Техническая информация
Изменения в файловой системе
Создает следующие файлы
- C:\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\network\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\level\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\layers\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\journal\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\iris\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\indust\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\ice\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\expeditn\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\evrgreen\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\edge\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\eclipse\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\echo\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\deepblue\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\papyrus\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\concrete\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\cascade\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\capsules\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\canyon\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\breeze\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\boldstri\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\blueprnt\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\bluecalm\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\blends\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\axis\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\arctic\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\aftrnoon\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\stationery\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\compass\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\pixel\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\profile\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\quad\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\vba\vba7\1033\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\vba\vba7\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\vba\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\triedit\en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\triedit\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\textconv\en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\textconv\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\translat\fren\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\translat\frar\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\translat\esen\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\translat\enfr\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\translat\enes\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\translat\arfr\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\translat\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\watermar\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\water\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\sumipntg\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\studio\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\strtedge\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\spring\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\sonora\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\slate\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\sky\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\satin\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\rmnsque\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\ripple\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\ricepapr\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\refined\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\themes14\radial\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\source engine\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\vc\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\smart tag\lists\1033\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\smart tag\1033\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\dw\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\decryption instructions.txt
- %CommonProgramFiles%\designer\decryption instructions.txt
- %CommonProgramFiles%\decryption instructions.txt
- %ProgramFiles%\decryption instructions.txt
- C:\perflogs\decryption instructions.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\decryption instructions.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\decryption instructions.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\equation\decryption instructions.txt
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\decryption instructions.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\decryption instructions.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\decryption instructions.txt
- C:\msocache\decryption instructions.txt
- C:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\decryption instructions.txt
- C:\$recycle.bin\decryption instructions.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\equation\1033\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\euro\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\filters\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\smart tag\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\proof\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\cultures\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\1033\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\office14\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\msinfo\en-us\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\msinfo\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\msclientdatamgr\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\help\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\grphflt\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\smart tag\lists\decryption instructions.txt
- %CommonProgramFiles%\microsoft shared\vgx\decryption instructions.txt
Перемещает следующие файлы
- %ProgramFiles%\internet explorer\signup\install.ins в %ProgramFiles%\internet explorer\signup\install.ins.hunted3
- %ProgramFiles%\java\jre1.8.0_45\readme.txt в %ProgramFiles%\java\jre1.8.0_45\readme.txt.hunted3
- %ProgramFiles%\java\jre1.8.0_45\license в %ProgramFiles%\java\jre1.8.0_45\license.hunted3
- %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt в %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.hunted3
- %ProgramFiles%\java\jre1.8.0_45\copyright в %ProgramFiles%\java\jre1.8.0_45\copyright.hunted3
- %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt в %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.hunted3
- %ProgramFiles%\java\jre1.8.0_45\bin\javacpl.cpl в %ProgramFiles%\java\jre1.8.0_45\bin\javacpl.cpl.hunted3
Изменяет следующие файлы
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.cab
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.cab
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordlr.cab
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.cab
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
