Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\desktop.ini
- %TEMP%\snapshot_blob.bin
- %TEMP%\visualelementsmanifest.xml
- %TEMP%\debug.log
- %TEMP%\000003.log
- %TEMP%\icon_128.png
- %TEMP%\icon_16.png
- %TEMP%\main.html
- %TEMP%\databases.db
- %TEMP%\secondarytile.png
- %TEMP%\natives_blob.bin
- %TEMP%\32.png
- %TEMP%\48.png
- %TEMP%\google profile.ico
- %TEMP%\759e.tmp
- %TEMP%\75ae.tmp
- %TEMP%\9c2.tmp
- %TEMP%\9d3.tmp
- %TEMP%\main.js
- %TEMP%\16.png
- %TEMP%\ntuser.dat.log
- %TEMP%\128.png
- %TEMP%\desert.jpg
- %TEMP%\firefox.lnk
- %TEMP%\mozilla thunderbird.lnk
- %TEMP%\opera.lnk
- %TEMP%\steam.lnk
- %TEMP%\kalimba.mp3
- %TEMP%\maid with the flaxen hair.mp3
- %TEMP%\sleep away.mp3
- %TEMP%\logo.png
- %TEMP%\splash-620x300.png
- %TEMP%\smalllogo.png
- %TEMP%\jellyfish.jpg
- %TEMP%\koala.jpg
- %TEMP%\lighthouse.jpg
- %TEMP%\penguins.jpg
- %TEMP%\tulips.jpg
- %TEMP%\wildlife.wmv
- %TEMP%\chrome.7z
- %TEMP%\chrysanthemum.jpg
- %TEMP%\hydrangeas.jpg
- %TEMP%\acrobat reader dc.lnk
- %TEMP%\iconcache.db
- %TEMP%\scriptcache-child-current.bin
- %TEMP%\permissions.sqlite
- %TEMP%\pkcs11.txt
- %TEMP%\places.sqlite
- %TEMP%\prefs.js
- %TEMP%\3647222921wleabceoxlt-eengsairo.sqlite
- %TEMP%\1451318868ntouromlalnodry--epcr.sqlite
- %TEMP%\1657114595amcateirvtisty.sqlite
- %TEMP%\formhistory.sqlite
- %TEMP%\key4.db
- %TEMP%\2823318777ntouromlalnodry--naod.sqlite
- %TEMP%\3870112724rsegmnoittet-es.sqlite
- %TEMP%\storage.sqlite
- %TEMP%\user.js
- %TEMP%\webappsstore.sqlite
- %TEMP%\installs.ini
- %TEMP%\profiles.ini
- %TEMP%\abook.sqlite
- %TEMP%\2918063365piupsah.sqlite
- %TEMP%\3561288849sdhlie.sqlite
- %TEMP%\brndlog.txt
- %TEMP%\brndlog.bak
- %TEMP%\content-prefs.sqlite
- %TEMP%\scriptcache-current.bin
- %TEMP%\urlcache-current.bin
- %TEMP%\urlcache.bin
- %TEMP%\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico
- %TEMP%\google chrome.lnk
- %TEMP%\launch internet explorer browser.lnk
- %TEMP%\cookies.sqlite
- %TEMP%\index.sqlite
- %TEMP%\favicons.sqlite
- %TEMP%\internet explorer.lnk
- %TEMP%\alternateservices.txt
- %TEMP%\securitypreloadstate.txt
- %TEMP%\sitesecurityservicestate.txt
- %TEMP%\trrblacklist.txt
- %TEMP%\cert9.db
- %TEMP%\compatibility.ini
- %TEMP%\windows explorer.lnk
- %TEMP%\windows media player.lnk
- %TEMP%\templates.lnk
- %TEMP%\window switcher.lnk
- %TEMP%\shows desktop.lnk
- %TEMP%\jaureglist.xml
- %TEMP%\device.png
- %TEMP%\overlay.png
- %TEMP%\superbar.png
- %TEMP%\watermark.png
- %TEMP%\resource.xml
- %TEMP%\folder.ico
- %TEMP%\netfol.ico
- %TEMP%\background.png
- %TEMP%\scan_property.ico
- %TEMP%\abcpy.ini
- %TEMP%\sync.ico
- %TEMP%\tasks.xml
- %TEMP%\wmp.ico
- %TEMP%\print_pref.ico
- %TEMP%\print_property.ico
- %TEMP%\print_queue.ico
- %TEMP%\scan_.ico
- %TEMP%\ringtones.ico
- %TEMP%\pictures.ico
- %TEMP%\settings.ico
- %TEMP%\accessmuiset.xml
- %TEMP%\office32mui.xml
- %TEMP%\proplusww.xml
- %TEMP%\setup.xml
- %TEMP%\excelmui.xml
- %TEMP%\powerpointmui.xml
- %TEMP%\publishermui.xml
- %TEMP%\outlookmui.xml
- %TEMP%\wordmui.xml
- %TEMP%\setup.ini
- %TEMP%\scan_settings.ico
- %TEMP%\office32ww.xml
- %TEMP%\infopathmui.xml
- %TEMP%\onenotemui.xml
- %TEMP%\groovemui.xml
- %TEMP%\officemui.xml
- %TEMP%\officemuiset.xml
- %TEMP%\branding.xml
- %TEMP%\accessmui.xml
- %TEMP%\proofing.xml
- %TEMP%\proof.xml
- %TEMP%\behavior.xml
- %TEMP%\assetlibrary.ico
- %TEMP%\usertile29.bmp
- %TEMP%\usertile31.bmp
- %TEMP%\usertile32.bmp
- %TEMP%\usertile33.bmp
- %TEMP%\usertile34.bmp
- %TEMP%\usertile35.bmp
- %TEMP%\usertile36.bmp
- %TEMP%\usertile28.bmp
- %TEMP%\usertile26.bmp
- %TEMP%\usertile30.bmp
- %TEMP%\usertile37.bmp
- %TEMP%\usertile41.bmp
- %TEMP%\usertile42.bmp
- %TEMP%\usertile43.bmp
- %TEMP%\usertile44.bmp
- %TEMP%\guest.bmp
- %TEMP%\user.bmp
- %TEMP%\usertile38.bmp
- %TEMP%\usertile39.bmp
- %TEMP%\usertile40.bmp
- %TEMP%\usertile27.bmp
- %TEMP%\usertile25.bmp
- %TEMP%\documentrepository.ico
- %TEMP%\mysite.ico
- %TEMP%\sharepointportalsite.ico
- %TEMP%\sharepointteamsite.ico
- %TEMP%\usertile10.bmp
- %TEMP%\usertile11.bmp
- %TEMP%\usertile12.bmp
- %TEMP%\usertile13.bmp
- %TEMP%\usertile14.bmp
- %TEMP%\mysharepoints.ico
- %TEMP%\usertile15.bmp
- %TEMP%\usertile17.bmp
- %TEMP%\usertile18.bmp
- %TEMP%\usertile19.bmp
- %TEMP%\usertile20.bmp
- %TEMP%\usertile21.bmp
- %TEMP%\usertile22.bmp
- %TEMP%\usertile23.bmp
- %TEMP%\usertile24.bmp
- %TEMP%\usertile16.bmp
- %TEMP%\blist.sqlite
- %TEMP%\enigmail.sqlite
Изменяет следующие файлы
- C:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\desktop.ini
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.xml
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.xml
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Другое
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /C "icacls . /grant Everyone:F /T /C /Q" (со скрытым окном)
- '%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q
