswow64\dmdskres.dll
%WINDIR%\syswow64\dbghelp.dll
%WINDIR%\syswow64\dmdskmgr.dll
%WINDIR%\syswow64\dmdlgs.dll
%WINDIR%\syswow64\dmcompos.dll
%WINDIR%\syswow64\dmband.dll
%WINDIR%\syswow64\dllhst3g.exe
%WINDIR%\syswow64\dllhost.exe
%WINDIR%\syswow64\displayswitch.exe
%WINDIR%\syswow64\display.dll
%WINDIR%\syswow64\dispex.dll
%WINDIR%\syswow64\dism.exe
%WINDIR%\syswow64\diskraid.exe
%WINDIR%\syswow64\diskperf.exe
%WINDIR%\syswow64\diskpart.exe
%WINDIR%\syswow64\devicecenter.dll
%WINDIR%\syswow64\devenum.dll
%WINDIR%\syswow64\deskperf.dll
%WINDIR%\syswow64\d2d1.dll
%WINDIR%\syswow64\c_iscii.dll
%WINDIR%\syswow64\c_is2022.dll
%WINDIR%\syswow64\c_g18030.dll
%WINDIR%\syswow64\cttunesvr.exe
%WINDIR%\syswow64\cttune.exe
%WINDIR%\syswow64\ctl3d32.dll
%WINDIR%\syswow64\ctfmon.exe
%WINDIR%\syswow64\cscript.exe
%WINDIR%\syswow64\cscobj.dll
%WINDIR%\syswow64\cscdll.dll
%WINDIR%\syswow64\cscapi.dll
%WINDIR%\syswow64\cryptxml.dll
%WINDIR%\syswow64\cryptui.dll
%WINDIR%\syswow64\cryptsvc.dll
%WINDIR%\syswow64\cryptsp.dll
%WINDIR%\syswow64\cryptnet.dll
%WINDIR%\syswow64\cryptext.dll
%WINDIR%\syswow64\cryptdll.dll
%WINDIR%\syswow64\cryptdlg.dll
%WINDIR%\syswow64\cryptbase.dll
%WINDIR%\syswow64\crypt32.dll
%WINDIR%\syswow64\crtdll.dll
%WINDIR%\syswow64\credwiz.exe
%WINDIR%\syswow64\credui.dll
%WINDIR%\syswow64\credssp.dll
%WINDIR%\syswow64\d3d10core.dll
%WINDIR%\syswow64\d3d10level9.dll
%WINDIR%\syswow64\d3d10.dll
%WINDIR%\syswow64\d3d10warp.dll
%WINDIR%\syswow64\deskmon.dll
%WINDIR%\syswow64\d3d10_1.dll
%WINDIR%\syswow64\deskadp.dll
%WINDIR%\syswow64\defaultlocationcpl.dll
%WINDIR%\syswow64\ddrawex.dll
%WINDIR%\syswow64\ddraw.dll
%WINDIR%\syswow64\ddores.dll
%WINDIR%\syswow64\ddoiproxy.dll
%WINDIR%\syswow64\ddodiag.exe
%WINDIR%\syswow64\ddaclsys.dll
%WINDIR%\syswow64\dcomcnfg.exe
%WINDIR%\syswow64\dciman32.dll
%WINDIR%\syswow64\dccw.exe
%WINDIR%\syswow64\dbnmpntw.dll
%WINDIR%\syswow64\dmdskres2.dll
%WINDIR%\syswow64\dnscmmc.dll
%WINDIR%\syswow64\dbgeng.dll
%WINDIR%\syswow64\davhlpr.dll
%WINDIR%\syswow64\davclnt.dll
%WINDIR%\syswow64\dataclen.dll
%WINDIR%\syswow64\d3dxof.dll
%WINDIR%\syswow64\d3dramp.dll
%WINDIR%\syswow64\d3dim700.dll
%WINDIR%\syswow64\d3dim.dll
%WINDIR%\syswow64\d3d9.dll
%WINDIR%\syswow64\d3d8thk.dll
%WINDIR%\syswow64\d3d8.dll
%WINDIR%\syswow64\d3d11.dll
%WINDIR%\syswow64\d3d10_1core.dll
%WINDIR%\syswow64\dbnetlib.dll
%WINDIR%\syswow64\dswave.dll
%WINDIR%\syswow64\fltmc.exe
%WINDIR%\syswow64\dot3api.dll
%WINDIR%\syswow64\eventcreate.exe
%WINDIR%\syswow64\eventcls.dll
%WINDIR%\syswow64\eudcedit.exe
%WINDIR%\syswow64\esentutl.exe
%WINDIR%\syswow64\esentprf.dll
%WINDIR%\syswow64\esent.dll
%WINDIR%\syswow64\es.dll
%WINDIR%\syswow64\eqossnap.dll
%WINDIR%\syswow64\encdec.dll
%WINDIR%\syswow64\encapi.dll
%WINDIR%\syswow64\elstrans.dll
%WINDIR%\syswow64\elslad.dll
%WINDIR%\syswow64\elscore.dll
%WINDIR%\syswow64\els.dll
%WINDIR%\syswow64\ehstorshell.dll
%WINDIR%\syswow64\ehstorpwdmgr.dll
%WINDIR%\syswow64\ehstorauthn.exe
%WINDIR%\syswow64\ehstorapi.dll
%WINDIR%\syswow64\efsutil.dll
%WINDIR%\syswow64\efsui.exe
%WINDIR%\syswow64\efscore.dll
%WINDIR%\syswow64\efsadu.dll
%WINDIR%\syswow64\eapqec.dll
%WINDIR%\syswow64\eappprxy.dll
%WINDIR%\syswow64\eapphost.dll
%WINDIR%\syswow64\eappgnui.dll
%WINDIR%\syswow64\eappcfg.dll
%WINDIR%\syswow64\dxva2.dll
%WINDIR%\syswow64\eapp3hst.dll
%WINDIR%\syswow64\eventvwr.exe
%WINDIR%\syswow64\evr.dll
%WINDIR%\syswow64\fltlib.dll
%WINDIR%\syswow64\fixmapi.exe
%WINDIR%\syswow64\firewallcontrolpanel.dll
%WINDIR%\syswow64\firewallapi.dll
%WINDIR%\syswow64\finger.exe
%WINDIR%\syswow64\findstr.exe
%WINDIR%\syswow64\findnetprinters.dll
%WINDIR%\syswow64\find.exe
%WINDIR%\syswow64\filemgmt.dll
%WINDIR%\syswow64\feclient.dll
%WINDIR%\syswow64\fdwsd.dll
%WINDIR%\syswow64\fdwnet.dll
%WINDIR%\syswow64\fdwcn.dll
%WINDIR%\syswow64\fdproxy.dll
%WINDIR%\syswow64\docprop.dll
%WINDIR%\syswow64\fdpnp.dll
%WINDIR%\syswow64\fdeploy.dll
%WINDIR%\syswow64\fde.dll
%WINDIR%\syswow64\fdbthproxy.dll
%WINDIR%\syswow64\fdbth.dll
%WINDIR%\syswow64\fc.exe
%WINDIR%\syswow64\faultrep.dll
%WINDIR%\syswow64\f3ahvoas.dll
%WINDIR%\syswow64\extrac32.exe
%WINDIR%\syswow64\expsrv.dll
%WINDIR%\syswow64\explorerframe.dll
%WINDIR%\syswow64\explorer.exe
%WINDIR%\syswow64\expand.exe
%WINDIR%\syswow64\dxtrans.dll
%WINDIR%\syswow64\dxtmsft.dll
%WINDIR%\syswow64\dxptasksync.dll
%WINDIR%\syswow64\drprov.dll
%WINDIR%\syswow64\drmv2clt.dll
%WINDIR%\syswow64\drmmgrtn.dll
%WINDIR%\syswow64\driverquery.exe
%WINDIR%\syswow64\dpx.dll
%WINDIR%\syswow64\dpwsockx.dll
%WINDIR%\syswow64\dpnsvr.exe
%WINDIR%\syswow64\dpnlobby.dll
%WINDIR%\syswow64\dpnhupnp.dll
%WINDIR%\syswow64\dpnhpast.dll
%WINDIR%\syswow64\dpnet.dll
%WINDIR%\syswow64\dpnathlp.dll
%WINDIR%\syswow64\dpnaddr.dll
%WINDIR%\syswow64\dpmodemx.dll
%WINDIR%\syswow64\dplayx.dll
%WINDIR%\syswow64\dplaysvr.exe
%WINDIR%\syswow64\dpiscaling.exe
%WINDIR%\syswow64\dpapiprovider.dll
%WINDIR%\syswow64\dpapimig.exe
%WINDIR%\syswow64\dot3ui.dll
%WINDIR%\syswow64\dot3msm.dll
%WINDIR%\syswow64\dot3hc.dll
%WINDIR%\syswow64\dot3gpui.dll
%WINDIR%\syswow64\dot3gpclnt.dll
%WINDIR%\syswow64\dot3dlg.dll
%WINDIR%\syswow64\dot3cfg.dll
%WINDIR%\syswow64\drtprov.dll
%WINDIR%\syswow64\drttransport.dll
%WINDIR%\syswow64\drt.dll
%WINDIR%\syswow64\drvinst.exe
%WINDIR%\syswow64\dxptaskringtone.dll
%WINDIR%\syswow64\drvstore.dll
%WINDIR%\syswow64\dxmasf.dll
%WINDIR%\syswow64\dxgi.dll
%WINDIR%\syswow64\dxdiagn.dll
%WINDIR%\syswow64\dxdiag.exe
%WINDIR%\syswow64\dwwin.exe
%WINDIR%\syswow64\dwrite.dll
%WINDIR%\syswow64\dwmcore.dll
%WINDIR%\syswow64\dwmapi.dll
%WINDIR%\syswow64\dvdupgrd.exe
%WINDIR%\syswow64\dvdplay.exe
%WINDIR%\syswow64\duser.dll
%WINDIR%\syswow64\dui70.dll
%WINDIR%\syswow64\cpfilters.dll
%WINDIR%\syswow64\doskey.exe
%WINDIR%\syswow64\dsuiext.dll
%WINDIR%\syswow64\dssenh.dll
%WINDIR%\syswow64\dssec.dll
%WINDIR%\syswow64\dsrole.dll
%WINDIR%\syswow64\dsquery.dll
%WINDIR%\syswow64\dsprop.dll
%WINDIR%\syswow64\dsound.dll
%WINDIR%\syswow64\dskquoui.dll
%WINDIR%\syswow64\dskquota.dll
%WINDIR%\syswow64\dshowrdpfilter.dll
%WINDIR%\syswow64\dsdmo.dll
%WINDIR%\syswow64\dsauth.dll
%WINDIR%\syswow64\ds32gt.dll
%WINDIR%\syswow64\dtsh.dll
%WINDIR%\syswow64\fdssdp.dll
%WINDIR%\syswow64\corpol.dll
%WINDIR%\syswow64\comp.exe
%WINDIR%\syswow64\api-ms-win-security-base-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-eventing-provider-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-utility-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-time-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-string-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-stdio-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-runtime-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-process-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-private-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-multibyte-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-math-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-locale-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-heap-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-filesystem-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-environment-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-convert-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-crt-conio-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-xstate-l2-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-xstate-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-util-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-timezone-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-threadpool-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-sysinfo-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-synch-l1-2-0.dll
%WINDIR%\syswow64\api-ms-win-core-synch-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-string-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-rtlsupport-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-processthreads-l1-1-1.dll
%WINDIR%\syswow64\api-ms-win-core-profile-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-security-lsalookup-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-security-sddl-l1-1-0.dll
%WINDIR%\syswow64\audioeng.dll
%WINDIR%\syswow64\audiodev.dll
%WINDIR%\syswow64\attrib.exe
%WINDIR%\syswow64\atmlib.dll
%WINDIR%\syswow64\atmfd.dll
%WINDIR%\syswow64\atl110.dll
%WINDIR%\syswow64\atl100.dll
%WINDIR%\syswow64\atl.dll
%WINDIR%\syswow64\atbroker.exe
%WINDIR%\syswow64\at.exe
%WINDIR%\syswow64\asycfilt.dll
%WINDIR%\syswow64\aspnet_counters.dll
%WINDIR%\syswow64\asferror.dll
%WINDIR%\syswow64\apss.dll
%WINDIR%\syswow64\api-ms-win-core-errorhandling-l1-1-0.dll
%WINDIR%\syswow64\appmgr.dll
%WINDIR%\syswow64\appmgmts.dll
%WINDIR%\syswow64\appidpolicyengineapi.dll
%WINDIR%\syswow64\appidapi.dll
%WINDIR%\syswow64\apphlpdm.dll
%WINDIR%\syswow64\apphelp.dll
%WINDIR%\syswow64\apisetschema.dll
%WINDIR%\syswow64\apircl.dll
%WINDIR%\syswow64\apilogen.dll
%WINDIR%\syswow64\api-ms-win-service-winsvc-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-service-management-l2-1-0.dll
%WINDIR%\syswow64\api-ms-win-service-management-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-service-core-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-processthreads-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-processenvironment-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-namedpipe-l1-1-0.dll
%WINDIR%\syswow64\admtmpl.dll
%WINDIR%\syswow64\admparse.dll
%WINDIR%\syswow64\adaptertroubleshooter.exe
%WINDIR%\syswow64\actxprxy.dll
%WINDIR%\syswow64\activeds.dll
%WINDIR%\syswow64\actioncentercpl.dll
%WINDIR%\syswow64\actioncenter.dll
%WINDIR%\syswow64\acppage.dll
%WINDIR%\syswow64\aclui.dll
%WINDIR%\syswow64\acledit.dll
%WINDIR%\syswow64\acctres.dll
%WINDIR%\syswow64\accessibilitycpl.dll
%WINDIR%\syswow64\aaclient.dll
%WINDIR%\write.exe
%WINDIR%\winhlp32.exe
%WINDIR%\twunk_32.exe
%WINDIR%\twunk_16.exe
%WINDIR%\twain_32.dll
%WINDIR%\twain.dll
%WINDIR%\splwow64.exe
%WINDIR%\regedit.exe
%WINDIR%\notepad.exe
%WINDIR%\hh.exe
%WINDIR%\helppane.exe
%WINDIR%\fveupdate.exe
%WINDIR%\explorer.exe
%WINDIR%\syswow64\adsldp.dll
%WINDIR%\syswow64\adsldpc.dll
%WINDIR%\syswow64\adprovider.dll
%WINDIR%\syswow64\adsmsext.dll
%WINDIR%\syswow64\api-ms-win-core-misc-l1-1-0.dll
%WINDIR%\syswow64\adsnt.dll
%WINDIR%\syswow64\api-ms-win-core-memory-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-localregistry-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-localization-l1-2-0.dll
%WINDIR%\syswow64\api-ms-win-core-localization-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-libraryloader-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-io-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-interlocked-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-heap-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-handle-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-file-l2-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-file-l1-2-0.dll
%WINDIR%\syswow64\api-ms-win-core-file-l1-1-0.dll
%WINDIR%\syswow64\arp.exe
%WINDIR%\syswow64\audiokse.dll
%WINDIR%\syswow64\api-ms-win-core-delayload-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-debug-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-datetime-l1-1-0.dll
%WINDIR%\syswow64\api-ms-win-core-console-l1-1-0.dll
%WINDIR%\syswow64\apds.dll
%WINDIR%\syswow64\amxread.dll
%WINDIR%\syswow64\amstream.dll
%WINDIR%\syswow64\alttab.dll
%WINDIR%\syswow64\aeevts.dll
%WINDIR%\syswow64\aecache.dll
%WINDIR%\syswow64\advpack.dll
%WINDIR%\syswow64\advapi32.dll
%WINDIR%\syswow64\adtschema.dll
%WINDIR%\syswow64\api-ms-win-core-fibers-l1-1-0.dll
%WINDIR%\syswow64\cacls.exe
%WINDIR%\syswow64\control.exe
%WINDIR%\syswow64\auditpol.exe
%WINDIR%\syswow64\cmipnpinstall.dll
%WINDIR%\syswow64\cmifw.dll
%WINDIR%\syswow64\cmicryptinstall.dll
%WINDIR%\syswow64\cmdl32.exe
%WINDIR%\syswow64\cmdkey.exe
%WINDIR%\syswow64\cmdial32.dll
%WINDIR%\syswow64\cmd.exe
%WINDIR%\syswow64\cmcfg32.dll
%WINDIR%\syswow64\clusapi.dll
%WINDIR%\syswow64\clip.exe
%WINDIR%\syswow64\cliconfg.exe
%WINDIR%\syswow64\cliconfg.dll
%WINDIR%\syswow64\clfsw32.dll
%WINDIR%\syswow64\cleanmgr.exe
%WINDIR%\syswow64\clbcatq.dll
%WINDIR%\syswow64\clb.dll
%WINDIR%\syswow64\cipher.exe
%WINDIR%\syswow64\cic.dll
%WINDIR%\syswow64\chxreadingstringime.dll
%WINDIR%\syswow64\chtbrkr.dll
%WINDIR%\syswow64\chsbrkr.dll
%WINDIR%\syswow64\choice.exe
%WINDIR%\syswow64\chkntfs.exe
%WINDIR%\syswow64\chkdsk.exe
%WINDIR%\syswow64\charmap.exe
%WINDIR%\syswow64\cfgmgr32.dll
%WINDIR%\syswow64\cfgbkend.dll
%WINDIR%\syswow64\certutil.exe
%WINDIR%\syswow64\cewmdm.dll
%WINDIR%\syswow64\cmlua.dll
%WINDIR%\syswow64\cmmon32.exe
%WINDIR%\syswow64\console.dll
%WINDIR%\syswow64\connect.dll
%WINDIR%\syswow64\concrt140d.dll
%WINDIR%\syswow64\concrt140.dll
%WINDIR%\syswow64\comuid.dll
%WINDIR%\syswow64\comsvcs.dll
%WINDIR%\syswow64\comsnap.dll
%WINDIR%\syswow64\comres.dll
%WINDIR%\syswow64\comrepl.dll
%WINDIR%\syswow64\computerdefaults.exe
%WINDIR%\syswow64\compstui.dll
%WINDIR%\syswow64\compobj.dll
%WINDIR%\syswow64\compact.exe
%WINDIR%\syswow64\comdlg32.dll
%WINDIR%\syswow64\audioses.dll
%WINDIR%\syswow64\comctl32.dll
%WINDIR%\syswow64\comcat.dll
%WINDIR%\syswow64\colorui.dll
%WINDIR%\syswow64\colorcpl.exe
%WINDIR%\syswow64\colorcnv.dll
%WINDIR%\syswow64\colbact.dll
%WINDIR%\syswow64\cnvfat.dll
%WINDIR%\syswow64\cngprovider.dll
%WINDIR%\syswow64\cngaudit.dll
%WINDIR%\syswow64\cmutil.dll
%WINDIR%\syswow64\cmstplua.dll
%WINDIR%\syswow64\cmstp.exe
%WINDIR%\syswow64\cmpbk32.dll
%WINDIR%\syswow64\certreq.exe
%WINDIR%\syswow64\certpoleng.dll
%WINDIR%\syswow64\certmgr.dll
%WINDIR%\syswow64\biocredprov.dll
%WINDIR%\syswow64\bidispl.dll
%WINDIR%\syswow64\bcryptprimitives.dll
%WINDIR%\syswow64\bcrypt.dll
%WINDIR%\syswow64\batmeter.dll
%WINDIR%\syswow64\basecsp.dll
%WINDIR%\syswow64\azsqlext.dll
%WINDIR%\syswow64\azroleui.dll
%WINDIR%\syswow64\azroles.dll
%WINDIR%\syswow64\avrt.dll
%WINDIR%\syswow64\avifil32.dll
%WINDIR%\syswow64\avicap32.dll
%WINDIR%\syswow64\auxiliarydisplaycpl.dll
%WINDIR%\syswow64\auxiliarydisplayapi.dll
%WINDIR%\syswow64\autoplay.dll
%WINDIR%\syswow64\autofmt.exe
%WINDIR%\syswow64\autoconv.exe
%WINDIR%\syswow64\autochk.exe
%WINDIR%\syswow64\authz.dll
%WINDIR%\syswow64\authui.dll
%WINDIR%\syswow64\authfwwizfwk.dll
%WINDIR%\syswow64\authfwsnapin.dll
%WINDIR%\syswow64\authfwgp.dll
%WINDIR%\syswow64\authfwcfg.dll
%WINDIR%\syswow64\auditpolmsg.dll
%WINDIR%\syswow64\auditpolicygpinterop.dll
%WINDIR%\syswow64\bitsperf.dll
%WINDIR%\syswow64\bitsprx2.dll
%WINDIR%\syswow64\bitsadmin.exe
%WINDIR%\syswow64\bitsprx3.dll
%WINDIR%\syswow64\certenrollui.dll
%WINDIR%\syswow64\bitsprx4.dll
%WINDIR%\syswow64\certenrollctrl.exe
%WINDIR%\syswow64\certenroll.dll
%WINDIR%\syswow64\certenc.dll
%WINDIR%\syswow64\certcredprovider.dll
%WINDIR%\syswow64\certcli.dll
%WINDIR%\syswow64\cdosys.dll
%WINDIR%\syswow64\cca.dll
%WINDIR%\syswow64\catsrvut.dll
%WINDIR%\syswow64\catsrvps.dll
%WINDIR%\syswow64\catsrv.dll
%WINDIR%\syswow64\capisp.dll
%WINDIR%\syswow64\capiprovider.dll
%WINDIR%\syswow64\convert.exe
%WINDIR%\syswow64\auditnativesnapin.dll
%WINDIR%\syswow64\cabview.dll
%WINDIR%\syswow64\cabinet.dll
%WINDIR%\syswow64\bwunpairelevated.dll
%WINDIR%\syswow64\bwcontexthandler.dll
%WINDIR%\syswow64\btpanui.dll
%WINDIR%\syswow64\bthudtask.exe
%WINDIR%\syswow64\browseui.dll
%WINDIR%\syswow64\browcli.dll
%WINDIR%\syswow64\bootvid.dll
%WINDIR%\syswow64\bootcfg.exe
%WINDIR%\syswow64\blackbox.dll
%WINDIR%\syswow64\bitsprx6.dll
%WINDIR%\syswow64\bitsprx5.dll
%WINDIR%\syswow64\calc.exe
%WINDIR%\syswow64\fmifs.dll

Изменяет следующие файлы

%HOMEPATH%\desktop\tree_view.htm
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.bak
%LOCALAPPDATA%\microsoft\media player\currentdatabase_372.wmdb
%LOCALAPPDATA%\microsoft\windows mail\stationery\connectivity.gif
%LOCALAPPDATA%\microsoft\media player\localmls_3.wmdb
C:\users\public\music\sample music\maid with the flaxen hair.mp3
%LOCALAPPDATA%\microsoft\windows mail\stationery\tiki.gif
%LOCALAPPDATA%\microsoft\windows mail\stationery\stucco.gif
C:\users\public\music\sample music\sleep away.mp3
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt
%LOCALAPPDATA%\microsoft\windows mail\stationery\wrinkled_paper.gif
%APPDATA%\microsoft\uproof\custom.dic
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt
%HOMEPATH%\desktop\pushkin.jpg
%HOMEPATH%\desktop\iisstart.htm
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\trivial-merge.html
%LOCALAPPDATA%\microsoft\windows mail\stationery\cave_drawings.gif
C:\users\public\music\sample music\kalimba.mp3

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Другое

Запускает на исполнение

'<SYSTEM32>\sc.exe' create Falconcy.sys binPath= "<Текущая директория>\Falconcy.sys" type= kernel (со скрытым окном)
'<SYSTEM32>\sc.exe' start Falconcy.sys (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней