Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие файлы на съемном носителе
- <Имя диска съемного носителя>:\@d0glun@.exe
- <Имя диска съемного носителя>:\1.bat
- <Имя диска съемного носителя>:\krsweden.rtf
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\trivial-merge.html
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: 'Regmonclass', WindowName: ''
- ClassName: 'Filemonclass', WindowName: ''
Изменения в файловой системе
Создает следующие файлы
- C:\@d0glun@.exe
- %HOMEPATH%\desktop\@d0glun@.key.vbs
- %HOMEPATH%\desktop\0nion@î´¨&.exe
- %HOMEPATH%\desktop\0nion@î´¨&.txt
- C:\@main wallpaper.bmp
- %HOMEPATH%\desktop\time 2025äê1ôâ25èõ10ê±20·ö21ãë.txt
- C:\î´¨.ico
- %WINDIR%\reg.reg
- %WINDIR%\1.bat
- %CommonProgramFiles%\microsoft shared\stationery\cave_drawings.gif.@d0glun@gif
- %CommonProgramFiles%\microsoft shared\stationery\connectivity.gif.@d0glun@gif
- %CommonProgramFiles%\microsoft shared\stationery\stucco.gif.@d0glun@gif
- C:\@d0glun2@.bmp
- C:\help.exe
- %HOMEPATH%\desktop\@d0glun@.bmp
- %CommonProgramFiles%\microsoft shared\stationery\tiki.gif.@d0glun@gif
- %HOMEPATH%\desktop\lnk.0nion@î´¨&
- %CommonProgramFiles%\microsoft shared\stationery\wrinkled_paper.gif.@d0glun@gif
- %HOMEPATH%\desktop\1.mp4.0nion@î´¨&
- %HOMEPATH%\desktop\1.docx.0nion@î´¨&
- D:\@d0glun@.exe
- D:\1.bat
- %HOMEPATH%\desktop\1.@d0glun@.key
- %HOMEPATH%\desktop\2.@d0glun@.key
- C:\1.bat
- %HOMEPATH%\desktop\3.@d0glun@.key
- %HOMEPATH%\desktop\4.@d0glun@.key
- %HOMEPATH%\desktop\5.@d0glun@.key
- %HOMEPATH%\desktop\6.@d0glun@.key
- %HOMEPATH%\desktop\7.@d0glun@.key
- %HOMEPATH%\desktop\1.exe.0nion@î´¨&
- %HOMEPATH%\desktop\2.txt.0nion@î´¨&
- %HOMEPATH%\desktop\3.zip.0nion@î´¨&
- %HOMEPATH%\desktop\1.rar.0nion@î´¨&
- %HOMEPATH%\desktop\1.doc.0nion@î´¨&
- %HOMEPATH%\desktop\1.pdf.0nion@î´¨&
- %TEMP%\temp_random_data.dat
Присваивает атрибут 'скрытый' для следующих файлов
- D:\1.bat
- <Имя диска съемного носителя>:\1.bat
- C:\1.bat
Удаляет следующие файлы
- %TEMP%\temp_random_data.dat
Перемещает следующие файлы
- %HOMEPATH%\desktop\0nion@î´¨&.txt в %HOMEPATH%\desktop\0nion@î´¨&.txt.@d0glun@txt
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01245_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01245_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01244_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01244_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01243_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01243_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01242_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01242_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01241_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01241_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01240_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01240_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01239_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01239_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01238_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01238_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01237_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01237_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01219_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01219_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph03014_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph03014_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph02845g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph02845g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph02752g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph02752g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph02750g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph02750g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph02749g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph02749g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph02748g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph02748g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph02746g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph02746g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph02743g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph02743g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph02742g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph02742g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph02740g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph02740g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph02736g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph02736g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph01255g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph01255g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ph00601g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ph00601g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099203.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0099203.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099202.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0099202.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01246_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01246_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01253_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01253_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01268_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01268_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01292_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01292_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01839_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01839_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01838_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01838_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01770_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01770_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01751_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01751_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01750_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01750_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01749_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01749_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01748_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01748_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01747_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01747_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01746_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01746_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01745_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01745_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01744_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01744_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01743_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01743_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01740_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01740_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01742_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01742_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01734_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01734_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01330_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01330_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01304g.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01304g.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01301_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01301_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01300_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01300_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01299_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01299_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01298_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01298_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01297_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01297_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01296_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01296_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01295_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01295_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01294_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01294_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01293_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01293_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01840_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01840_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099201.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0099201.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099200.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0099200.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099199.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0099199.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif.@d0glun@gif
- %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif в %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif.@d0glun@gif
- %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif в %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif.@d0glun@gif
- %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif в %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif.@d0glun@gif
- %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif в %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif.@d0glun@gif
- %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif в %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif.@d0glun@gif
- %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif в %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif.@d0glun@gif
- %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif в %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif.@d0glun@gif
- %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif в %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif.@d0glun@gif
- %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif в %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif.@d0glun@gif
- %ProgramFiles%\java\jre1.8.0_45\lib\deploy\ffjcext.zip в %ProgramFiles%\java\jre1.8.0_45\lib\deploy\ffjcext.@d0glun@zip
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00139_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00139_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00142_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00142_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00154_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00154_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099197.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0099197.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099196.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0099196.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099195.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0099195.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099194.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0099194.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099193.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0099193.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099192.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0099192.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0075478.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0075478.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00172_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00172_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00170_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00170_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00169_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00169_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00167_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00167_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00165_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00165_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00164_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00164_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00163_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00163_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00158_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00158_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00157_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\ag00157_.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\j0099198.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\j0099198.gif.@d0glun@gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\wb01842_.gif в %ProgramFiles%\microsoft office\clipart\pub60cor\wb01842_.gif.@d0glun@gif
Изменяет следующие файлы
- <Имя диска съемного носителя>:\krsweden.rtf
- %CommonProgramFiles%\microsoft shared\themes14\deepblue\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\concrete\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\compass\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\cascade\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\capsules\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\canyon\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\breeze\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\boldstri\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\blueprnt\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\bluecalm\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\blends\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\axis\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\arctic\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\aftrnoon\preview.gif
- %CommonProgramFiles%\microsoft shared\grphflt\ms.gif
- %HOMEPATH%\desktop\trivial-merge.html
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %CommonProgramFiles%\microsoft shared\themes14\echo\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\eclipse\preview.gif
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Другое
Ищет следующие окна
- ClassName: '4823-00000029' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: '' WindowName: 'Taskmgr.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c D:\1.bat (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c <Имя диска съемного носителя>:\1.bat (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c C:\1.bat (со скрытым окном)
