Trojan.Encoder.25363

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '*software32' = '%HOMEPATH%\Desktop\Dokir How to Decrypt Files dokir@protonmail.com.html'

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_23ef5514-3059-436f-a4a7-4cefaab20eb1dokirCrypted
C:\Far2\Plugins\Colorer\hrd\console\contrib\black_sezaldokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\contrib\black_aydokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\xmastreedokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\whitedokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\ncdokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\mirrordokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\hackdokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\graydokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\dnlikedokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\defaultdokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\contrib\classicdokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\bluedokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\catalog-textdokirCrypted.xml
C:\Far2\Plugins\Colorer\hrd\catalog-rgbdokirCrypted.xml
C:\Far2\Plugins\Colorer\hrd\catalog-consoledokirCrypted.xml
C:\Far2\Plugins\Colorer\hrc\auto\types\autodokirCrypted.jar
C:\Far2\Plugins\Colorer\hrc\auto\vimdokirCrypted.hrc
C:\Far2\Plugins\Colorer\hrc\auto\rare-scriptsdokirCrypted.hrc
C:\Far2\Plugins\Colorer\hrc\auto\qrmdokirCrypted.hrc
C:\Far2\Plugins\Colorer\hrc\auto\litestepdokirCrypted.hrc
C:\Far2\Plugins\Colorer\hrc\auto\gen.j2eedokirCrypted.hrc
C:\Far2\Plugins\Colorer\hrc\auto\gendokirCrypted.hrc
C:\Far2\Plugins\Colorer\hrd\console\blackdokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\contrib\cyberpunkdokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\contrib\gray_pultdokirCrypted.hrd
C:\Far2\Plugins\Colorer\hrd\console\contrib\oceandokirCrypted.hrd
C:\Far2\Plugins\EMenu\EMenuRusdokirCrypted.hlf
C:\Far2\Plugins\EMenu\EMenuEngdokirCrypted.lng
C:\Far2\Plugins\EMenu\EMenuEngdokirCrypted.hlf
C:\Far2\Plugins\EMenu\EMenudokirCrypted.map
C:\Far2\Plugins\EMenu\changelogdokirCrypted
C:\Far2\Plugins\EditCase\EditCasedokirCrypted.map
C:\Far2\Plugins\EditCase\ECaseRusdokirCrypted.lng
C:\Far2\Plugins\EditCase\ECaseRusdokirCrypted.hlf
C:\Far2\Plugins\EditCase\ECaseEngdokirCrypted.lng
C:\Far2\Plugins\EditCase\ECaseEngdokirCrypted.hlf
C:\Far2\Plugins\EditCase\changelogdokirCrypted
C:\Far2\Plugins\DrawLine\DrawRusdokirCrypted.lng
C:\Far2\Plugins\DrawLine\DrawRusdokirCrypted.hlf
C:\Far2\Plugins\DrawLine\DrawLinedokirCrypted.map
C:\Far2\Plugins\DrawLine\DrawEngdokirCrypted.lng
C:\Far2\Plugins\DrawLine\DrawEngdokirCrypted.hlf
C:\Far2\Plugins\DrawLine\changelogdokirCrypted
C:\Far2\Plugins\Compare\CompRusdokirCrypted.lng
C:\Far2\Plugins\Compare\CompEngdokirCrypted.lng
C:\Far2\Plugins\Compare\ComparedokirCrypted.map
C:\Far2\Plugins\Compare\CmpRusdokirCrypted.hlf
C:\Far2\Plugins\Compare\CmpEngdokirCrypted.hlf
C:\Far2\Plugins\Compare\changelogdokirCrypted
C:\Far2\Plugins\Colorer\hrc\auto\fartypesdokirCrypted.hrc
C:\Far2\Plugins\EMenu\EMenuRusdokirCrypted.lng
C:\Far2\Plugins\Colorer\hrc\auto\ccsqldokirCrypted.hrc
C:\Far2\Plugins\Colorer\hrc\php-prot.entdokirCrypted.hrc
C:\Far2\Plugins\arclite\arclite_rusdokirCrypted.hlf
C:\Far2\Plugins\arclite\arclite_engdokirCrypted.lng
C:\Far2\Plugins\arclite\arclite_engdokirCrypted.hlf
C:\Far2\Plugins\arclite\arclitedokirCrypted.map
C:\Far2\Plugins\arclite\7zSDdokirCrypted.sfx
C:\Far2\Plugins\arclite\7zS2condokirCrypted.sfx
C:\Far2\Plugins\arclite\7zS2dokirCrypted.sfx
C:\Far2\Plugins\arclite\7zCondokirCrypted.sfx
C:\Far2\Plugins\arclite\7zdokirCrypted.sfx
C:\Far2\Plugins\Align\changelogdokirCrypted
C:\Far2\Plugins\arclite\arclite_rusdokirCrypted.lng
C:\Far2\Plugins\Align\AlignRusdokirCrypted.lng
C:\Far2\Plugins\Align\AligndokirCrypted.map
C:\Far2\Plugins\7-Zip\far7zdokirCrypted.txt
C:\Far2\Plugins\7-Zip\far7zdokirCrypted.reg
C:\Far2\Plugins\7-Zip\7-ZipRusdokirCrypted.lng
C:\Far2\Plugins\7-Zip\7-ZipRusdokirCrypted.hlf
C:\Far2\Plugins\7-Zip\7-ZipEngdokirCrypted.lng
C:\Far2\Plugins\7-Zip\7-ZipEngdokirCrypted.hlf
C:\Far2\FExcept\changelogdokirCrypted
C:\Far2\Encyclopedia\FarEncyclopedia.rudokirCrypted.chm
C:\Far2\Documentation\rus\TechInfodokirCrypted.txt
C:\Far2\Plugins\Align\AlignEngdokirCrypted.lng
C:\Far2\Plugins\arclite\changelogdokirCrypted
C:\Far2\Plugins\AutoWrap\AutoWrapdokirCrypted.map
C:\Far2\Plugins\AutoWrap\changelogdokirCrypted
C:\Far2\Plugins\Colorer\hrc\msg.entdokirCrypted.hrc
C:\Far2\Plugins\Colorer\hrc\ini.entdokirCrypted.hrc
C:\Far2\Plugins\Colorer\hrc\commondokirCrypted.jar
C:\Far2\Plugins\Colorer\hrc\colorer.entdokirCrypted.hrc
C:\Far2\Plugins\Colorer\hrc\changesdokirCrypted.txt
C:\Far2\Plugins\Colorer\bin\shortcutsdokirCrypted.reg
C:\Far2\Plugins\Colorer\bin\colorerdokirCrypted.lng
C:\Far2\Plugins\Colorer\bin\colorerdokirCrypted.hlf
C:\Far2\Plugins\Colorer\bin\coloreedokirCrypted.lng
C:\Far2\Plugins\Colorer\bin\coloreedokirCrypted.hlf
C:\Far2\Plugins\Colorer\READMEdokirCrypted
C:\Far2\Plugins\Colorer\LICENSEdokirCrypted
C:\Far2\Plugins\Colorer\catalogdokirCrypted.xml
C:\Far2\Plugins\Brackets\changelogdokirCrypted
C:\Far2\Plugins\Brackets\BrackRusdokirCrypted.reg
C:\Far2\Plugins\Brackets\BrackRusdokirCrypted.lng
C:\Far2\Plugins\Brackets\BrackRusdokirCrypted.hlf
C:\Far2\Plugins\Brackets\BracketsdokirCrypted.map
C:\Far2\Plugins\Brackets\BrackEngdokirCrypted.reg
C:\Far2\Plugins\Brackets\BrackEngdokirCrypted.lng
C:\Far2\Plugins\Brackets\BrackEngdokirCrypted.hlf
C:\Far2\Plugins\AutoWrap\WrapRusdokirCrypted.lng
C:\Far2\Plugins\AutoWrap\WrapEngdokirCrypted.lng
C:\Far2\Plugins\Colorer\hrc\protodokirCrypted.hrc
C:\Far2\Plugins\EMenu\HotkeydokirCrypted.reg
C:\Far2\Plugins\EMenu\HotkeyClipboarddokirCrypted.reg
C:\Far2\Plugins\EMenu\HotkeyPropertiesdokirCrypted.reg
C:\Far2\Plugins\ProcList\changelogdokirCrypted
C:\Far2\Plugins\Network\NetworkdokirCrypted.map
C:\Far2\Plugins\Network\NetRusdokirCrypted.lng
C:\Far2\Plugins\Network\NetRusdokirCrypted.hlf
C:\Far2\Plugins\Network\NetEngdokirCrypted.lng
C:\Far2\Plugins\Network\NetEngdokirCrypted.hlf
C:\Far2\Plugins\Network\changelogdokirCrypted
C:\Far2\Plugins\MacroView\MacroViewdokirCrypted.map
C:\Far2\Plugins\MacroView\MacroRusdokirCrypted.lng
C:\Far2\Plugins\MacroView\MacroRusdokirCrypted.hlf
C:\Far2\Plugins\ProcList\ProcEngdokirCrypted.lng
C:\Far2\Plugins\ProcList\ProcEngdokirCrypted.hlf
C:\Far2\Plugins\MacroView\changelogdokirCrypted
C:\Far2\Plugins\HlfViewer\HlfViewerRusdokirCrypted.lng
C:\Far2\Plugins\HlfViewer\HlfViewerRusdokirCrypted.hlf
C:\Far2\Plugins\HlfViewer\HlfViewerEngdokirCrypted.lng
C:\Far2\Plugins\HlfViewer\HlfViewerEngdokirCrypted.hlf
C:\Far2\Plugins\HlfViewer\HlfViewerdokirCrypted.map
C:\Far2\Plugins\HlfViewer\changelogdokirCrypted
C:\Far2\Plugins\FTP\lib\Progress_ZeMAdokirCrypted.reg
C:\Far2\Plugins\FTP\lib\Progress_WeshadokirCrypted.reg
C:\Far2\Plugins\FTP\lib\Progress_JMdokirCrypted.reg
C:\Far2\Plugins\MacroView\MacroEngdokirCrypted.lng
C:\Muldrop\7-ZjqEohepljsCszqufedokirCrypted.img_0
C:\Far2\Plugins\ProcList\ProclistdokirCrypted.map
C:\Muldrop\0007F0B7epljsCszqufedokirCrypted.xqm_0
C:\Far2\PluginSDK\Headers.pas\PluginWdokirCrypted.pas
C:\Far2\PluginSDK\Headers.pas\FarKeysWdokirCrypted.pas
C:\Far2\PluginSDK\Headers.pas\FarColorWdokirCrypted.pas
C:\Far2\PluginSDK\Headers.c\plugindokirCrypted.hpp
C:\Far2\PluginSDK\Headers.c\farkeysdokirCrypted.hpp
C:\Far2\PluginSDK\Headers.c\farcolordokirCrypted.hpp
C:\Far2\Plugins\WinSCP\WinSCPdokirCrypted.lng
C:\Far2\Plugins\WinSCP\readmedokirCrypted
C:\Far2\Plugins\WinSCP\licencedokirCrypted
C:\Far2\Plugins\TmpPanel\TmpRusdokirCrypted.lng
C:\Far2\Plugins\TmpPanel\TmpRusdokirCrypted.hlf
C:\Far2\Plugins\TmpPanel\TmpPaneldokirCrypted.map
C:\Far2\Plugins\TmpPanel\TmpEngdokirCrypted.lng
C:\Far2\Plugins\TmpPanel\TmpEngdokirCrypted.hlf
C:\Far2\Plugins\TmpPanel\shortcuts.rusdokirCrypted.temp
C:\Far2\Plugins\TmpPanel\shortcuts.rusdokirCrypted.reg
C:\Far2\Plugins\TmpPanel\shortcuts.engdokirCrypted.temp
C:\Far2\Plugins\TmpPanel\shortcuts.engdokirCrypted.reg
C:\Far2\Plugins\TmpPanel\disks.rusdokirCrypted.temp
C:\Far2\Plugins\TmpPanel\disks.engdokirCrypted.temp
C:\Far2\Plugins\TmpPanel\changelogdokirCrypted
C:\Far2\Plugins\ProcList\ProcRusdokirCrypted.lng
C:\Far2\Plugins\FTP\lib\Progress_FarCopydokirCrypted.reg
C:\Far2\Plugins\MacroView\MacroEngdokirCrypted.hlf
C:\Far2\Plugins\FTP\lib\ftpProgressdokirCrypted.map
C:\Far2\Plugins\FTP\lib\ftpProgressdokirCrypted.fll
C:\Far2\Plugins\FTP\lib\ftpDirListdokirCrypted.map
C:\Far2\Plugins\ExtSearch\sources\ESEARCHdokirCrypted.BAT
C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALEdokirCrypted.CPP
C:\Far2\Plugins\ExtSearch\sources\PLUGINdokirCrypted.HPP
C:\Far2\Plugins\ExtSearch\sources\ExtSearchRegdokirCrypted.cpp
C:\Far2\Plugins\ExtSearch\sources\ExtSearchMixdokirCrypted.cpp
C:\Far2\Plugins\ExtSearch\sources\ExtSearchdokirCrypted.hpp
C:\Far2\Plugins\ExtSearch\sources\ExtSearchdokirCrypted.cpp
C:\Far2\Plugins\ExtSearch\sources\ExtRegExpdokirCrypted.cpp
C:\Far2\Plugins\ExtSearch\sources\ExtMenudokirCrypted.cpp
C:\Far2\Plugins\ExtSearch\sources\ExtClipBoarddokirCrypted.cpp
C:\Far2\Plugins\ExtSearch\sources\ExtChCasedokirCrypted.cpp
C:\Far2\Plugins\ExtSearch\keys\ES_RUSdokirCrypted.REG
C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXPdokirCrypted.CPP
C:\Far2\Plugins\ExtSearch\keys\ES_ENGdokirCrypted.REG
C:\Far2\Plugins\ExtSearch\doc\RUS_READdokirCrypted.TXT
C:\Far2\Plugins\ExtSearch\doc\RUS_NEWSdokirCrypted.TXT
C:\Far2\Plugins\ExtSearch\doc\REGEXPSdokirCrypted.TXT
C:\Far2\Plugins\ExtSearch\doc\ENG_READdokirCrypted.TXT
C:\Far2\Plugins\ExtSearch\doc\ENG_NEWSdokirCrypted.TXT
C:\Far2\Plugins\ExtSearch\ES_RUSdokirCrypted.LNG
C:\Far2\Plugins\ExtSearch\ES_RUSdokirCrypted.HLF
C:\Far2\Plugins\ExtSearch\ES_ENGdokirCrypted.LNG
C:\Far2\Plugins\ExtSearch\ES_ENGdokirCrypted.HLF
C:\Far2\Documentation\rus\Plugins.ReviewdokirCrypted.txt
C:\Far2\Plugins\FarCmds\changelogdokirCrypted
C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXPdokirCrypted.H
C:\Far2\Plugins\FarCmds\FARCmdsEngdokirCrypted.hlf
C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALEdokirCrypted.H
C:\Far2\Plugins\FTP\lib\ftpDirListdokirCrypted.fll
C:\Far2\Plugins\FTP\TechInfo_rusdokirCrypted.reg
C:\Far2\Plugins\FTP\TechInfodokirCrypted.reg
C:\Far2\Plugins\FTP\Notes_rusdokirCrypted.txt
C:\Far2\Plugins\FTP\NotesdokirCrypted.txt
C:\Far2\Plugins\FTP\FtpRusdokirCrypted.lng
C:\Far2\Plugins\FTP\FtpRusdokirCrypted.hlf
C:\Far2\Plugins\FTP\FtpEngdokirCrypted.lng
C:\Far2\Plugins\FTP\FtpEngdokirCrypted.hlf
C:\Far2\Plugins\FTP\FtpCmds_rusdokirCrypted.txt
C:\Far2\Plugins\FTP\FtpCmdsdokirCrypted.txt
C:\Far2\Plugins\FTP\FarFtpdokirCrypted.map
C:\Far2\Plugins\FTP\changelogdokirCrypted
C:\Far2\Plugins\FileCase\FileCasedokirCrypted.map
C:\Far2\Plugins\FileCase\changelogdokirCrypted
C:\Far2\Plugins\FileCase\CaseRusdokirCrypted.lng
C:\Far2\Plugins\FileCase\CaseRusdokirCrypted.hlf
C:\Far2\Plugins\FileCase\CaseEngdokirCrypted.lng
C:\Far2\Plugins\FileCase\CaseEngdokirCrypted.hlf
C:\Far2\Plugins\FarCmds\FARCmdsRusdokirCrypted.lng
C:\Far2\Plugins\FarCmds\FARCmdsRusdokirCrypted.hlf
C:\Far2\Plugins\FarCmds\FARCmdsEngdokirCrypted.lng
C:\Far2\Plugins\FarCmds\FARCmdsdokirCrypted.map
C:\Far2\Plugins\ProcList\ProcRusdokirCrypted.hlf
C:\Far2\Documentation\rus\Plugins.InstalldokirCrypted.txt
C:\Far2\Addons\Macros\View.NextPrevFiledokirCrypted.reg
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookiesdokirCrypted.sqlite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefsdokirCrypted.sqlite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstoredokirCrypted.sqlite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8dokirCrypted.db
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarksdokirCrypted.html
%APPDATA%\Microsoft\Windows\Themes\CustomdokirCrypted.theme
%APPDATA%\Microsoft\Media Player\0007F0B7dokirCrypted.wpl
%APPDATA%\Microsoft\Internet Explorer\DesktopdokirCrypted.htt
%APPDATA%\Microsoft\Internet Explorer\brndlogdokirCrypted.txt
%APPDATA%\Microsoft\Address Book\%USERNAME%dokirCrypted.wab~
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloadsdokirCrypted.sqlite
%APPDATA%\Microsoft\Address Book\%USERNAME%dokirCrypted.wab
C:\Documents and Settings\Default User\Templates\winword2dokirCrypted.doc
C:\Documents and Settings\Default User\Templates\winworddokirCrypted.doc
C:\Documents and Settings\Default User\Templates\quattrodokirCrypted.wb2
C:\Documents and Settings\Default User\Templates\presentadokirCrypted.shw
C:\Documents and Settings\Default User\Templates\powerpntdokirCrypted.ppt
C:\Documents and Settings\Default User\Templates\lotusdokirCrypted.wk4
C:\Documents and Settings\Default User\Templates\excel4dokirCrypted.xls
C:\Documents and Settings\Default User\Templates\exceldokirCrypted.xls
C:\Documents and Settings\Default User\Templates\amiprodokirCrypted.sam
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNSdokirCrypted.XML
%APPDATA%\winscpdokirCrypted.rnd
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensionsdokirCrypted.sqlite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistorydokirCrypted.sqlite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3dokirCrypted.db
%HOMEPATH%\Templates\winworddokirCrypted.doc
%HOMEPATH%\Templates\quattrodokirCrypted.wb2
%HOMEPATH%\Templates\presentadokirCrypted.shw
%HOMEPATH%\Templates\powerpntdokirCrypted.ppt
%HOMEPATH%\Templates\lotusdokirCrypted.wk4
%HOMEPATH%\Templates\excel4dokirCrypted.xls
%HOMEPATH%\Templates\exceldokirCrypted.xls
%HOMEPATH%\Templates\amiprodokirCrypted.sam
%HOMEPATH%\Favorites\Links\Windows MarketplacedokirCrypted.url
%HOMEPATH%\Favorites\Radio Station GuidedokirCrypted.url
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-exampledokirCrypted.css
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-exampledokirCrypted.css
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10dokirCrypted.json
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstoredokirCrypted.sqlite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signonsdokirCrypted.sqlite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmoddokirCrypted.db
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\searchdokirCrypted.sqlite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\searchdokirCrypted.json
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefsdokirCrypted.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\placesdokirCrypted.sqlite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissionsdokirCrypted.sqlite
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypesdokirCrypted.rdf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstoredokirCrypted.rdf
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNSdokirCrypted.DTD
%HOMEPATH%\Templates\winword2dokirCrypted.doc
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59RdokirCrypted.wmdb
%ALLUSERSPROFILE%\DRM\drmv2dokirCrypted.sst
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-offdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kickdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horsesdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitardokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frogdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fishdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duckdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dripdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dogdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bikedokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm treedokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chessdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cardokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterflydokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beachdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\balldokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronautdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplanedokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%dokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guestdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\drwtsn32dokirCrypted.log
<LS_APPDATA>\encrypted.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\catdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flowerdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flowerdokirCrypted.bmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skaterdokirCrypted.bmp
%ALLUSERSPROFILE%\DRM\drmv2dokirCrypted.lic
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\WinterdokirCrypted.jpg
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water liliesdokirCrypted.jpg
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\SunsetdokirCrypted.jpg
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hillsdokirCrypted.jpg
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst9dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst8dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst7dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst6dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst5dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst4dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst3dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst2dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst15dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst14dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst13dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst12dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst11dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst10dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Plylst1dokirCrypted.wpl
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues)dokirCrypted.wma
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo)dokirCrypted.wma
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflakedokirCrypted.bmp
C:\Documents and Settings\Default User\NTUSERdokirCrypted.DAT
C:\Far2\changelogdokirCrypted
C:\Far2\changelog_engdokirCrypted
C:\Far2\fardokirCrypted.map
C:\Far2\Addons\Macros\ShiftBSdokirCrypted.reg
C:\Far2\Addons\Macros\Panel.SpaceToSelectdokirCrypted.reg
C:\Far2\Addons\Macros\Panel.SelectFromClipboarddokirCrypted.reg
C:\Far2\Addons\Macros\Panel.NumpaddokirCrypted.reg
C:\Far2\Addons\Macros\Panel.MouseWheelTiltdokirCrypted.reg
C:\Far2\Addons\Macros\Panel.Lynx-motdokirCrypted.reg
C:\Far2\Addons\Macros\Panel.JumpToSelectedFiledokirCrypted.reg
C:\Far2\Addons\Macros\Panel.EscdokirCrypted.reg
C:\Far2\Addons\Macros\Panel.DeldokirCrypted.reg
C:\Far2\Addons\Macros\Panel.CtrlShiftPgUpDndokirCrypted.reg
C:\Far2\Addons\Macros\ShiftTabdokirCrypted.reg
C:\Far2\Addons\Macros\ShiftF1dokirCrypted.reg
C:\Far2\Addons\Macros\Panel.CtrlQdokirCrypted.reg
C:\Far2\Addons\Macros\Panel.CtrlLeftdokirCrypted.reg
C:\Far2\Addons\Macros\Panel.CtrlIns..dokirCrypted.reg
C:\Far2\Addons\Macros\Panel.BSdokirCrypted.reg
C:\Far2\Addons\Macros\Panel.AppsdokirCrypted.reg
C:\Far2\Addons\Macros\Panel.AltBSdokirCrypted.reg
C:\Far2\Addons\Macros\OpeningLastFiledokirCrypted.reg
C:\Far2\Addons\Macros\MacroConstsdokirCrypted.reg
C:\Far2\Addons\Macros\F9TabledokirCrypted.reg
C:\Far2\Addons\Macros\F9DeactivateMenudokirCrypted.reg
C:\Far2\Addons\Macros\Panel.CtrlShiftBackSlashdokirCrypted.reg
C:\Far2\Documentation\rus\Bug.ReportdokirCrypted.txt
C:\Far2\Addons\Macros\View.CtrlUpDowndokirCrypted.reg
C:\Far2\Documentation\rus\Arc.SupportdokirCrypted.txt
C:\Far2\Documentation\eng\TechInfodokirCrypted.txt
C:\Far2\Documentation\eng\Plugins.ReviewdokirCrypted.txt
C:\Far2\Documentation\eng\Plugins.InstalldokirCrypted.txt
C:\Far2\Documentation\eng\Far.FAQdokirCrypted.txt
C:\Far2\Documentation\eng\Bug.ReportdokirCrypted.txt
C:\Far2\Documentation\eng\Arc.SupportdokirCrypted.txt
C:\Far2\Addons\XLat\Russian\QwertydokirCrypted.reg
C:\Far2\Addons\XLat\Russian\DescriptdokirCrypted.ion
C:\Far2\Addons\XLat\Russian\CtrlShiftXdokirCrypted.reg
C:\Far2\Addons\XLat\Russian\CtrlRdokirCrypted.reg
C:\Far2\Addons\XLat\Russian\AppsdokirCrypted.reg
C:\Far2\Addons\XLat\Russian\AltRdokirCrypted.reg
C:\Far2\Addons\Shell\FARHeredokirCrypted.inf
C:\Far2\Addons\SetUp\WindowsGUIdokirCrypted.reg
C:\Far2\Addons\SetUp\Executor.CMDdokirCrypted.reg
C:\Far2\Addons\SetUp\Executor.4NTdokirCrypted.reg
C:\Far2\Addons\SetUp\DescriptdokirCrypted.ion
C:\Far2\Addons\SetUp\Default165dokirCrypted.reg
C:\Far2\Addons\Macros\WheelScreenSwitchdokirCrypted.reg
C:\Far2\Addons\Macros\View.SpacedokirCrypted.reg
C:\Far2\Addons\Macros\View.ShiftInsSearchdokirCrypted.reg
C:\Far2\Addons\Macros\View.PgDndokirCrypted.reg
C:\Far2\Addons\Macros\F3dokirCrypted.reg
C:\Far2\Addons\Macros\Panel.CtrlRightdokirCrypted.reg
C:\Far2\Addons\Macros\Edit.SaveFiledokirCrypted.reg
C:\Far2\Addons\Macros\Edit.SaveAndExitdokirCrypted.reg
C:\Far2\Addons\Macros\Edit.NotepaddokirCrypted.reg
C:\Far2\Addons\DescriptdokirCrypted.ion
C:\Far2\Addons\Colors\Custom Highlighting\dn_likedokirCrypted.reg
C:\Far2\Addons\Colors\Custom Highlighting\DescriptdokirCrypted.ion
C:\Far2\Addons\Colors\Custom Highlighting\Colors_from_SadovojdokirCrypted.reg
C:\Far2\Addons\Colors\Custom Highlighting\Colors_from_GernichenkodokirCrypted.reg
C:\Far2\Addons\Colors\Custom Highlighting\Colors_from_admin_essp_rudokirCrypted.reg
C:\Far2\Addons\Colors\Custom Highlighting\black_from_MyodovdokirCrypted.reg
C:\Far2\Addons\Colors\Custom Highlighting\black_from_julydokirCrypted.reg
C:\Far2\Addons\Colors\Custom Highlighting\black_from_FonarevdokirCrypted.reg
C:\Far2\Addons\Colors\DescriptdokirCrypted.ion
C:\Far2\Addons\READMEdokirCrypted.TXT
C:\Far2\File_iddokirCrypted.diz
C:\Far2\Addons\Colors\Custom Highlighting\GreenMiledokirCrypted.reg
C:\Far2\FarSpadokirCrypted.lng
C:\Far2\FarRusdokirCrypted.lng
C:\Far2\FarRusdokirCrypted.hlf
C:\Far2\FarPoldokirCrypted.lng
C:\Far2\FarHundokirCrypted.lng
C:\Far2\FarHundokirCrypted.hlf
C:\Far2\FarGerdokirCrypted.lng
C:\Far2\FarEngdokirCrypted.lng
C:\Far2\FarEngdokirCrypted.hlf
C:\Far2\FarCzedokirCrypted.lng
C:\Far2\Documentation\rus\Far.FAQdokirCrypted.txt
C:\Far2\Addons\Colors\Custom Highlighting\nc5pal2dokirCrypted.reg
C:\Far2\Addons\Colors\Custom Highlighting\helldokirCrypted.reg
C:\Far2\Addons\Colors\Custom Highlighting\VaxColorsdokirCrypted.reg
C:\Far2\Addons\Colors\Custom Highlighting\FARColors242dokirCrypted.reg
C:\Far2\Addons\Macros\Dialog.AltDowndokirCrypted.reg
C:\Far2\Addons\Macros\DescriptdokirCrypted.ion
C:\Far2\Addons\Macros\CtrlF10dokirCrypted.reg
C:\Far2\Addons\Macros\CtrlDeldokirCrypted.reg
C:\Far2\Addons\Macros\AltXdokirCrypted.reg
C:\Far2\Addons\Macros\AltSearchdokirCrypted.reg
C:\Far2\Addons\Macros\AltScreensdokirCrypted.reg
C:\Far2\Addons\Macros\AltMenudokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\VaxColorsdokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\Rodion_DoroshkevichdokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\nc5pal2dokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\helldokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\GreenMiledokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\FARColors242dokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\dn_likedokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\DescriptdokirCrypted.ion
C:\Far2\Addons\Colors\Default Highlighting\Colors_from_SadovojdokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\Colors_from_GernichenkodokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\Colors_from_admin_essp_rudokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\black_from_MyodovdokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\black_from_julydokirCrypted.reg
C:\Far2\Addons\Colors\Default Highlighting\black_from_FonarevdokirCrypted.reg
C:\Far2\Addons\Colors\Custom Highlighting\Rodion_DoroshkevichdokirCrypted.reg
C:\Muldrop\7-ZjqEohepljsCszqufedokirCrypted.moh_0

Удаляет следующие файлы:

C:\Muldrop\0007F0B7epljsCszqufe.xqm_0
C:\Muldrop\7-ZjqEohepljsCszqufe.img_0
C:\Muldrop\7-ZjqEohepljsCszqufe.moh_0

Создает файлы с требованием оплатить расшифровку файлов (Trojan.Encoder).

Другое:

Запускает на исполнение:

'<SYSTEM32>\schtasks.exe' /create /tn Java Task Scheduler /tr "\"<Полный путь к файлу>\" arguments" /sc MINUTE /mo 5 /RU SYSTEM

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней