Trojan.Encoder.41972

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\13.jpeg
%HOMEPATH%\desktop\pushkin.jpeg
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\iisstart.html
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\168.jpg
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\tileimage.bmp

Изменения в файловой системе

Создает следующие файлы

%TEMP%\office32ww.xml
%TEMP%\penguins.jpg
%TEMP%\tulips.jpg
%TEMP%\wildlife.wmv
%TEMP%\13.jpeg
%TEMP%\168.jpg
%TEMP%\4f0bf7ff71f28.jpeg
%TEMP%\google chrome.lnk
%TEMP%\telegram.lnk
%TEMP%\adhd_and_obesity.docx
%TEMP%\applicantform_en.doc
%TEMP%\browse.htm
%TEMP%\dashborder_144.bmp
%TEMP%\koala.jpg
%TEMP%\lighthouse.jpg
%TEMP%\dashborder_96.bmp
%TEMP%\howto-index.html
%TEMP%\ituneshelpunavailable.html
%TEMP%\iisstart.html
%TEMP%\ovp25012015.doc
%TEMP%\pushkin.jpeg
%TEMP%\sdszfo.docx
%TEMP%\tileimage.bmp
%TEMP%\desktop.lnk
%TEMP%\downloads.lnk
%TEMP%\recentplaces.lnk
%TEMP%\ntuser.ini
%TEMP%\168.jpeg
%TEMP%\february_catalogue__2015.doc
%TEMP%\file_p_00000000_1371597592.docx
%TEMP%\jellyfish.jpg
%TEMP%\hydrangeas.jpg
%TEMP%\desert.jpg
%TEMP%\setup.xml
%TEMP%\excelmui.xml
%TEMP%\powerpointmui.xml
%TEMP%\publishermui.xml
%TEMP%\outlookmui.xml
%TEMP%\wordmui.xml
%TEMP%\proof.xml
%TEMP%\proofing.xml
%TEMP%\office32mui.xml
%TEMP%\infopathmui.xml
%TEMP%\onenotemui.xml
%TEMP%\groovemui.xml
%TEMP%\officemui.xml
%TEMP%\proplusww.xml
%TEMP%\officemuiset.xml
%TEMP%\accessmui.xml
%TEMP%\accessmuiset.xml
%TEMP%\ntuser.dat.log
%TEMP%\acrobat reader dc.lnk
%TEMP%\firefox.lnk
%TEMP%\mozilla thunderbird.lnk
%TEMP%\opera.lnk
%TEMP%\desktop.ini
%TEMP%\steam.lnk
%TEMP%\maid with the flaxen hair.mp3
%TEMP%\kalimba.mp3
%TEMP%\sleep away.mp3
%TEMP%\chrysanthemum.jpg
%TEMP%\branding.xml
%TEMP%\1sm_price.zip
%TEMP%\2.jpeg

Изменяет следующие файлы

C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.xml
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\accessmui.xml
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\branding.xml