Trojan.Encoder.31196

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\correct.avi
<Имя диска съемного носителя>:\iisstart.htm
<Имя диска съемного носителя>:\advice_process.htm
<Имя диска съемного носителя>:\garden.htm
<Имя диска съемного носителя>:\browse.html
<Имя диска съемного носителя>:\iisstart.html
<Имя диска съемного носителя>:\api-hashmap.html
<Имя диска съемного носителя>:\adadsi.html
<Имя диска съемного носителя>:\parnas_01.jpeg
<Имя диска съемного носителя>:\13.jpeg
<Имя диска съемного носителя>:\1189.jpeg
<Имя диска съемного носителя>:\210252809.jpeg
<Имя диска съемного носителя>:\pushkin.jpeg
<Имя диска съемного носителя>:\3.jpeg
<Имя диска съемного носителя>:\weeklysheet1215.doc
<Имя диска съемного носителя>:\4f0bf7ff71f28.jpeg
<Имя диска съемного носителя>:\4f0bf7ff71f28.jpg
<Имя диска съемного носителя>:\parnas_01.jpg
<Имя диска съемного носителя>:\region-north-karelia.jpg
<Имя диска съемного носителя>:\210252809.jpg
<Имя диска съемного носителя>:\scan.mov
<Имя диска съемного носителя>:\etc6_m_1.mov
<Имя диска съемного носителя>:\dag2_panel1_320_ref.mov
<Имя диска съемного носителя>:\51.mp4
<Имя диска съемного носителя>:\clip_480_5sec_6mbps_h264.mp4
<Имя диска съемного носителя>:\d0068197bb5a41fea16a220c45390606.mp4
<Имя диска съемного носителя>:\video_1.mp4
<Имя диска съемного носителя>:\ff_ot_user_guide.pdf
<Имя диска съемного носителя>:\fil_20060629111052.pdf
<Имя диска съемного носителя>:\trivial-merge.htm
<Имя диска съемного носителя>:\ituneshelpunavailable.htm
<Имя диска съемного носителя>:\browse.htm
<Имя диска съемного носителя>:\jre-7u75-windows-i586-iftw.exe
<Имя диска съемного носителя>:\calc.exe
<Имя диска съемного носителя>:\split.avi
<Имя диска съемного носителя>:\archer.avi
<Имя диска съемного носителя>:\default.bmp
<Имя диска съемного носителя>:\toolbar.bmp
<Имя диска съемного носителя>:\coffee.bmp
<Имя диска съемного носителя>:\dashborder_144.bmp
<Имя диска съемного носителя>:\dashborder_120.bmp
<Имя диска съемного носителя>:\dashborder_192.bmp
<Имя диска съемного носителя>:\testee.cer
<Имя диска съемного носителя>:\sdksampleprivdeveloper.cer
<Имя диска съемного носителя>:\contoso.cer
<Имя диска съемного носителя>:\cveuropeo.doc
<Имя диска съемного носителя>:\508softwareandos.doc
<Имя диска съемного носителя>:\7790_preview.pdf
<Имя диска съемного носителя>:\2.jpg
<Имя диска съемного носителя>:\ovp25012015.doc
<Имя диска съемного носителя>:\fi51.doc
<Имя диска съемного носителя>:\hadac_newsletter_july_2010_final.docx
<Имя диска съемного носителя>:\holycrosschurchinstructions.docx
<Имя диска съемного носителя>:\aoc_saq_d_v3_merchant.docx
<Имя диска съемного носителя>:\glidescope_review_rev_010.docx
<Имя диска съемного носителя>:\nwfieldnotes1966.docx
<Имя диска съемного носителя>:\sdszfo.docx
<Имя диска съемного носителя>:\file_p_00000000_1371597592.docx
<Имя диска съемного носителя>:\thlps_keeper_mayer_1965.docx
<Имя диска съемного носителя>:\utorrent.exe
<Имя диска съемного носителя>:\chromesetup.exe
<Имя диска съемного носителя>:\tcm851ax32.exe
<Имя диска съемного носителя>:\skypesetup.exe
<Имя диска съемного носителя>:\join.avi
<Имя диска съемного носителя>:\lisp_success.doc
<Имя диска съемного носителя>:\2015-02-worms-nanoparticle-toxicity.pdf

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\210252809.jpeg
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\region-north-karelia.jpeg
%HOMEPATH%\desktop\ituneshelpunavailable.htm
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\3.jpeg
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\weeklysheet1215.doc

Изменения в файловой системе

Создает следующие файлы

C:\!!! read this !!!.hta
%ProgramFiles%\claw95cf\how to recover encrypted files.txt
%ProgramFiles%\cleaner\!!! read this !!!.hta
%ProgramFiles%\cleaner\how to recover encrypted files.txt
%ProgramFiles%\cleaner3\!!! read this !!!.hta
%ProgramFiles%\cleaner3\how to recover encrypted files.txt
%ProgramFiles%\claw95\how to recover encrypted files.txt
%ProgramFiles%\claw95cf\!!! read this !!!.hta
%ProgramFiles%\clisvc\!!! read this !!!.hta
%ProgramFiles%\clrcche\how to recover encrypted files.txt
%ProgramFiles%\cmain\!!! read this !!!.hta
%ProgramFiles%\cmain\how to recover encrypted files.txt
%ProgramFiles%\cmgrdian\!!! read this !!!.hta
%ProgramFiles%\cmgrdian\how to recover encrypted files.txt
%ProgramFiles%\clisvc\how to recover encrypted files.txt
%ProgramFiles%\clrcche\!!! read this !!!.hta
%CommonProgramFiles%\how to recover encrypted files.txt
%CommonProgramFiles%\!!! read this !!!.hta
%ProgramFiles%\clamwin\!!! read this !!!.hta
%ProgramFiles%\ccproxy\!!! read this !!!.hta
%ProgramFiles%\ccproxy\how to recover encrypted files.txt
%ProgramFiles%\ccsetmgr\!!! read this !!!.hta
%ProgramFiles%\ccsetmgr\how to recover encrypted files.txt
%ProgramFiles%\clamwin\how to recover encrypted files.txt
%ProgramFiles%\ccleaner\!!! read this !!!.hta
%ProgramFiles%\claw95\!!! read this !!!.hta
%ProgramFiles%\cemrep\!!! read this !!!.hta
%ProgramFiles%\clamscan\!!! read this !!!.hta
%ProgramFiles%\clamscan\how to recover encrypted files.txt
%ProgramFiles%\clamtray\!!! read this !!!.hta
%ProgramFiles%\clamtray\how to recover encrypted files.txt
%ProgramFiles%\cemrep\how to recover encrypted files.txt
%ProgramFiles%\chrome\!!! read this !!!.hta
%ProgramFiles%\chrome\how to recover encrypted files.txt
%ProgramFiles%\cabalmain\how to recover encrypted files.txt
%CommonProgramFiles%\designer\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\ar-sa\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\bg-bg\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\cs-cz\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\cs-cz\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\da-dk\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\ar-sa\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\da-dk\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\bg-bg\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\de-de\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\el-gr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\es-es\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\de-de\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\el-gr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\help\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\dw\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\dw\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\equation\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\equation\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\equation\1033\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\equation\1033\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\euro\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\filters\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\filters\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\grphflt\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\grphflt\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\help\!!! read this !!!.hta
%ProgramFiles%\ccevtmgr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\euro\how to recover encrypted files.txt
%ProgramFiles%\ccleaner\how to recover encrypted files.txt
%ProgramFiles%\ccevtmgr\!!! read this !!!.hta
%ProgramFiles%\ccapp\how to recover encrypted files.txt
%ProgramFiles%\ccapp\!!! read this !!!.hta
%ProgramFiles%\bdswitch\how to recover encrypted files.txt
%ProgramFiles%\bdwizreg\!!! read this !!!.hta
%ProgramFiles%\bdwizreg\how to recover encrypted files.txt
%ProgramFiles%\blackd\!!! read this !!!.hta
%ProgramFiles%\bdsurvey\!!! read this !!!.hta
%ProgramFiles%\bdsubmitwiz\!!! read this !!!.hta
%ProgramFiles%\bdswitch\!!! read this !!!.hta
%ProgramFiles%\blackd\how to recover encrypted files.txt
%ProgramFiles%\blindman\how to recover encrypted files.txt
%ProgramFiles%\btini\!!! read this !!!.hta
%ProgramFiles%\btini\how to recover encrypted files.txt
%ProgramFiles%\btinint\!!! read this !!!.hta
%ProgramFiles%\blackice\!!! read this !!!.hta
%ProgramFiles%\blackice\how to recover encrypted files.txt
%ProgramFiles%\blindman\!!! read this !!!.hta
%ProgramFiles%\bdsubmitwiz\how to recover encrypted files.txt
%ProgramFiles%\bdsubmit\how to recover encrypted files.txt
%ProgramFiles%\btinint\how to recover encrypted files.txt
%ProgramFiles%\b2\how to recover encrypted files.txt
%ProgramFiles%\backweb-4476822\!!! read this !!!.hta
%ProgramFiles%\backweb-4476822\how to recover encrypted files.txt
%ProgramFiles%\bdagent\!!! read this !!!.hta
%ProgramFiles%\bdagent\how to recover encrypted files.txt
%ProgramFiles%\bdmcon\!!! read this !!!.hta
%ProgramFiles%\b2\!!! read this !!!.hta
%ProgramFiles%\bdmcon\how to recover encrypted files.txt
%ProgramFiles%\bdnews\how to recover encrypted files.txt
%ProgramFiles%\bdoesrv\!!! read this !!!.hta
%ProgramFiles%\bdoesrv\how to recover encrypted files.txt
%ProgramFiles%\bdss\!!! read this !!!.hta
%ProgramFiles%\bdss\how to recover encrypted files.txt
%ProgramFiles%\bdsubmit\!!! read this !!!.hta
%ProgramFiles%\bdnews\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\es-es\how to recover encrypted files.txt
%CommonProgramFiles%\designer\how to recover encrypted files.txt
%ProgramFiles%\cabalmain\!!! read this !!!.hta
%ProgramFiles%\cavapp\!!! read this !!!.hta
%ProgramFiles%\cavsn\!!! read this !!!.hta
%ProgramFiles%\cavsn\how to recover encrypted files.txt
%ProgramFiles%\cavsub\!!! read this !!!.hta
%ProgramFiles%\cavsub\how to recover encrypted files.txt
%ProgramFiles%\cavscons\how to recover encrypted files.txt
%ProgramFiles%\cavsubmit\!!! read this !!!.hta
%ProgramFiles%\cavse\how to recover encrypted files.txt
%ProgramFiles%\cavumas\!!! read this !!!.hta
%ProgramFiles%\cavuserupd\!!! read this !!!.hta
%ProgramFiles%\cavuserupd\how to recover encrypted files.txt
%ProgramFiles%\cavvl\!!! read this !!!.hta
%ProgramFiles%\cavvl\how to recover encrypted files.txt
%ProgramFiles%\cavsubmit\how to recover encrypted files.txt
%ProgramFiles%\bdsurvey\how to recover encrypted files.txt
%ProgramFiles%\cavumas\how to recover encrypted files.txt
%ProgramFiles%\cavse\!!! read this !!!.hta
%ProgramFiles%\cavscons\!!! read this !!!.hta
%ProgramFiles%\cavq\how to recover encrypted files.txt
%ProgramFiles%\cavapp\how to recover encrypted files.txt
%ProgramFiles%\cavasm\!!! read this !!!.hta
%ProgramFiles%\cavasm\how to recover encrypted files.txt
%ProgramFiles%\cavaud\!!! read this !!!.hta
%ProgramFiles%\cavaud\how to recover encrypted files.txt
%ProgramFiles%\cafix\how to recover encrypted files.txt
%ProgramFiles%\cavemsrv\!!! read this !!!.hta
%ProgramFiles%\cavmr\!!! read this !!!.hta
%ProgramFiles%\cavmr\how to recover encrypted files.txt
%ProgramFiles%\cavmud\!!! read this !!!.hta
%ProgramFiles%\cavmud\how to recover encrypted files.txt
%ProgramFiles%\cavoar\!!! read this !!!.hta
%ProgramFiles%\cavoar\how to recover encrypted files.txt
%ProgramFiles%\cavemsrv\how to recover encrypted files.txt
%ProgramFiles%\cavq\!!! read this !!!.hta
%ProgramFiles%\cafix\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\ko-kr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fi-fi\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\msinfo\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\msinfo\en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\msinfo\en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\msclientdatamgr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\cultures\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\1033\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\1033\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\cultures\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\et-ee\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\source engine\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\source engine\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\smart tag\1033\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\stationery\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\smart tag\lists\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\textconv\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\textconv\en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\textconv\en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\stationery\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\smart tag\1033\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\textconv\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\smart tag\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\smart tag\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\proof\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\proof\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\msclientdatamgr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\msinfo\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\zh-tw\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\zh-tw\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\zh-cn\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\he-il\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\he-il\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\it-it\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\it-it\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\hu-hu\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\hu-hu\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\ja-jp\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fr-fr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fr-fr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fi-fi\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\et-ee\how to recover encrypted files.txt
%ProgramFiles%\avsynmgr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\ja-jp\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\lt-lt\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\sl-si\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\sv-se\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\sk-sk\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\sv-se\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\sl-si\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\th-th\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\tr-tr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\uk-ua\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\uk-ua\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\zh-cn\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\th-th\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\tr-tr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\sk-sk\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\ru-ru\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\ru-ru\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\lv-lv\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\lv-lv\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\nb-no\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\nb-no\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\nl-nl\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\lt-lt\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\nl-nl\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\pl-pl\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\pt-br\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\pt-br\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\pt-pt\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\pt-pt\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\ro-ro\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\pl-pl\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\ro-ro\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\ko-kr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\!!! read this !!!.hta
%ProgramFiles%\avsynmgr\!!! read this !!!.hta
%ProgramFiles%\avginet\!!! read this !!!.hta
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\!!! read this !!!.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\how to recover encrypted files.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\!!! read this !!!.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\how to recover encrypted files.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\how to recover encrypted files.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\!!! read this !!!.hta
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\far2\plugins\tmppanel\!!! read this !!!.hta
C:\far2\plugins\tmppanel\how to recover encrypted files.txt
C:\far2\pluginsdk\!!! read this !!!.hta
C:\far2\pluginsdk\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\far2\plugins\proclist\!!! read this !!!.hta
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\far2\pluginsdk\headers.c\!!! read this !!!.hta
C:\msocache\!!! read this !!!.hta
C:\msocache\how to recover encrypted files.txt
C:\msocache\all users\!!! read this !!!.hta
C:\msocache\all users\how to recover encrypted files.txt
C:\far2\pluginsdk\headers.c\how to recover encrypted files.txt
C:\far2\pluginsdk\headers.pas\!!! read this !!!.hta
C:\far2\pluginsdk\headers.pas\how to recover encrypted files.txt
C:\far2\documentation\rus\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
%ProgramFiles%\how to recover encrypted files.txt
%ProgramFiles%\360tray\how to recover encrypted files.txt
%ProgramFiles%\a2cmd\!!! read this !!!.hta
%ProgramFiles%\a2cmd\how to recover encrypted files.txt
%ProgramFiles%\a2guard\!!! read this !!!.hta
%ProgramFiles%\!!! read this !!!.hta
%ProgramFiles%\a2guard\how to recover encrypted files.txt
%ProgramFiles%\360tray\!!! read this !!!.hta
%ProgramFiles%\a2hijackfree\how to recover encrypted files.txt
%ProgramFiles%\a2scan\how to recover encrypted files.txt
%ProgramFiles%\a2service\!!! read this !!!.hta
%ProgramFiles%\a2service\how to recover encrypted files.txt
%ProgramFiles%\a2start\!!! read this !!!.hta
%ProgramFiles%\a2hijackfree\!!! read this !!!.hta
C:\perflogs\admin\how to recover encrypted files.txt
%ProgramFiles%\a2scan\!!! read this !!!.hta
C:\perflogs\admin\!!! read this !!!.hta
C:\perflogs\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\!!! read this !!!.hta
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\!!! read this !!!.hta
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\how to recover encrypted files.txt
C:\perflogs\!!! read this !!!.hta
C:\far2\plugins\network\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\how to recover encrypted files.txt
C:\far2\plugins\proclist\how to recover encrypted files.txt
C:\far2\plugins\network\!!! read this !!!.hta
C:\far2\plugins\macroview\how to recover encrypted files.txt
C:\far2\plugins\macroview\!!! read this !!!.hta
C:\far2\addons\macros\how to recover encrypted files.txt
C:\far2\addons\setup\!!! read this !!!.hta
C:\far2\addons\setup\how to recover encrypted files.txt
C:\far2\addons\shell\!!! read this !!!.hta
C:\far2\addons\colors\default_highlighting\!!! read this !!!.hta
C:\far2\addons\colors\custom_highlighting\!!! read this !!!.hta
C:\far2\addons\macros\!!! read this !!!.hta
C:\far2\addons\shell\how to recover encrypted files.txt
C:\far2\addons\xlat\russian\how to recover encrypted files.txt
C:\far2\documentation\!!! read this !!!.hta
C:\far2\documentation\how to recover encrypted files.txt
C:\far2\documentation\eng\!!! read this !!!.hta
C:\far2\addons\xlat\!!! read this !!!.hta
C:\far2\addons\xlat\how to recover encrypted files.txt
C:\far2\addons\xlat\russian\!!! read this !!!.hta
C:\far2\addons\colors\custom_highlighting\how to recover encrypted files.txt
C:\far2\addons\colors\how to recover encrypted files.txt
C:\far2\documentation\eng\how to recover encrypted files.txt
C:\$recycle.bin\!!! read this !!!.hta
D:\$recycle.bin\how to recover encrypted files.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\!!! read this !!!.hta
C:\$recycle.bin\how to recover encrypted files.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how to recover encrypted files.txt
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\!!! read this !!!.hta
D:\$recycle.bin\!!! read this !!!.hta
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how to recover encrypted files.txt
C:\documents and settings\how to recover encrypted files.txt
C:\far2\!!! read this !!!.hta
C:\far2\how to recover encrypted files.txt
C:\far2\addons\!!! read this !!!.hta
C:\far2\addons\how to recover encrypted files.txt
C:\far2\addons\colors\!!! read this !!!.hta
C:\documents and settings\!!! read this !!!.hta
%ProgramFiles%\a2start\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\far2\documentation\rus\!!! read this !!!.hta
C:\far2\encyclopedia\tap\!!! read this !!!.hta
C:\far2\plugins\emenu\!!! read this !!!.hta
C:\far2\plugins\emenu\how to recover encrypted files.txt
C:\far2\plugins\farcmds\!!! read this !!!.hta
C:\far2\plugins\farcmds\how to recover encrypted files.txt
C:\far2\plugins\drawline\how to recover encrypted files.txt
C:\far2\plugins\filecase\!!! read this !!!.hta
C:\far2\plugins\editcase\how to recover encrypted files.txt
C:\far2\plugins\ftp\!!! read this !!!.hta
C:\far2\plugins\ftp\lib\!!! read this !!!.hta
C:\far2\plugins\ftp\lib\how to recover encrypted files.txt
C:\far2\plugins\hlfviewer\!!! read this !!!.hta
C:\far2\plugins\hlfviewer\how to recover encrypted files.txt
C:\far2\plugins\filecase\how to recover encrypted files.txt
C:\far2\addons\colors\default_highlighting\how to recover encrypted files.txt
C:\far2\plugins\ftp\how to recover encrypted files.txt
C:\far2\plugins\editcase\!!! read this !!!.hta
C:\far2\plugins\drawline\!!! read this !!!.hta
C:\far2\plugins\compare\how to recover encrypted files.txt
C:\far2\encyclopedia\tap\how to recover encrypted files.txt
C:\far2\fexcept\!!! read this !!!.hta
C:\far2\fexcept\how to recover encrypted files.txt
C:\far2\plugins\!!! read this !!!.hta
C:\far2\plugins\how to recover encrypted files.txt
C:\far2\encyclopedia\how to recover encrypted files.txt
C:\far2\plugins\align\!!! read this !!!.hta
C:\far2\plugins\arclite\!!! read this !!!.hta
C:\far2\plugins\arclite\how to recover encrypted files.txt
C:\far2\plugins\autowrap\!!! read this !!!.hta
C:\far2\plugins\autowrap\how to recover encrypted files.txt
C:\far2\plugins\brackets\!!! read this !!!.hta
C:\far2\plugins\brackets\how to recover encrypted files.txt
C:\far2\plugins\align\how to recover encrypted files.txt
C:\far2\plugins\compare\!!! read this !!!.hta
C:\far2\encyclopedia\!!! read this !!!.hta
%ProgramFiles%\armor2net\!!! read this !!!.hta
%ProgramFiles%\avscan\!!! read this !!!.hta
%ProgramFiles%\a2wizard\!!! read this !!!.hta
%ProgramFiles%\avcmd\!!! read this !!!.hta
%ProgramFiles%\avcmd\how to recover encrypted files.txt
%ProgramFiles%\avconfig\!!! read this !!!.hta
%ProgramFiles%\avconfig\how to recover encrypted files.txt
%ProgramFiles%\avconsol\!!! read this !!!.hta
%ProgramFiles%\avciman\!!! read this !!!.hta
%ProgramFiles%\avciman\how to recover encrypted files.txt
%ProgramFiles%\avconsol\how to recover encrypted files.txt
%ProgramFiles%\avgcc\!!! read this !!!.hta
%ProgramFiles%\avgcc\how to recover encrypted files.txt
%ProgramFiles%\avgdiag\!!! read this !!!.hta
%ProgramFiles%\avgdiag\how to recover encrypted files.txt
%ProgramFiles%\avgemc\!!! read this !!!.hta
%ProgramFiles%\avgamsvr\!!! read this !!!.hta
%ProgramFiles%\avgamsvr\how to recover encrypted files.txt
%ProgramFiles%\avgfwsrv\!!! read this !!!.hta
%ProgramFiles%\avgemc\how to recover encrypted files.txt
%ProgramFiles%\avadmin\how to recover encrypted files.txt
%ProgramFiles%\ash_updatemediator\how to recover encrypted files.txt
%ProgramFiles%\aswregsvr\!!! read this !!!.hta
%ProgramFiles%\aswregsvr\how to recover encrypted files.txt
%ProgramFiles%\aswupdsv\!!! read this !!!.hta
%ProgramFiles%\avcenter\!!! read this !!!.hta
%ProgramFiles%\ashwebsv\how to recover encrypted files.txt
%ProgramFiles%\avcenter\how to recover encrypted files.txt
%ProgramFiles%\aswupdsv\how to recover encrypted files.txt
%ProgramFiles%\autostartexplorer\how to recover encrypted files.txt
%ProgramFiles%\autotrace\!!! read this !!!.hta
%ProgramFiles%\autotrace\how to recover encrypted files.txt
%ProgramFiles%\avadmin\!!! read this !!!.hta
%ProgramFiles%\autodown\!!! read this !!!.hta
%ProgramFiles%\autodown\how to recover encrypted files.txt
%ProgramFiles%\autostartexplorer\!!! read this !!!.hta
%ProgramFiles%\a2upd\!!! read this !!!.hta
%ProgramFiles%\avgfwsrv\how to recover encrypted files.txt
%ProgramFiles%\avinitnt\!!! read this !!!.hta
%ProgramFiles%\avkserv\!!! read this !!!.hta
%ProgramFiles%\avkserv\how to recover encrypted files.txt
%ProgramFiles%\avkservice\!!! read this !!!.hta
%ProgramFiles%\avkservice\how to recover encrypted files.txt
%ProgramFiles%\avgwizfw\how to recover encrypted files.txt
%ProgramFiles%\avkwctl\!!! read this !!!.hta
%ProgramFiles%\avinitnt\how to recover encrypted files.txt
%ProgramFiles%\avnotify\!!! read this !!!.hta
%ProgramFiles%\avpcc\!!! read this !!!.hta
%ProgramFiles%\avpcc\how to recover encrypted files.txt
%ProgramFiles%\avpm\!!! read this !!!.hta
%ProgramFiles%\avpm\how to recover encrypted files.txt
%ProgramFiles%\avkwctl\how to recover encrypted files.txt
%ProgramFiles%\avgwizfw\!!! read this !!!.hta
%ProgramFiles%\avnotify\how to recover encrypted files.txt
%ProgramFiles%\avgw\how to recover encrypted files.txt
%ProgramFiles%\avgw\!!! read this !!!.hta
%ProgramFiles%\avginet\how to recover encrypted files.txt
%ProgramFiles%\avgnpdln\how to recover encrypted files.txt
%ProgramFiles%\avgnpsvc\!!! read this !!!.hta
%ProgramFiles%\avgnpsvc\how to recover encrypted files.txt
%ProgramFiles%\avgrssvc\!!! read this !!!.hta
%ProgramFiles%\avgrssvc\how to recover encrypted files.txt
%ProgramFiles%\avgscan\!!! read this !!!.hta
%ProgramFiles%\avgnpdln\!!! read this !!!.hta
%ProgramFiles%\avgscan\how to recover encrypted files.txt
%ProgramFiles%\avgupden\how to recover encrypted files.txt
%ProgramFiles%\avgupsvc\!!! read this !!!.hta
%ProgramFiles%\avgupsvc\how to recover encrypted files.txt
%ProgramFiles%\avgvv\!!! read this !!!.hta
%ProgramFiles%\avgvv\how to recover encrypted files.txt
%ProgramFiles%\ashwebsv\!!! read this !!!.hta
%ProgramFiles%\avgupden\!!! read this !!!.hta
%ProgramFiles%\ash_updatemediator\!!! read this !!!.hta
%ProgramFiles%\ashupd\how to recover encrypted files.txt
%ProgramFiles%\ashupd\!!! read this !!!.hta
%ProgramFiles%\ashskpck\how to recover encrypted files.txt
%ProgramFiles%\almon\!!! read this !!!.hta
%ProgramFiles%\almon\how to recover encrypted files.txt
%ProgramFiles%\alsvc\!!! read this !!!.hta
%ProgramFiles%\alsvc\how to recover encrypted files.txt
%ProgramFiles%\aimpro\how to recover encrypted files.txt
%ProgramFiles%\aim6\how to recover encrypted files.txt
%ProgramFiles%\airdefense\how to recover encrypted files.txt
%ProgramFiles%\amon\!!! read this !!!.hta
%ProgramFiles%\anti-trojan\!!! read this !!!.hta
%ProgramFiles%\anti-trojan\how to recover encrypted files.txt
%ProgramFiles%\antivirus\!!! read this !!!.hta
%ProgramFiles%\antivirus\how to recover encrypted files.txt
%ProgramFiles%\amon\how to recover encrypted files.txt
%ProgramFiles%\amsn\!!! read this !!!.hta
%ProgramFiles%\amsn\how to recover encrypted files.txt
%ProgramFiles%\aimpro\!!! read this !!!.hta
%ProgramFiles%\aim6\!!! read this !!!.hta
%ProgramFiles%\aoltbserver\!!! read this !!!.hta
%ProgramFiles%\aavshield\!!! read this !!!.hta
%ProgramFiles%\aavshield\how to recover encrypted files.txt
%ProgramFiles%\about\!!! read this !!!.hta
%ProgramFiles%\about\how to recover encrypted files.txt
%ProgramFiles%\ackwin32\!!! read this !!!.hta
%ProgramFiles%\ackwin32\how to recover encrypted files.txt
%ProgramFiles%\a2wizard\how to recover encrypted files.txt
%ProgramFiles%\admunch\!!! read this !!!.hta
%ProgramFiles%\agb5\!!! read this !!!.hta
%ProgramFiles%\agb5\how to recover encrypted files.txt
%ProgramFiles%\ageofconan\!!! read this !!!.hta
%ProgramFiles%\ageofconan\how to recover encrypted files.txt
%ProgramFiles%\ahnsd\!!! read this !!!.hta
%ProgramFiles%\ahnsd\how to recover encrypted files.txt
%ProgramFiles%\admunch\how to recover encrypted files.txt
%ProgramFiles%\a2upd\how to recover encrypted files.txt
%ProgramFiles%\avscan\how to recover encrypted files.txt
%ProgramFiles%\aoltbserver\how to recover encrypted files.txt
%ProgramFiles%\armorsurf\how to recover encrypted files.txt
%ProgramFiles%\ashpopwz\how to recover encrypted files.txt
%ProgramFiles%\ashquick\!!! read this !!!.hta
%ProgramFiles%\ashquick\how to recover encrypted files.txt
%ProgramFiles%\ashserv\!!! read this !!!.hta
%ProgramFiles%\ashmaisv\!!! read this !!!.hta
%ProgramFiles%\ashserv\how to recover encrypted files.txt
%ProgramFiles%\ashpopwz\!!! read this !!!.hta
%ProgramFiles%\ashsimp2\how to recover encrypted files.txt
%ProgramFiles%\ashsimpl\how to recover encrypted files.txt
%ProgramFiles%\ashskpcc\!!! read this !!!.hta
%ProgramFiles%\ashskpcc\how to recover encrypted files.txt
%ProgramFiles%\ashskpck\!!! read this !!!.hta
%ProgramFiles%\ashsimp2\!!! read this !!!.hta
%ProgramFiles%\airdefense\!!! read this !!!.hta
%ProgramFiles%\ashsimpl\!!! read this !!!.hta
%ProgramFiles%\ashmaisv\how to recover encrypted files.txt
%ProgramFiles%\ashlogv\how to recover encrypted files.txt
%ProgramFiles%\ashlogv\!!! read this !!!.hta
%ProgramFiles%\ash\!!! read this !!!.hta
%ProgramFiles%\ash\how to recover encrypted files.txt
%ProgramFiles%\ashavast\!!! read this !!!.hta
%ProgramFiles%\ashavast\how to recover encrypted files.txt
%ProgramFiles%\ashavsrv\!!! read this !!!.hta
%ProgramFiles%\armorsurf\!!! read this !!!.hta
%ProgramFiles%\ashavsrv\how to recover encrypted files.txt
%ProgramFiles%\ashchest\how to recover encrypted files.txt
%ProgramFiles%\ashdisp\!!! read this !!!.hta
%ProgramFiles%\ashdisp\how to recover encrypted files.txt
%ProgramFiles%\ashdug\!!! read this !!!.hta
%ProgramFiles%\ashdug\how to recover encrypted files.txt
%ProgramFiles%\ashenhcd\!!! read this !!!.hta
%ProgramFiles%\ashchest\!!! read this !!!.hta
%ProgramFiles%\ashenhcd\how to recover encrypted files.txt
%ProgramFiles%\armor2net\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\how to recover encrypted files.txt

Перемещает следующие файлы

%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\[supportclown@cock.li][id=96812c1a]aiodlite.dll.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[supportclown@cock.li][id=96812c1a]cef.pak.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportclown@cock.li][id=96812c1a]acrobroker.exe.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\viewer.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]viewer.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\trackedsend.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]trackedsend.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\stamp.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]stamp.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\measure.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]measure.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\home.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]home.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\fillsign.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]fillsign.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\epdf_rhp.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]epdf_rhp.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\epdf_full.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]epdf_full.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[supportclown@cock.li][id=96812c1a]cef_100_percent.pak.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\edit_r_rhp.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]edit_r_rhp.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\cpdf_rhp.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]cpdf_rhp.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\cpdf_full.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]cpdf_full.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\comments.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]comments.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\certificates_r.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]certificates_r.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\combine_r_rhp.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]combine_r_rhp.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\collectsignatures.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]collectsignatures.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\appcenter_r.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]appcenter_r.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportclown@cock.li][id=96812c1a]ace.dll.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportclown@cock.li][id=96812c1a]a3dutils.dll.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportclown@cock.li][id=96812c1a]1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\edit_r_full.aapp в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportclown@cock.li][id=96812c1a]edit_r_full.aapp.notfound
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[supportclown@cock.li][id=96812c1a]cef_200_percent.pak.notfound

Самоперемещается

из <Полный путь к файлу> в <Текущая директория>\[supportclown@cock.li][id=96812c1a]<Имя файла>.exe.notfound

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Сетевая активность

TCP

'localhost':49172
'localhost':49173
'te########tion.000webhostapp.com':443

UDP

DNS ASK te########tion.000webhostapp.com

Другое

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c vol C

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней