Trojan.Encoder.41978

Техническая информация

Изменения в файловой системе

Перемещает следующие файлы

%TEMP%\wallpaper.bmp в %TEMP%\wallpaper.bmp.xlockxlock
%APPDATA%\mozilla\firefox\installs.ini в %APPDATA%\mozilla\firefox\installs.ini.xlockxlock
%APPDATA%\mozilla\firefox\profiles.ini в %APPDATA%\mozilla\firefox\profiles.ini.xlockxlock
%APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 в %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.xlockxlock
%APPDATA%\telegram desktop\unins000.dat в %APPDATA%\telegram desktop\unins000.dat.xlockxlock
%APPDATA%\thunderbird\profiles.ini в %APPDATA%\thunderbird\profiles.ini.xlockxlock
%APPDATA%\thunderbird\installs.ini в %APPDATA%\thunderbird\installs.ini.xlockxlock
%APPDATA%\thunderbird\crash reports\installtime20210406220621 в %APPDATA%\thunderbird\crash reports\installtime20210406220621.xlockxlock

Изменяет следующие файлы

C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\boot.sdi.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\zh-tw.pak.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\chrome.7z.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\external_extensions.json.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\secondarytile.png.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\resources.pak.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\icudtl.dat.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\nacl_irt_x86_64.nexe.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\nacl_irt_x86_32.nexe.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest.xlockxlock
%LOCALAPPDATA%\google\chrome\application\debug.log.xlockxlock
%LOCALAPPDATA%\google\chrome\application\visualelementsmanifest.xml.xlockxlock
%ALLUSERSPROFILE%\sun\java\java update\jaureglist.xml.xlockxlock
%ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\state.rsm.xlockxlock
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm.xlockxlock
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.xlockxlock
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\state.rsm.xlockxlock
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.xlockxlock
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\state.rsm.xlockxlock
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm.xlockxlock
%ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.xlockxlock
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\update-config.json.xlockxlock
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\update-config.json.xlockxlock
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.xlockxlock
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.xlockxlock
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\kn.pak.xlockxlock
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ar.pak.xlockxlock