Trojan.Encoder.38565

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx

Изменения в файловой системе

Создает следующие файлы

%HOMEPATH%\windowupdate.data
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\icons_ie8.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\icons_ie8.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\icons_ie8.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\images\progress.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\wow_helper.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\symbol.txt.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\zdingbat.txt.encrypt
%CommonProgramFiles(x86)%\adobe\arm\1.0\adobearm.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-up-pressed.gif.encrypt
%CommonProgramFiles(x86)%\adobe\arm\1.0\adobearmhelper.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\icons_ie8.gif.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_gb.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_us.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_us_posix.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\adobe\products.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_ca\list.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_gb\list.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_us\list.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_en_ca.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_th_en_ca_v2.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\affdescription.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_ca.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\changelog.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_gb_euro.txt.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-up.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-right.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-right-pressed.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tl.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tr.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\trash.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationinacrobat.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationintray.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationinacrobat.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationintray.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\warning.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner_2x.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\stop_collection_data.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner_int.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\adobe_spinner.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\adobe_spinner_mini.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\ind_prog.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress-indeterminate.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress_spinner.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress_spinner2x.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress_spinner_dark.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress_spinner_dark2x.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-down-pressed.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-down.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-left-pressed.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner_int_2x.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-left.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_ok.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\submission_history.gif.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\license.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\readme_en_us.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_finnish.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_french.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_german.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_greek.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_hungarian.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_italian.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_japanese.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_korean.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_koreana.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_latam.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_dutch.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_english.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_norwegian.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_romanian.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_russian.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_schinese.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_spanish.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_swedish.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_tchinese.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_thai.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_turkish.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_ukrainian.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_vietnamese.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_polish.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_portuguese.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_danish.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_bulgarian.txt.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\eula.exe.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\added.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\excluded.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_gb\added.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_gb\excluded.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\added.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\excluded.txt.encrypt
%CommonProgramFiles(x86)%\java\java update\jaureg.exe.encrypt
%CommonProgramFiles(x86)%\java\java update\jucheck.exe.encrypt
%CommonProgramFiles(x86)%\java\java update\jusched.exe.encrypt
%CommonProgramFiles(x86)%\microsoft shared\textconv\wksconv\wkconv.exe.encrypt
%CommonProgramFiles(x86)%\microsoft shared\vsta\8.0\x86\vsta_ep32.exe.encrypt
%CommonProgramFiles(x86)%\microsoft shared\vsto\10.0\vstoinstaller.exe.encrypt
%CommonProgramFiles(x86)%\steam\steamservice.exe.encrypt
%ProgramFiles(x86)%\opera\29.0.1795.47\installer.exe.encrypt
%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe.encrypt
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_autoupdate.exe.encrypt
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe.encrypt
%ProgramFiles(x86)%\opera\29.0.1795.47\resources\license.txt.encrypt
%ProgramFiles(x86)%\opera\29.0.1795.47\wow_helper.exe.encrypt
%ProgramFiles(x86)%\opera\launcher.exe.encrypt
%ProgramFiles(x86)%\steam\bin\steamservice.exe.encrypt
%ProgramFiles(x86)%\steam\logs\bootstrap_log.txt.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_brazilian.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\wordnet_license.txt.encrypt
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme_en_gb.txt.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_lg.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_issue.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\rss.gif.encrypt
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.encrypt
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_1024.db.encrypt
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_256.db.encrypt
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_32.db.encrypt
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_96.db.encrypt
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db.encrypt
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_sr.db.encrypt
%LOCALAPPDATA%\microsoft\windows mail\stationery\cave_drawings.gif.encrypt
%LOCALAPPDATA%\microsoft\windows mail\stationery\connectivity.gif.encrypt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png.encrypt
%LOCALAPPDATA%\microsoft\windows mail\stationery\stucco.gif.encrypt
%LOCALAPPDATA%\iconcache.db.encrypt
%LOCALAPPDATA%\microsoft\windows mail\stationery\wrinkled_paper.gif.encrypt
%TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.encrypt
%TEMP%\dd_setuputility.txt.encrypt
%TEMP%\dd_vcredistmsi7a3c.txt.encrypt
%TEMP%\dd_vcredistui7a3c.txt.encrypt
%TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt.encrypt
%TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt.encrypt
%TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt.encrypt
%TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt.encrypt
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt.encrypt
%LOCALAPPDATA%\microsoft\windows mail\stationery\tiki.gif.encrypt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png.encrypt
%TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.encrypt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png.encrypt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png.encrypt
%HOMEPATH%\qqcontact.data
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\newyear.exe
%HOMEPATH%\desktop\chromesetup.exe.encrypt
%HOMEPATH%\desktop\dashborder_120.bmp.encrypt
%HOMEPATH%\desktop\dashborder_144.bmp.encrypt
%HOMEPATH%\desktop\dialmap.bmp.encrypt
%HOMEPATH%\desktop\dotnetfx45_full_setup.exe.encrypt
%HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe.encrypt
%HOMEPATH%\desktop\nwfieldnotes1966.docx.encrypt
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx.encrypt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\delegate_execute.exe.encrypt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\chrome.7z.encrypt
%ALLUSERSPROFILE%\logo.data
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\setup.exe.encrypt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\secondarytile.png.encrypt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\logo.png.encrypt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\smalllogo.png.encrypt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\splash-620x300.png.encrypt
%LOCALAPPDATA%\google\chrome\application\chrome.exe.encrypt
%LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db.encrypt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png.encrypt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png.encrypt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\128.png.encrypt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\128.png.encrypt
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt.encrypt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\nacl64.exe.encrypt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt.encrypt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\128.png.encrypt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\reader_sl.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\bl.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\br.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\create_form.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\distribute_form.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\email_all.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\email_initiator.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\ended_review_or_form.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\end_review.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_distributed.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_received.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_super.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\form_responses.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\info.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\open_original_form.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\pdf.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviewers.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_joined.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_sent.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_super.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_browser.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_email.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_same_reviewers.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_shared.gif.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\64bitmapibroker.exe.encrypt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\add_reviewer.gif.encrypt
%ProgramFiles(x86)%\steam\public\steambootstrapper_czech.txt.encrypt
%ProgramFiles(x86)%\steam\steam.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\arh.exe.encrypt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt.encrypt
%APPDATA%\telegram desktop\telegram.exe.encrypt
%APPDATA%\telegram desktop\unins000.exe.encrypt
%APPDATA%\telegram desktop\updater.exe.encrypt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt.encrypt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe.encrypt
%ALLUSERSPROFILE%\oracle\java\javapath\java.exe.encrypt
%ALLUSERSPROFILE%\oracle\java\javapath\javaw.exe.encrypt
%ALLUSERSPROFILE%\oracle\java\javapath\javaws.exe.encrypt
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe.encrypt
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\vc_redist.x64.exe.encrypt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt.encrypt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.encrypt
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe.encrypt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe.encrypt
%ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\vc_redist.x64.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrservicesupdater.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32info.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrotextextractor.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adelrcp.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobecollabsync.exe.encrypt
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\vc_redist.x86.exe.encrypt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\logtransport2.exe.encrypt
%ProgramFiles(x86)%\steam\uninstall.exe.encrypt

Изменяет следующие файлы

%HOMEPATH%\desktop\google chrome.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer reports.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\task scheduler.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\system restore.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\system information.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\resource monitor.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\disk cleanup.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\dfrgui.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\character map.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sync center.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sticky notes.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sound recorder.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\snipping tool.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\remote desktop connection.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\paint.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\networkprojection.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\mobility center.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\math input panel.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\displayswitch.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\calculator.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\speech recognition.lnk
C:\users\public\desktop\steam.lnk
C:\users\public\desktop\opera.lnk
C:\users\public\desktop\mozilla thunderbird.lnk
C:\users\public\desktop\firefox.lnk
C:\users\public\desktop\acrobat reader dc.lnk
%HOMEPATH%\desktop\telegram.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\shapecollector.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\tabtip.lnk

Изменяет множество файлов.

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Другое

Ищет следующие окна

ClassName: 'SystemTray_Main' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней