Trojan.Encoder.41464

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XPSUDTARW' = '"<Полный путь к файлу>"'

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\decryptfiles.txt
%APPDATA%\microsoft\word\startup\decryptfiles.txt

Вредоносные функции

Для затруднения выявления своего присутствия в системе

удаляет теневые копии разделов.

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\toolbar.bmp
%APPDATA%\mozilla\firefox\profiles.ini
%APPDATA%\thunderbird\profiles.ini

Изменения в файловой системе

Создает следующие файлы

%TEMP%\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt.xipt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite-wal.dfte
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\events\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite-wal.vtad
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\parent.lock.epnl
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\security_state\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt.fooy
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.fil...
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\minidumps\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\decryptfiles.txt
%APPDATA%\microsoft\windows\sendto\documents.mydocs.iwgd
%APPDATA%\microsoft\windows\sendto\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\accessories\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\administrative tools\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\google chrome\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\maintenance\decryptfiles.txt
%APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.imrb
%APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.dvks
%APPDATA%\mozilla\firefox\crash reports\events\decryptfiles.txt
%APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.gdqt
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\winrar\decryptfiles.txt
%APPDATA%\microsoft\windows\templates\decryptfiles.txt
%APPDATA%\microsoft\windows\themes\decryptfiles.txt
%APPDATA%\microsoft\word\decryptfiles.txt
%APPDATA%\mozilla\decryptfiles.txt
%APPDATA%\mozilla\extensions\decryptfiles.txt
%APPDATA%\mozilla\firefox\decryptfiles.txt
%APPDATA%\mozilla\firefox\crash reports\decryptfiles.txt
%APPDATA%\mozilla\firefox\pending pings\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt.wnic
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\default\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt.zhuh
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\decryptfiles.txt
%HOMEPATH%\contacts\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\decryptfiles.txt
%HOMEPATH%\documents\decryptfiles.txt
%HOMEPATH%\favorites\links\decryptfiles.txt
%HOMEPATH%\favorites\links for united states\decryptfiles.txt
%HOMEPATH%\favorites\microsoft websites\decryptfiles.txt
%HOMEPATH%\favorites\msn websites\decryptfiles.txt
%HOMEPATH%\favorites\windows live\decryptfiles.txt
%HOMEPATH%\links\decryptfiles.txt
%HOMEPATH%\ntuser.dat.log1.jujz
%HOMEPATH%\ntuser.dat.log2.muxe
%HOMEPATH%\saved games\decryptfiles.txt
%HOMEPATH%\downloads\decryptfiles.txt
%HOMEPATH%\favorites\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\parent.lock.mzhb
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\minidumps\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt.rdon
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite-wal.imsu
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\decryptfiles.txt
%APPDATA%\mozilla\systemextensionsdev\decryptfiles.txt
%APPDATA%\telegram desktop\decryptfiles.txt
%APPDATA%\thunderbird\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decryptfiles.txt
%APPDATA%\thunderbird\crash reports\decryptfiles.txt
%APPDATA%\thunderbird\pending pings\decryptfiles.txt
%APPDATA%\thunderbird\profiles\decryptfiles.txt
%APPDATA%\thunderbird\profiles\dm02c46v.default\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt.zpmt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\events\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\decryptfiles.txt
%APPDATA%\thunderbird\crash reports\events\decryptfiles.txt
%APPDATA%\microsoft\windows\recent\customdestinations\decryptfiles.txt
%HOMEPATH%\searches\decryptfiles.txt
%APPDATA%\microsoft\windows\recent\automaticdestinations\decryptfiles.txt
%APPDATA%\microsoft\windows\privacie\low\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink.fjcr
C:\users\default\appdata\roaming\microsoft\windows\start menu\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail.htdk
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\templates\decryptfiles.txt
C:\users\default\desktop\decryptfiles.txt
C:\users\default\documents\my music\decryptfiles.txt
C:\users\public\documents\my music\decryptfiles.txt
C:\users\default\documents\my pictures\decryptfiles.txt
C:\users\default\documents\my videos\decryptfiles.txt
C:\users\default\downloads\decryptfiles.txt
C:\users\default\favorites\decryptfiles.txt
C:\users\default\links\decryptfiles.txt
C:\users\default\ntuser.dat.log2.edpv
C:\users\default\saved games\decryptfiles.txt
C:\users\public\decryptfiles.txt
C:\users\public\desktop\decryptfiles.txt
C:\users\public\documents\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.hong
C:\users\default\documents\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\decryptfiles.txt
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\decryptfiles.txt
%HOMEPATH%\desktop\decryptfiles.txt
%HOMEPATH%\documents\my music\decryptfiles.txt
%HOMEPATH%\documents\my pictures\decryptfiles.txt
%HOMEPATH%\documents\my videos\decryptfiles.txt
C:\kms\decryptfiles.txt
<Текущая директория>\decryptfiles.txt
C:\msocache\decryptfiles.txt
C:\perflogs\decryptfiles.txt
C:\perflogs\admin\decryptfiles.txt
C:\recovery\decryptfiles.txt
C:\users\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\decryptfiles.txt
C:\users\default\decryptfiles.txt
C:\users\default\appdata\decryptfiles.txt
C:\users\default\appdata\roaming\decryptfiles.txt
C:\users\default\appdata\roaming\media center programs\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\cookies\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\recent\decryptfiles.txt
C:\users\public\documents\my pictures\decryptfiles.txt
C:\users\public\documents\my videos\decryptfiles.txt
C:\users\public\downloads\decryptfiles.txt
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.nzja
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\decryptfiles.txt
%APPDATA%\microsoft\systemcertificates\decryptfiles.txt
%APPDATA%\microsoft\systemcertificates\my\decryptfiles.txt
%APPDATA%\microsoft\systemcertificates\my\certificates\decryptfiles.txt
%APPDATA%\microsoft\systemcertificates\my\crls\decryptfiles.txt
%APPDATA%\microsoft\systemcertificates\my\ctls\decryptfiles.txt
%APPDATA%\microsoft\templates\decryptfiles.txt
%APPDATA%\microsoft\uproof\decryptfiles.txt
%APPDATA%\microsoft\proof\decryptfiles.txt
%APPDATA%\microsoft\protect\decryptfiles.txt
%APPDATA%\microsoft\windows\decryptfiles.txt
%APPDATA%\microsoft\windows\iecompatcache\decryptfiles.txt
%APPDATA%\microsoft\windows\iecompatcache\low\decryptfiles.txt
%APPDATA%\microsoft\windows\ietldcache\decryptfiles.txt
%APPDATA%\microsoft\windows\ietldcache\low\decryptfiles.txt
%APPDATA%\microsoft\windows\libraries\decryptfiles.txt
%APPDATA%\microsoft\uproof\custom.dic.mxfm
%APPDATA%\microsoft\windows\network shortcuts\decryptfiles.txt
%APPDATA%\microsoft\windows\printer shortcuts\decryptfiles.txt
%APPDATA%\microsoft\windows\privacie\decryptfiles.txt
%APPDATA%\microsoft\windows\cookies\decryptfiles.txt
%APPDATA%\microsoft\windows\cookies\low\decryptfiles.txt
%APPDATA%\microsoft\office\recent\decryptfiles.txt
%APPDATA%\microsoft\office\decryptfiles.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\decryptfiles.txt
C:\users\public\libraries\decryptfiles.txt
C:\users\public\music\sample music\decryptfiles.txt
C:\users\public\pictures\sample pictures\decryptfiles.txt
C:\users\public\recorded tv\decryptfiles.txt
C:\users\public\recorded tv\sample media\decryptfiles.txt
C:\users\public\videos\sample videos\decryptfiles.txt
%HOMEPATH%\decryptfiles.txt
%HOMEPATH%\appdata\decryptfiles.txt
%APPDATA%\decryptfiles.txt
%APPDATA%\identities\decryptfiles.txt
C:\users\public\favorites\decryptfiles.txt
%APPDATA%\identities\{1bba5dcd-58f3-46ae-861d-68cf42722c36}\decryptfiles.txt
%APPDATA%\microsoft\decryptfiles.txt
%APPDATA%\microsoft\addins\decryptfiles.txt
%APPDATA%\microsoft\credentials\decryptfiles.txt
%APPDATA%\microsoft\crypto\decryptfiles.txt
%APPDATA%\microsoft\crypto\rsa\decryptfiles.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\decryptfiles.txt
%APPDATA%\microsoft\internet explorer\decryptfiles.txt
%APPDATA%\microsoft\internet explorer\quick launch\decryptfiles.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\decryptfiles.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decryptfiles.txt
%APPDATA%\media center programs\decryptfiles.txt
%APPDATA%\microsoft\windows\recent\decryptfiles.txt
nul

Перемещает следующие файлы

%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814 в %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814.bjga
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4.vfsg
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json.xtwu
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json.jrnh
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4.oalm
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.szox
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.pkyq
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4.wcgy
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.mfiw
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini.wsil
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json.jngi
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
%APPDATA%\thunderbird\profiles\dm02c46v.default\times.json в %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json.cwii
%APPDATA%\thunderbird\crash reports\installtime20210406220621 в %APPDATA%\thunderbird\crash reports\installtime20210406220621.uwos
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js в %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js.lqfe
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js.qvnp
%APPDATA%\mozilla\firefox\profiles.ini в %APPDATA%\mozilla\firefox\profiles.ini.mhnw
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.tnle
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json в %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json.dpzz
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.vtcq
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.lvfa
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.fwpz
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json.zuqw
%APPDATA%\thunderbird\installs.ini в %APPDATA%\thunderbird\installs.ini.cgwl
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json.dmgk
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json.kqoe
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.bwmf
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.kqas
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.ubfr
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json.cifu
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json.uhpm
%APPDATA%\thunderbird\profiles.ini в %APPDATA%\thunderbird\profiles.ini.tuoa
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.bsgc
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2.rixk
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.cesw
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4.fpzc
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite.vxsl
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite.dczv
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4.syni
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.votv
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2.qexs
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.nkhz
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json.ynru
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.psgj
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json.umqz
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.dhwp
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.wiou
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json.evno
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4.lwzx
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8.ixiy
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.kdxk
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.nsez
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2.xxgp
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4.yrye
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json.nett
%APPDATA%\mozilla\firefox\installs.ini в %APPDATA%\mozilla\firefox\installs.ini.xkmk
%APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 в %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.eomw
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini в %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.tzha
%APPDATA%\microsoft\windows\sendto\desktop.ini в %APPDATA%\microsoft\windows\sendto\desktop.ini.sxhm
%APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms в %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.vleo
%APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini в %APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini.svwg
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini в %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.kuxw
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini.nryq
%APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini в %APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini.fxcg
%APPDATA%\microsoft\windows\libraries\music.library-ms в %APPDATA%\microsoft\windows\libraries\music.library-ms.xkun
%APPDATA%\microsoft\windows\libraries\pictures.library-ms в %APPDATA%\microsoft\windows\libraries\pictures.library-ms.rzox
%APPDATA%\microsoft\templates\normal.dotm в %APPDATA%\microsoft\templates\normal.dotm.dcni
%APPDATA%\microsoft\windows\libraries\documents.library-ms в %APPDATA%\microsoft\windows\libraries\documents.library-ms.gply
%APPDATA%\Microsoft\Templates\~$Normal.dotm в %APPDATA%\microsoft\templates\~$normal.dotm.biid
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c в %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c.cfmz
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred в %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred.dsae
%APPDATA%\microsoft\office\mso1033.acl в %APPDATA%\microsoft\office\mso1033.acl.zzkf
%APPDATA%\microsoft\office\recent\templates.lnk в %APPDATA%\microsoft\office\recent\templates.lnk.qdes
%APPDATA%\microsoft\protect\credhist в %APPDATA%\microsoft\protect\credhist.eghs
%APPDATA%\microsoft\windows\libraries\videos.library-ms в %APPDATA%\microsoft\windows\libraries\videos.library-ms.ixqx
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2024-09-04_11_de2a2eo29nunltkagq5ija==.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2024-09-04_11_de2a2eo29nunltkagq5ija==.jsonlz4.sgxe
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json.srvo
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json.nmtf
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2.xtmu
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177.zhmn
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071.orrj
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9.vayr
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.zipu
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4.vieo
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.txpy
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json.fuqu
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858.djfw
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4.aqbv
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json.xbqz
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4.xozg
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js.vice
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4.qixn
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.csqe
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json.xzlj
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4.uhkf
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4.edba
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json.yxol
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4.gstu
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4.worh
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json.zhje
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json.rxcn
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json.xoxk
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.txpu
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.fbij

Изменяет следующие файлы

%HOMEPATH%\desktop\contoso_1.cer
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred
%APPDATA%\microsoft\office\mso1033.acl
%APPDATA%\microsoft\office\recent\templates.lnk
%APPDATA%\microsoft\protect\credhist
C:\users\public\music\sample music\sleep away.mp3
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
C:\users\public\music\sample music\maid with the flaxen hair.mp3
C:\users\public\libraries\recordedtv.library-ms
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\desktop.ini
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\desktop.ini
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini
C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop.ini
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\boot.sdi
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\dashborder_96.bmp
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c
%APPDATA%\Microsoft\Templates\~$Normal.dotm

Изменяет множество файлов.

Самоудаляется.

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Другое

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /C ping 1.#.1.1 -n 1 -w 3000 > Nul & Del /f /q "<Полный путь к файлу>"
'%WINDIR%\syswow64\ping.exe' 1.#.1.1 -n 1 -w 3000
'<SYSTEM32>\wbem\wmic.exe' shadowcopy delete (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней