Trojan.Encoder.42190

Техническая информация

Изменения в файловой системе

Перемещает следующие файлы

%TEMP%\wallpaper.bmp в %TEMP%\8ur3zpzx.crypted
%APPDATA%\telegram desktop\unins000.exe в %APPDATA%\telegram desktop\2uka5no1.crypted
%APPDATA%\telegram desktop\updater.exe в %APPDATA%\telegram desktop\3hrdur2f.crypted
%APPDATA%\thunderbird\crash reports\installtime20210406220621 в %APPDATA%\thunderbird\crash reports\4g7nguaj.crypted
%APPDATA%\thunderbird\installs.ini в %APPDATA%\thunderbird\1qdqjrgm.crypted
%APPDATA%\thunderbird\profiles\dm02c46v.default\times.json в %APPDATA%\thunderbird\profiles\dm02c46v.default\2gk97ui8.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\j87qfdk3.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\o1qb0zq1.crypted
%APPDATA%\telegram desktop\unins000.dat в %APPDATA%\telegram desktop\e7narw5p.crypted
%APPDATA%\telegram desktop\telegram.exe в %APPDATA%\telegram desktop\hxko76by.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\kbu6d6ts.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cert9.db в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xc0eli71.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\w9s4t0k2.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\k30846fb.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\1ko14cyu.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\g12awatd.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\ybvkt1s2.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\4zqmori2.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\da1brdjb.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\4wlhjee0.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\8sm26w8x.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\8g31ky25.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\al9g3sz7.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2qplb8mp.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\0c5bpfn2.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\ilaolvou.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\yqo0bvej.crypted
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json в %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\z7wmdu7p.crypted
%APPDATA%\mozilla\firefox\profiles.ini в %APPDATA%\mozilla\firefox\3keg2h5z.crypted
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js в %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\ddgpiuck.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\e0vs5cxa.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\eafbbqeu.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\tu6xnw6o.crypted в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\gkc9faxe.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pr87nawj.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\wlaxtga7.crypted в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\7fcjo83c.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\7gqz9nd7.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\8eh7fqmr.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\tc8vt6ky.crypted в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\84k8vv6y.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\ec6ur4ci.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\6cvfkne6.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\f6jsn6vj.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\mhqxo5fi.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\tl6bev8j.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\tbb4ax87.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\6o3779b3.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\wuugzc3r.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\4san4df5.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\eh8yo7eg.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\vvpkrya5.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\tvr635i8.crypted в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\59jxs04g.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sl9z4jf8.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\wiglpek6.crypted в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\4ws7969k.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xc0eli71.crypted в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\n5390svi.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\kuaini8h.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\ybvkt1s2.crypted в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\kh3eoum3.crypted
%APPDATA%\thunderbird\profiles.ini в %APPDATA%\thunderbird\6ouati5i.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\vvpkrya5.crypted в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\gtou90n6.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\w9s4t0k2.crypted в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\hkggiacj.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\s8csuv8p.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\e189lafc.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\9wfw4q1q.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\g1sf3cj2.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\nsjegmtf.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\tvr635i8.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\mev3in6w.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\m42mvyo1.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\hu2o1r5o.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\19bh1iwg.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2 в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\1a9upswq.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\h57v5vzz.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\parent.lock в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\wiglpek6.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\856gybwx.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\n7j1s498.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\7eidaig1.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\axapxkuc.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\key4.db в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\qw5rmwjs.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\mailviews.dat в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\jyd7bv6e.crypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\8dyw8s45.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\x9iflv2p.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\a2i5w1vd.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\vazuwgz1.crypted
%APPDATA%\microsoft\windows\sendto\documents.mydocs в %APPDATA%\microsoft\windows\sendto\1b7p5dk9.crypted
%APPDATA%\microsoft\windows\sendto\fax recipient.lnk в %APPDATA%\microsoft\windows\sendto\6a44y6cr.crypted
%APPDATA%\microsoft\windows\sendto\mail recipient.mapimail в %APPDATA%\microsoft\windows\sendto\f0bnyg8q.crypted
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk в %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\0xk3c9p2.crypted
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk в %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\e1cgidyc.crypted
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk в %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\k0l3zsmm.crypted
%APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget в %APPDATA%\microsoft\windows\sendto\ru91i35u.crypted
%APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk в %APPDATA%\microsoft\windows\start menu\programs\google chrome\6h0x3tjb.crypted
%APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms в %APPDATA%\microsoft\windows\recent\automaticdestinations\frzc3mo8.crypted
%APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk в %APPDATA%\microsoft\windows\start menu\programs\accessories\0zq877ei.crypted
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk в %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\34rr6j2a.crypted
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk в %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\fhozziny.crypted
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk в %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\kjldhetb.crypted
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk в %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\nn4znlve.crypted
%APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk в %APPDATA%\microsoft\windows\start menu\programs\accessories\0nik94gb.crypted
%APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk в %APPDATA%\microsoft\windows\start menu\programs\accessories\2r9ui0pn.crypted
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk в %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\340dnl3a.crypted
%APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk в %APPDATA%\microsoft\windows\start menu\programs\accessories\faj71h8b.crypted
%APPDATA%\microsoft\windows\libraries\pictures.library-ms в %APPDATA%\microsoft\windows\libraries\9208vq8k.crypted
%APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk в %APPDATA%\microsoft\internet explorer\quick launch\o78o47vu.crypted
%APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk в %APPDATA%\microsoft\internet explorer\quick launch\8ur3zpzx.crypted
%APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk в %APPDATA%\microsoft\internet explorer\quick launch\h0da1yoj.crypted
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk в %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\e8760xls.crypted
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk в %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\ls7e9th4.crypted
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk в %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\lpcv7uvh.crypted
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk в %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\32x6k7vh.crypted
%APPDATA%\microsoft\windows\libraries\videos.library-ms в %APPDATA%\microsoft\windows\libraries\dxh7nl7p.crypted
%APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk в %APPDATA%\microsoft\windows\start menu\programs\mi633azk.crypted
%APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk в %APPDATA%\microsoft\internet explorer\quick launch\f98er24s.crypted
%APPDATA%\microsoft\office\mso1033.acl в %APPDATA%\microsoft\office\jxaka686.crypted
%APPDATA%\microsoft\office\recent\templates.lnk в %APPDATA%\microsoft\office\recent\92ydct3k.crypted
%APPDATA%\microsoft\templates\normal.dotm в %APPDATA%\microsoft\templates\047rjl54.crypted
%APPDATA%\microsoft\uproof\custom.dic в %APPDATA%\microsoft\uproof\y4jc34rr.crypted
%APPDATA%\microsoft\windows\libraries\documents.library-ms в %APPDATA%\microsoft\windows\libraries\62g73vvy.crypted
%APPDATA%\microsoft\windows\libraries\music.library-ms в %APPDATA%\microsoft\windows\libraries\kgry99dw.crypted
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk в %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\akeoeeoj.crypted
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk в %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\lvzwelog.crypted
%APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink в %APPDATA%\microsoft\windows\sendto\k162m3no.crypted
%APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk в %APPDATA%\microsoft\windows\start menu\programs\4knem0bb.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\jm33pjb3.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\4qbf6lp9.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\lhxy5o1c.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\oafmnjtp.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\j26x39y2.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pluginreg.dat в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\2n1npqyv.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\7pbvi0z6.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\byhmt2yk.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\heml3gu8.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\rabtxv32.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\rtsxk5vy.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\6sx75i4q.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\4fh1pkcp.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\metirxru.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\o4f8xr36.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\voj3thfq.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\mv21getq.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\54swxpy9.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\5na6g74b.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\rtb0ya7y.crypted
%APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk в %APPDATA%\microsoft\windows\start menu\programs\maintenance\1cn0uxmp.crypted
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk в %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\koio5f4l.crypted
%APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk в %APPDATA%\microsoft\windows\start menu\programs\winrar\ozrw0m40.crypted
%APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk в %APPDATA%\microsoft\windows\start menu\programs\winrar\a9z09b4f.crypted
%APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk в %APPDATA%\microsoft\windows\start menu\programs\winrar\zo9eurgu.crypted
%APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk в %APPDATA%\microsoft\windows\start menu\programs\winrar\r5o5975q.crypted
%APPDATA%\microsoft\windows\themes\transcodedwallpaper.jpg в %APPDATA%\microsoft\windows\themes\hu37hajr.crypted
%APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 в %APPDATA%\mozilla\firefox\crash reports\j968oc6q.crypted
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk в %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\jis03vk7.crypted
%APPDATA%\mozilla\firefox\installs.ini в %APPDATA%\mozilla\firefox\9ivooktr.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\5ylbiwow.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\tc8vt6ky.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2024-08-28_11_de2a2eo29nunltkagq5ija==.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\xe2p2skf.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\wlaxtga7.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\n6hi0wpi.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\3nhreqkq.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\459qzu76.crypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\tu6xnw6o.crypted
%TEMP%\8ur3zpzx.crypted в %TEMP%\ru1nz9ya.crypted
%TEMP%\wallpaper.bmp в %TEMP%\n3csnvgs.crypted

Изменяет следующие файлы

%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\dial.bmp
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk
%APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk
%HOMEPATH%\desktop\dashborder_144.bmp
%APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
%APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk
%TEMP%\wallpaper.bmp
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%TEMP%\fxsapidebuglogfile.txt
%APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx

Изменяет множество файлов.

Подменяет следующие файлы

%HOMEPATH%\Desktop\508softwareandos.doc
%TEMP%\wallpaper.bmp
%HOMEPATH%\Desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\Desktop\dashBorder_144.bmp
%HOMEPATH%\Desktop\dashBorder_96.bmp
%HOMEPATH%\Desktop\default.bmp
%HOMEPATH%\Desktop\dial.bmp
%HOMEPATH%\Desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\Desktop\glidescope_review_rev_010.docx
%HOMEPATH%\Desktop\Google Chrome.lnk
%HOMEPATH%\Desktop\hanni_umami_chapter.doc
%HOMEPATH%\Desktop\holycrosschurchinstructions.docx
%HOMEPATH%\Desktop\Telegram.lnk
%HOMEPATH%\Desktop\TestCertificate.cer
%HOMEPATH%\Desktop\tileimage.bmp
%HOMEPATH%\Desktop\toolbar.bmp

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней