Техническая информация
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\1189.jpeg
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\trivial-merge.htm
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\168.jpeg
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\default.bmp
Изменения в файловой системе
Создает следующие файлы
- C:\decryption instructions.txt
- C:\users\default\downloads\decryption instructions.txt
- C:\users\default\favorites\decryption instructions.txt
- C:\users\default\links\decryption instructions.txt
- C:\users\default\music\decryption instructions.txt
- C:\users\default\pictures\decryption instructions.txt
- C:\users\default\saved games\decryption instructions.txt
- C:\users\default\videos\decryption instructions.txt
- C:\users\public\decryption instructions.txt
- %HOMEPATH%\decryption instructions.txt
- %HOMEPATH%\appdata\decryption instructions.txt
- %HOMEPATH%\contacts\decryption instructions.txt
- %HOMEPATH%\desktop\decryption instructions.txt
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- %HOMEPATH%\documents\decryption instructions.txt
- %HOMEPATH%\favorites\decryption instructions.txt
- %HOMEPATH%\favorites\links\decryption instructions.txt
- %HOMEPATH%\favorites\links for united states\decryption instructions.txt
- %HOMEPATH%\favorites\msn websites\decryption instructions.txt
- %HOMEPATH%\favorites\microsoft websites\decryption instructions.txt
- %HOMEPATH%\favorites\windows live\decryption instructions.txt
- %HOMEPATH%\links\decryption instructions.txt
- %HOMEPATH%\music\decryption instructions.txt
- %HOMEPATH%\pictures\decryption instructions.txt
- %HOMEPATH%\saved games\decryption instructions.txt
- %HOMEPATH%\searches\decryption instructions.txt
- %HOMEPATH%\videos\decryption instructions.txt
- C:\users\default\desktop\decryption instructions.txt
- C:\users\default\documents\decryption instructions.txt
- C:\users\default\appdata\decryption instructions.txt
- C:\users\default\decryption instructions.txt
- C:\users\decryption instructions.txt
- C:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\decryption instructions.txt
- C:\msocache\decryption instructions.txt
- C:\msocache\all users\decryption instructions.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\decryption instructions.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\decryption instructions.txt
- C:\kms\decryption instructions.txt
- %HOMEPATH%\downloads\decryption instructions.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\decryption instructions.txt
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\decryption instructions.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\decryption instructions.txt
- C:\perflogs\decryption instructions.txt
- %ProgramFiles%\decryption instructions.txt
- %ProgramFiles(x86)%\decryption instructions.txt
- %ALLUSERSPROFILE%\decryption instructions.txt
- C:\recovery\decryption instructions.txt
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\decryption instructions.txt
- C:\$recycle.bin\decryption instructions.txt
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- <Текущая директория>\decryption instructions.txt
Изменяет следующие файлы
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\owow32lr.cab
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
