Техническая информация
Вредоносные функции
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
- firefox.exe
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\494bf419e40d26ec80a426c8fc08f5e8_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
- %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.encrypting.map
- %ProgramFiles%\microsoft office\office14\samples\decryption_ids.txt
- %ProgramFiles%\microsoft office\office14\samples\how to recovery files.txt
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\sw5mb1bhdghxzwxjb21lsw1hz2uuanbn.encrypted
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\decryption_ids.txt
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\how to recovery files.txt
- %ProgramFiles%\microsoft office\office14\groove\toolbmps\tg9naw5eawfsb2dcywnrz3jvdw5klmpwzw==.encrypted
- %ProgramFiles%\microsoft office\office14\groove\toolbmps\decryption_ids.txt
- %ProgramFiles%\microsoft office\office14\groove\toolbmps\how to recovery files.txt
- %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\ufnsq0hmvfmurefu.encrypted
- %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\t1vurk9sts5eqvq=.encrypted
- %ProgramFiles%\microsoft office\office14\1033\actip10.hlp.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\decryption_ids.txt
- %ProgramFiles%\microsoft office\office14\1033\how to recovery files.txt
- %ProgramFiles%\microsoft office\office14\outlfltr.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\t0nssemurefu.encrypted
- %ProgramFiles%\microsoft office\office14\te9ps1vqlkrbva==.encrypted
- %ProgramFiles%\microsoft office\office14\engdic.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\how to recovery files.txt
- %ProgramFiles%\microsoft office\office14\decryption_ids.txt
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\how to recovery files.txt
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\decryption_ids.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\how to recovery files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\decryption_ids.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\how to recovery files.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\how to recovery files.txt
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njmuslbh.encrypted
- %ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\decryption_ids.txt
- %ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\how to recovery files.txt
- %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.encrypting.map
- %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\decryption_ids.txt
- %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\how to recovery files.txt
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\uegwmjgyououslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodczmzcuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mzguslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mjyuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi4mzyuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjaymjc1ntguslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjaxnzc4mdyuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjaxndkxmtguslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjaxndg3ntcuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjaxnduymtiuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjawotkxoteuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjawotkxnjyuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\decryption_ids.txt
- %ProgramFiles%\microsoft office\clipart\pub60cor\how to recovery files.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting.map
- %ProgramFiles%\java\jre1.8.0_45\lib\decryption_ids.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\how to recovery files.txt
- %ALLUSERSPROFILE%\key
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ndiuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ndquslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ndcuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq5mdauslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq4otuuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq4odguslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq4oduuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5nzauslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njkuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njcuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njyuslbh.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\decryption_ids.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\decryption_ids.txt
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njeuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntkuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntuuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntquslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntiuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntauslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\qwrvymvjrc5wzgy=.encrypted
Удаляет следующие файлы
- %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.encrypting.map
- %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin.encrypting.map
- %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat.encrypting.map
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.encrypting.map
- %ProgramFiles%\microsoft office\office14\1033\actip10.hlp.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting.map
- %ProgramFiles%\microsoft office\office14\engdic.dat.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg.encrypting.map
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg.encrypting.map
- %ProgramFiles%\microsoft office\office14\outlfltr.dat.encrypting.map
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin.encrypting.map
Перемещает следующие файлы
- %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat в %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one в %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one.encrypting
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.encrypting в %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\revtsudorviut05f.encrypted
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one в %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.encrypting
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one.encrypting в %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\qlvtsu5fu1mut05f.encrypted
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one в %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one.encrypting
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one.encrypting в %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\qkxbtksut05f.encrypted
- %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf в %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.encrypting
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one.encrypting в %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\uexbtk5fulmut05f.encrypted
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one в %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one.encrypting
- %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.encrypting в %ProgramFiles%\microsoft office\office14\samples\u09mvlnbtvauwext.encrypted
- %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls в %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.encrypting
- %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.encrypting в %ProgramFiles%\microsoft office\office14\1033\ufnsq0htuk4urefu.encrypted
- %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat в %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.encrypting
- %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.encrypting в %ProgramFiles%\microsoft office\office14\1033\ufnsq0hmrvgurefu.encrypted
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one в %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting
- %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.encrypting в %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\u3luy2hyb25pemf0aw9urxvsys5ydgy=.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\standardbusiness.pdf.encrypting в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\u3rhbmrhcmrcdxnpbmvzcy5wzgy=.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\words.pdf.encrypting в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\v29yzhmucgrm.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.encrypting в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\slncexrlq29kzvdpbi5iaw4=.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.encrypting
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin.encrypting в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\c25hchnob3rfymxvyi5iaw4=.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin.encrypting
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin.encrypting в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\bmf0axzlc19ibg9ilmjpbg==.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin.encrypting
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak.encrypting в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\y2vmxziwmf9wzxjjzw50lnbhaw==.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak.encrypting
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak.encrypting в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\y2vmxzewmf9wzxjjzw50lnbhaw==.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak.encrypting
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.encrypting в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\y2vmlnbhaw==.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.encrypting
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf.encrypting в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\uergu2lnuuzvcm1hbfjlcc5wzgy=.encrypted
- %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat в %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.encrypting
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one.encrypting в %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\qunbrevnsumut05f.encrypted
- %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat.encrypting в %ProgramFiles%\microsoft office\office14\1033\ufnsq0hlrvkurefu.encrypted
- %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat в %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat.encrypting
- %ProgramFiles%\microsoft office\office14\1033\actip10.hlp.encrypting в %ProgramFiles%\microsoft office\office14\1033\qunusvaxmc5itfa=.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ndguslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mzkuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mzeuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mzauslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mjcuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mjuuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting
- %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting в %ProgramFiles%\java\jre1.8.0_45\lib\dhpkyi5kyxq=.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg.encrypting в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\zwrpdf9wzgzfcg9zdgvymnguanbn.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.encrypting в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\mtq5ndg3memtotkxmi1dmtg0ltrdqzktqjqwms1bntngneq4reuyotaucgrm.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntguslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntcuslbh.encrypted
- %ProgramFiles%\microsoft office\office14\1033\actip10.hlp в %ProgramFiles%\microsoft office\office14\1033\actip10.hlp.encrypting
- %ProgramFiles%\microsoft office\office14\outlfltr.dat.encrypting в %ProgramFiles%\microsoft office\office14\t1vutezmvfiurefu.encrypted
- %ProgramFiles%\microsoft office\office14\outlfltr.dat в %ProgramFiles%\microsoft office\office14\outlfltr.dat.encrypting
- %ProgramFiles%\microsoft office\office14\engdic.dat.encrypting в %ProgramFiles%\microsoft office\office14\ru5hreldlkrbva==.encrypted
- %ProgramFiles%\microsoft office\office14\engdic.dat в %ProgramFiles%\microsoft office\office14\engdic.dat.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\uegwmta0nkouslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq4njiuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njguslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njuuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg в %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njiuslbh.encrypted
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting в %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njauslbh.encrypted
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\icu\icudt26l.dat.encrypting в %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\icu\awn1zhqynmwuzgf0.encrypted
Изменяет следующие файлы
- %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382959.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382955.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382954.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382952.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382950.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382947.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382944.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382942.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382938.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382926.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382836.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0227558.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0177806.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0149118.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0148757.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0145212.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099191.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099166.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382961.jpg
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting
Изменяет множество файлов.
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
