Trojan.Encoder.41670

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XPSUDTARW' = '"<Полный путь к файлу>"'

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\decryptfiles.txt
%APPDATA%\microsoft\word\startup\decryptfiles.txt

Вредоносные функции

Для затруднения выявления своего присутствия в системе

удаляет теневые копии разделов.

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\210252809.jpeg
%HOMEPATH%\desktop\trivial-merge.htm
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\weeklysheet1215.doc
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\trivial-merge.html
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\region-north-karelia.jpeg
%HOMEPATH%\desktop\parnas_01.jpg
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%APPDATA%\mozilla\firefox\profiles.ini
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\iisstart.htm
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\210252809.jpg
%HOMEPATH%\desktop\join.avi
%APPDATA%\thunderbird\profiles.ini

Изменения в файловой системе

Создает следующие файлы

%TEMP%\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt.kari
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\events\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite-wal.kysj
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite-wal.ntzj
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\parent.lock.lket
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt.pevx
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\security_state\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.fil...
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\minidumps\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\administrative tools\decryptfiles.txt
%APPDATA%\microsoft\windows\sendto\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\decryptfiles.txt
%APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.ptea
%APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.xswq
%APPDATA%\microsoft\windows\sendto\documents.mydocs.irvi
%APPDATA%\microsoft\windows\start menu\programs\accessories\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\decryptfiles.txt
%APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.ayoe
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\google chrome\decryptfiles.txt
%APPDATA%\mozilla\firefox\crash reports\events\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\maintenance\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\decryptfiles.txt
%APPDATA%\microsoft\windows\start menu\programs\winrar\decryptfiles.txt
%APPDATA%\microsoft\windows\templates\decryptfiles.txt
%APPDATA%\microsoft\windows\themes\decryptfiles.txt
%APPDATA%\microsoft\word\decryptfiles.txt
%APPDATA%\mozilla\decryptfiles.txt
%APPDATA%\mozilla\extensions\decryptfiles.txt
%APPDATA%\mozilla\firefox\decryptfiles.txt
%APPDATA%\mozilla\firefox\crash reports\decryptfiles.txt
%APPDATA%\mozilla\firefox\pending pings\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\default\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt.sifb
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\decryptfiles.txt
%HOMEPATH%\contacts\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt.juvx
%HOMEPATH%\documents\decryptfiles.txt
%HOMEPATH%\favorites\links\decryptfiles.txt
%HOMEPATH%\favorites\links for united states\decryptfiles.txt
%HOMEPATH%\favorites\microsoft websites\decryptfiles.txt
%HOMEPATH%\favorites\msn websites\decryptfiles.txt
%HOMEPATH%\favorites\windows live\decryptfiles.txt
%HOMEPATH%\links\decryptfiles.txt
%HOMEPATH%\ntuser.dat.log1.rssg
%HOMEPATH%\ntuser.dat.log2.wnwl
%HOMEPATH%\saved games\decryptfiles.txt
%HOMEPATH%\downloads\decryptfiles.txt
%HOMEPATH%\favorites\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\parent.lock.wgwc
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\minidumps\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt.omai
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite-wal.xoyz
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\decryptfiles.txt
%APPDATA%\mozilla\systemextensionsdev\decryptfiles.txt
%APPDATA%\telegram desktop\decryptfiles.txt
%APPDATA%\thunderbird\decryptfiles.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decryptfiles.txt
%APPDATA%\thunderbird\crash reports\decryptfiles.txt
%APPDATA%\thunderbird\pending pings\decryptfiles.txt
%APPDATA%\thunderbird\profiles\decryptfiles.txt
%APPDATA%\thunderbird\profiles\dm02c46v.default\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt.yuoa
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\events\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\decryptfiles.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\decryptfiles.txt
%APPDATA%\thunderbird\crash reports\events\decryptfiles.txt
%APPDATA%\microsoft\windows\recent\customdestinations\decryptfiles.txt
%HOMEPATH%\searches\decryptfiles.txt
%APPDATA%\microsoft\windows\recent\automaticdestinations\decryptfiles.txt
%APPDATA%\microsoft\windows\privacie\low\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink.oita
C:\users\default\appdata\roaming\microsoft\windows\start menu\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail.ulba
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\templates\decryptfiles.txt
C:\users\default\desktop\decryptfiles.txt
C:\users\default\documents\my music\decryptfiles.txt
C:\users\public\documents\my music\decryptfiles.txt
C:\users\default\documents\my pictures\decryptfiles.txt
C:\users\default\documents\my videos\decryptfiles.txt
C:\users\default\downloads\decryptfiles.txt
C:\users\default\favorites\decryptfiles.txt
C:\users\default\links\decryptfiles.txt
C:\users\default\ntuser.dat.log2.ndbx
C:\users\default\saved games\decryptfiles.txt
C:\users\public\decryptfiles.txt
C:\users\public\desktop\decryptfiles.txt
C:\users\public\documents\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.qgbh
C:\users\default\documents\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\decryptfiles.txt
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\decryptfiles.txt
%HOMEPATH%\desktop\decryptfiles.txt
%HOMEPATH%\documents\my music\decryptfiles.txt
%HOMEPATH%\documents\my pictures\decryptfiles.txt
%HOMEPATH%\documents\my videos\decryptfiles.txt
C:\kms\decryptfiles.txt
C:\msocache\decryptfiles.txt
<Текущая директория>\decryptfiles.txt
C:\perflogs\decryptfiles.txt
C:\perflogs\admin\decryptfiles.txt
C:\recovery\decryptfiles.txt
C:\users\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\decryptfiles.txt
C:\users\default\decryptfiles.txt
C:\users\default\appdata\decryptfiles.txt
C:\users\default\appdata\roaming\decryptfiles.txt
C:\users\default\appdata\roaming\media center programs\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\cookies\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\decryptfiles.txt
C:\users\default\appdata\roaming\microsoft\windows\recent\decryptfiles.txt
C:\users\public\documents\my pictures\decryptfiles.txt
C:\users\public\documents\my videos\decryptfiles.txt
C:\users\public\downloads\decryptfiles.txt
%APPDATA%\microsoft\protect\decryptfiles.txt
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\decryptfiles.txt
%APPDATA%\microsoft\systemcertificates\decryptfiles.txt
%APPDATA%\microsoft\systemcertificates\my\decryptfiles.txt
%APPDATA%\microsoft\systemcertificates\my\certificates\decryptfiles.txt
%APPDATA%\microsoft\systemcertificates\my\crls\decryptfiles.txt
%APPDATA%\microsoft\systemcertificates\my\ctls\decryptfiles.txt
%APPDATA%\microsoft\templates\decryptfiles.txt
%APPDATA%\microsoft\uproof\decryptfiles.txt
%APPDATA%\microsoft\office\recent\decryptfiles.txt
%APPDATA%\microsoft\proof\decryptfiles.txt
%APPDATA%\microsoft\windows\decryptfiles.txt
%APPDATA%\microsoft\windows\iecompatcache\decryptfiles.txt
%APPDATA%\microsoft\windows\iecompatcache\low\decryptfiles.txt
%APPDATA%\microsoft\windows\ietldcache\decryptfiles.txt
%APPDATA%\microsoft\windows\ietldcache\low\decryptfiles.txt
%APPDATA%\microsoft\windows\libraries\decryptfiles.txt
%APPDATA%\microsoft\windows\network shortcuts\decryptfiles.txt
%APPDATA%\microsoft\uproof\custom.dic.qkuc
%APPDATA%\microsoft\windows\printer shortcuts\decryptfiles.txt
%APPDATA%\microsoft\windows\privacie\decryptfiles.txt
%APPDATA%\microsoft\windows\cookies\decryptfiles.txt
%APPDATA%\microsoft\windows\cookies\low\decryptfiles.txt
%APPDATA%\microsoft\office\decryptfiles.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\decryptfiles.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decryptfiles.txt
C:\users\public\libraries\decryptfiles.txt
C:\users\public\music\sample music\decryptfiles.txt
C:\users\public\pictures\sample pictures\decryptfiles.txt
C:\users\public\recorded tv\decryptfiles.txt
C:\users\public\recorded tv\sample media\decryptfiles.txt
C:\users\public\videos\sample videos\decryptfiles.txt
%HOMEPATH%\decryptfiles.txt
%HOMEPATH%\appdata\decryptfiles.txt
%APPDATA%\decryptfiles.txt
%APPDATA%\identities\decryptfiles.txt
C:\users\public\favorites\decryptfiles.txt
%APPDATA%\identities\{1bba5dcd-58f3-46ae-861d-68cf42722c36}\decryptfiles.txt
%APPDATA%\microsoft\decryptfiles.txt
%APPDATA%\microsoft\addins\decryptfiles.txt
%APPDATA%\microsoft\credentials\decryptfiles.txt
%APPDATA%\microsoft\crypto\decryptfiles.txt
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.kwzx
%APPDATA%\microsoft\crypto\rsa\decryptfiles.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\decryptfiles.txt
%APPDATA%\microsoft\internet explorer\decryptfiles.txt
%APPDATA%\microsoft\internet explorer\quick launch\decryptfiles.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\decryptfiles.txt
%APPDATA%\media center programs\decryptfiles.txt
%APPDATA%\microsoft\windows\recent\decryptfiles.txt
nul

Перемещает следующие файлы

%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814 в %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814.fcdl
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json.semu
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.dgow
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.qwju
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4.fgwr
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.dwbn
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4.nhfg
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini.cxdg
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json.eloq
%APPDATA%\thunderbird\profiles\dm02c46v.default\times.json в %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json.ufok
%APPDATA%\thunderbird\installs.ini в %APPDATA%\thunderbird\installs.ini.pxyc
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json.ivzx
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json.razf
%APPDATA%\mozilla\firefox\profiles.ini в %APPDATA%\mozilla\firefox\profiles.ini.hrzi
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json в %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json.yzms
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json.brhm
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js.seuq
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.kmup
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json.tdld
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.dzog
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.qmkg
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.fibg
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.yexm
%APPDATA%\thunderbird\crash reports\installtime20210406220621 в %APPDATA%\thunderbird\crash reports\installtime20210406220621.jbic
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json.acjt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4.brek
%APPDATA%\thunderbird\profiles.ini в %APPDATA%\thunderbird\profiles.ini.ywhb
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.pxiu
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.ipqd
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.gvue
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.xikq
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json.myvb
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4.vlhp
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2.klsb
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json.jsek
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.yufk
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8.ezrt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.enxk
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.yofy
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite.ygrn
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2.bfjv
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.apov
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.wudo
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.mnro
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.gkjl
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json.twae
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite.azio
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4.uenr
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4.qfsj
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js в %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js.gkmk
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9.yfag
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4.gntu
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2.owsw
%APPDATA%\microsoft\windows\libraries\documents.library-ms в %APPDATA%\microsoft\windows\libraries\documents.library-ms.dpxz
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4.pnbu
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json.czkb
%APPDATA%\mozilla\firefox\installs.ini в %APPDATA%\mozilla\firefox\installs.ini.gfwc
%APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 в %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.iwzx
%APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini в %APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini.qust
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini в %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.lndp
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini в %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.gihe
%APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini в %APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini.nyvt
%APPDATA%\microsoft\windows\sendto\desktop.ini в %APPDATA%\microsoft\windows\sendto\desktop.ini.wwgv
%APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms в %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.ifyt
%APPDATA%\microsoft\templates\normal.dotm в %APPDATA%\microsoft\templates\normal.dotm.tweu
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json.psju
%APPDATA%\microsoft\windows\libraries\videos.library-ms в %APPDATA%\microsoft\windows\libraries\videos.library-ms.xafi
%APPDATA%\microsoft\windows\libraries\music.library-ms в %APPDATA%\microsoft\windows\libraries\music.library-ms.onvr
%APPDATA%\microsoft\windows\libraries\pictures.library-ms в %APPDATA%\microsoft\windows\libraries\pictures.library-ms.fqas
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred в %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred.irkv
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\e7b9399e-3392-43f5-af55-6a17db70251d в %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\e7b9399e-3392-43f5-af55-6a17db70251d.xzxy
%APPDATA%\Microsoft\Templates\~$Normal.dotm в %APPDATA%\microsoft\templates\~$normal.dotm.gpdj
%APPDATA%\microsoft\office\recent\templates.lnk в %APPDATA%\microsoft\office\recent\templates.lnk.kufh
%APPDATA%\microsoft\office\mso1033.acl в %APPDATA%\microsoft\office\mso1033.acl.ttef
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c в %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c.iwbj
%APPDATA%\microsoft\protect\credhist в %APPDATA%\microsoft\protect\credhist.ptcq
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json.nlce
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json.wshi
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini.bedv
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4.eplp
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2025-02-03_11_de2a2eo29nunltkagq5ija==.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2025-02-03_11_de2a2eo29nunltkagq5ija==.jsonlz4.vojo
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2.jxqy
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.qpll
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json.heuf
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.okzl
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.baklz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.baklz4.cczj
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4.kmzn
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4.fxqi
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071.kmvq
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json.khmn
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177.ohsm
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858.ewgi
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite.zyfv
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js.sapc
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.cxeg
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json.lqoy
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json.xzju
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4.otyn
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4.tkfa
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json.teus
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4.wlrn
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json.vxsc
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json.slsp
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4.qjbx
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.wjtc

Изменяет следующие файлы

%HOMEPATH%\desktop\210252809.jpeg
%APPDATA%\microsoft\windows\libraries\music.library-ms
C:\users\public\music\sample music\kalimba.mp3
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\e7b9399e-3392-43f5-af55-6a17db70251d
%APPDATA%\Microsoft\Templates\~$Normal.dotm
%APPDATA%\microsoft\office\recent\templates.lnk
%APPDATA%\microsoft\office\mso1033.acl
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c
%APPDATA%\microsoft\protect\credhist
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
C:\users\public\music\sample music\maid with the flaxen hair.mp3
C:\users\public\music\sample music\sleep away.mp3
C:\users\public\libraries\recordedtv.library-ms
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\desktop.ini
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\desktop.ini
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini
C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop.ini
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\boot.sdi
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\210252809.jpg
%HOMEPATH%\desktop\about.html
%APPDATA%\microsoft\windows\libraries\pictures.library-ms
%APPDATA%\microsoft\windows\libraries\documents.library-ms

Изменяет множество файлов.

Самоудаляется.

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Другое

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /C ping 1.#.1.1 -n 1 -w 3000 > Nul & Del /f /q "<Полный путь к файлу>"
'%WINDIR%\syswow64\ping.exe' 1.#.1.1 -n 1 -w 3000
'<SYSTEM32>\wbem\wmic.exe' shadowcopy delete (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней