Trojan.Encoder.30941

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\runtime broker.exe
%APPDATA%\microsoft\windows\start menu\programs\startup\wannascream.hta

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\13.jpg
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\region-north-karelia.jpg
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\trivial-merge.htm
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\4f0bf7ff71f28.jpg
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\3.jpg
%HOMEPATH%\desktop\210252809.jpg
%HOMEPATH%\desktop\2.jpg
%HOMEPATH%\desktop\168.jpg
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\weeklysheet1215.doc

Изменения в файловой системе

Создает следующие файлы

%HOMEPATH%\desktop\info.txt
%LOCALAPPDATA%\microsoft\feeds cache\dp0qcmsh\info.txt
%APPDATA%\adobe\acrobat\dc\security\crlcache\info.txt
%APPDATA%\adobe\acrobat\dc\security\info.txt
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\info.txt
%LOCALAPPDATA%\adobe\acrobat\dc\cache\info.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\safebrowsing\info.txt
%LOCALAPPDATA%\microsoft\feeds cache\3v2zgiw9\info.txt
%LOCALAPPDATA%\microsoft\internet explorer\info.txt
%APPDATA%\icq-profile\update\info.txt
%APPDATA%\adobe\acrobat\dc\preferences\info.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cache2\entries\info.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\offlinecache\info.txt
%TEMP%\info.txt
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\info.txt
%LOCALAPPDATA%\steam\htmlcache\info.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\info.txt
%LOCALAPPDATA%\microsoft\internet explorer\domstore\info.txt
%APPDATA%\microsoft\internet explorer\quick launch\info.txt
%LOCALAPPDATA%\microsoft\media player\info.txt
%APPDATA%\microsoft\document building blocks\1033\14\info.txt
%APPDATA%\microsoft\dbgclr\7.1\info.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\info.txt
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\info.txt
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\info.txt
%APPDATA%\mirc\info.txt
%APPDATA%\mail.ru\agent\info.txt
%APPDATA%\icqm\icq\database\info.txt
%LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\info.txt
%LOCALAPPDATA%\microsoft\internet explorer\domstore\p4p79gg0\info.txt
%LOCALAPPDATA%\microsoft\feeds cache\evw7z7yu\info.txt
%LOCALAPPDATA%\microsoft\internet explorer\domstore\g32ifqhj\info.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\active\info.txt
%LOCALAPPDATA%\microsoft\internet explorer\domstore\1ilya49m\info.txt
%LOCALAPPDATA%\microsoft\feeds cache\e6k79x6b\info.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cache2\info.txt
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\info.txt
%LOCALAPPDATA%\opera software\opera stable\cache\info.txt
%APPDATA%\ghisler\info.txt
%LOCALAPPDATA%\adobe\color\info.txt
%LOCALAPPDATA%low\adobe\acrobat\dc\info.txt
%LOCALAPPDATA%\adobe\acrobat\dc\info.txt
%LOCALAPPDATA%\applicationhistory\info.txt
%HOMEPATH%\contacts\info.txt
%LOCALAPPDATA%\info.txt
%HOMEPATH%\videos\info.txt
%HOMEPATH%\pictures\info.txt
%HOMEPATH%\downloads\info.txt
%LOCALAPPDATA%\microsoft\windows\history\info.txt
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012016081820160819\info.txt
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012015112320151124\info.txt
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\info.txt
%HOMEPATH%\music\info.txt
%HOMEPATH%\documents\info.txt
%LOCALAPPDATA%low\microsoft\internet explorer\services\info.txt
%LOCALAPPDATA%low\oracle\java\au\info.txt
%APPDATA%\adobe\acrobat\dc\jscache\info.txt
%APPDATA%\adobe\acrobat\dc\info.txt
%LOCALAPPDATA%\microsoft\feeds\info.txt
%APPDATA%\icqm\info.txt
%APPDATA%\icq-profile\base\info.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\info.txt
%LOCALAPPDATA%\adobe\color\profiles\info.txt
%APPDATA%\icq-profile\info.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\info.txt
%LOCALAPPDATA%\microsoft\device metadata\info.txt
%LOCALAPPDATA%\msfree inc\info.txt
%LOCALAPPDATA%\google\chrome\user data\info.txt
%LOCALAPPDATA%\microsoft\dbgclr\7.1\info.txt
%APPDATA%\adobe\logtransport2\info.txt
%APPDATA%\adobe\flash player\nativecache\info.txt
%LOCALAPPDATA%low\sun\java\deployment\info.txt
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\info.txt
%LOCALAPPDATA%\microsoft\feeds cache\info.txt
%APPDATA%\microsoft\mmc\info.txt

Перемещает следующие файлы

%APPDATA%\ghisler\wincmd.ini в %APPDATA%\ghisler\wincmd.ini-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\opera software\opera stable\bookmarksextras в %APPDATA%\opera software\opera stable\bookmarksextras-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icq\dll\mailrusputnik.exe в %APPDATA%\icqm\icq\dll\mailrusputnik.exe-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mra\update\languages.aff в %APPDATA%\mra\update\languages.aff-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk в %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mail.ru\agent\magentsetup.exe в %APPDATA%\mail.ru\agent\magentsetup.exe-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\publisher building blocks\contentstore.xml в %APPDATA%\microsoft\publisher building blocks\contentstore.xml-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json в %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\opera software\opera stable\bookmarks.bak в %APPDATA%\opera software\opera stable\bookmarks.bak-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\qipguard\chrome.dll в %APPDATA%\qipguard\chrome.dll-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icq\dll\altergeo.msi в %APPDATA%\icqm\icq\dll\altergeo.msi-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mra\base\opt.dbs в %APPDATA%\mra\base\opt.dbs-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk в %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk в %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\opera software\opera stable\bookmarks в %APPDATA%\opera software\opera stable\bookmarks-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\qipguard\cache в %APPDATA%\qipguard\cache-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mozilla\firefox\crash reports\installtime20150415140819 в %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icq\database\citylist_uz.csv в %APPDATA%\icqm\icq\database\citylist_uz.csv-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mra\base\mra.dbs в %APPDATA%\mra\base\mra.dbs-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\internet explorer\quick launch\mail.ru agent.lnk в %APPDATA%\microsoft\internet explorer\quick launch\mail.ru agent.lnk-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mirc\scripts\popups.ini в %APPDATA%\mirc\scripts\popups.ini-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\dd_setuputility.txt в %TEMP%\dd_setuputility.txt-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mail.ru\agent\magent.exe в %APPDATA%\mail.ru\agent\magent.exe-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icq\database\citylist_ua.csv в %APPDATA%\icqm\icq\database\citylist_ua.csv-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mirc\scripts\aliases.ini в %APPDATA%\mirc\scripts\aliases.ini-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mra\installerlang.xml в %APPDATA%\mra\installerlang.xml-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\dd_vcredist_amd64_20151216210341.log в %TEMP%\dd_vcredist_amd64_20151216210341.log-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\msdn\7.0\objbrow.dat в %APPDATA%\microsoft\msdn\7.0\objbrow.dat-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\qipguard\qipguard.exe в %APPDATA%\qipguard\qipguard.exe-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\qipguard\sqlite3.dll в %APPDATA%\qipguard\sqlite3.dll-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\opera software\opera stable\cookies-journal в %APPDATA%\opera software\opera stable\cookies-journal-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mail.ru\agent\vplog.dat в %APPDATA%\mail.ru\agent\vplog.dat-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icq\fonts\segoesc.ttf в %APPDATA%\icqm\icq\fonts\segoesc.ttf-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\telegram desktop\log.txt в %APPDATA%\telegram desktop\log.txt-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\opera software\opera stable\cookies в %APPDATA%\opera software\opera stable\cookies-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\uproof\excludedictionaryen0809.lex в %APPDATA%\microsoft\uproof\excludedictionaryen0809.lex-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk в %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mail.ru\agent\vivo.dll в %APPDATA%\mail.ru\agent\vivo.dll-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini в %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mra\update\languages.hash в %APPDATA%\mra\update\languages.hash-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\templates\normal.dotm в %APPDATA%\microsoft\templates\normal.dotm-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\blocklist.xml в %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\blocklist.xml-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\opera software\opera stable\certificate revocation lists в %APPDATA%\opera software\opera stable\certificate revocation lists-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\uproof\excludedictionaryen0409.lex в %APPDATA%\microsoft\uproof\excludedictionaryen0409.lex-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\dd_vcredist_x86_20151216210157.log в %TEMP%\dd_vcredist_x86_20151216210157.log-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\internet explorer\quick launch\winamp.lnk в %APPDATA%\microsoft\internet explorer\quick launch\winamp.lnk-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mail.ru\agent\sciter32.dll в %APPDATA%\mail.ru\agent\sciter32.dll-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icq\dll\mousephone.dll в %APPDATA%\icqm\icq\dll\mousephone.dll-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mra\update\languages.dict в %APPDATA%\mra\update\languages.dict-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\opera software\opera stable\browser.js в %APPDATA%\opera software\opera stable\browser.js-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\qipguard\qipguard_upd.exe в %APPDATA%\qipguard\qipguard_upd.exe-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk в %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mail.ru\agent\mrainplaceviewer.dll в %APPDATA%\mail.ru\agent\mrainplaceviewer.dll-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icq\dll\mratag.dll в %APPDATA%\icqm\icq\dll\mratag.dll-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt в %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icq\database\citylist_tr.csv в %APPDATA%\icqm\icq\database\citylist_tr.csv-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yastatic.net\settings.sol в %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yastatic.net\settings.sol-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl в %APPDATA%\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icq-profile\update\vvlog.dat в %APPDATA%\icq-profile\update\vvlog.dat-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icqsetup.exe в %APPDATA%\icqm\icqsetup.exe-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\aspnetsetup_00000.log в %TEMP%\aspnetsetup_00000.log-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl в %APPDATA%\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\aspnetsetup.log в %TEMP%\aspnetsetup.log-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata в %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icq-profile\update\languages.hash в %APPDATA%\icq-profile\update\languages.hash-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\adobesfx.log в %TEMP%\adobesfx.log-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icq-profile\update\languages.dict в %APPDATA%\icq-profile\update\languages.dict-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\adobe\acrobat\dc\preferences\defaultheuristics.dat в %APPDATA%\adobe\acrobat\dc\preferences\defaultheuristics.dat-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\libvoip_x86.dll в %APPDATA%\icqm\libvoip_x86.dll-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icq.exe в %APPDATA%\icqm\icq.exe-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icq-profile\update\languages.aff в %APPDATA%\icq-profile\update\languages.aff-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\adobe\acrobat\dc\preferences\autofilldefaults.dat в %APPDATA%\adobe\acrobat\dc\preferences\autofilldefaults.dat-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\adobearm.log в %TEMP%\adobearm.log-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\adobe\acrobat\dc\jscache\globsettings в %APPDATA%\adobe\acrobat\dc\jscache\globsettings-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icq-profile\base\opt.dbs в %APPDATA%\icq-profile\base\opt.dbs-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\adobe\acrobat\dc\jscache\globdata в %APPDATA%\adobe\acrobat\dc\jscache\globdata-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icq-profile\base\mra.dbs в %APPDATA%\icq-profile\base\mra.dbs-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icq-profile\installerlang.xml в %APPDATA%\icq-profile\installerlang.xml-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\adobe\acrobat\dc\tmgrpprm.sav в %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\adobe\logtransport2\logtransport2.cfg в %APPDATA%\adobe\logtransport2\logtransport2.cfg-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\adobe\flash player\nativecache\nativecache.directory в %APPDATA%\adobe\flash player\nativecache\nativecache.directory-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\adobe\acrobat\dc\tmdocs.sav в %APPDATA%\adobe\acrobat\dc\tmdocs.sav-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\adobearm_notlocked.log в %TEMP%\adobearm_notlocked.log-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\cprogram files (x86)opera29.0.1795.47opera_autoupdate.download.lock в %TEMP%\cprogram files (x86)opera29.0.1795.47opera_autoupdate.download.lock-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\aspnetsetup_00001.log в %TEMP%\aspnetsetup_00001.log-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\mrainplaceviewer.dll в %APPDATA%\icqm\mrainplaceviewer.dll-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\settings.sol в %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\settings.sol-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx в %APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\office\mso1033.acl в %APPDATA%\microsoft\office\mso1033.acl-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icq\database\citylist_ru.csv в %APPDATA%\icqm\icq\database\citylist_ru.csv-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mozilla\firefox\profiles.ini в %APPDATA%\mozilla\firefox\profiles.ini-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\internet explorer\quick launch\icq.lnk в %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\network\connections\pbk\_hiddenpbk\rasphone.pbk в %APPDATA%\microsoft\network\connections\pbk\_hiddenpbk\rasphone.pbk-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\cvrf2a3.tmp.cvr в %TEMP%\cvrf2a3.tmp.cvr-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk в %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mirc\urls.ini в %APPDATA%\mirc\urls.ini-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\cvreaf2.tmp.cvr в %TEMP%\cvreaf2.tmp.cvr-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mirc\servers.ini в %APPDATA%\mirc\servers.ini-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icq\database\citylist_kz.csv в %APPDATA%\icqm\icq\database\citylist_kz.csv-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\mmc\taskschd в %APPDATA%\microsoft\mmc\taskschd-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\dbgclr\7.1\objbrow.dat в %APPDATA%\microsoft\dbgclr\7.1\objbrow.dat-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\cprogram files (x86)opera29.0.1795.47opera_autoupdate.metrics.lock в %TEMP%\cprogram files (x86)opera29.0.1795.47opera_autoupdate.metrics.lock-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol в %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\cvrde7f.tmp.cvr в %TEMP%\cvrde7f.tmp.cvr-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\fuid01.sol в %APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\fuid01.sol-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mirc\mirc.ini в %APPDATA%\mirc\mirc.ini-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mail.ru\agent\libvoip_x86.dll в %APPDATA%\mail.ru\agent\libvoip_x86.dll-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\icq\database\citylist_en.csv в %APPDATA%\icqm\icq\database\citylist_en.csv-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\cvrc867.tmp.cvr в %TEMP%\cvrc867.tmp.cvr-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\vplog.dat в %APPDATA%\icqm\vplog.dat-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\cvrbada.tmp.cvr в %TEMP%\cvrbada.tmp.cvr-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\vivo.dll в %APPDATA%\icqm\vivo.dll-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%TEMP%\cvr6b9c.tmp.cvr в %TEMP%\cvr6b9c.tmp.cvr-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\icqm\sciter32.dll в %APPDATA%\icqm\sciter32.dll-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\startmenu\icq.lnk в %APPDATA%\microsoft\internet explorer\quick launch\user pinned\startmenu\icq.lnk-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma
%APPDATA%\mra\update\vvlog.dat в %APPDATA%\mra\update\vvlog.dat-id.[1f6ca2b1].email=[decryptharma24@cock.li].harma

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Сетевая активность

TCP

Запросы HTTP GET

http://ic###azip.com/
http://re#######ata.merehosting.com/db
http://re#######ata.merehosting.com/db/

UDP

DNS ASK ic###azip.com
DNS ASK re#######ata.merehosting.com

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней