Trojan.Encoder.38662

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\# decrypt files bluesky #.txt

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\trivial-merge.htm

Изменения в файловой системе

Создает следующие файлы

C:\# decrypt files bluesky #.txt
C:\users\public\music\sample music\# decrypt files bluesky #.txt
C:\users\public\pictures\# decrypt files bluesky #.txt
C:\users\public\pictures\sample pictures\# decrypt files bluesky #.txt
C:\users\public\recorded tv\# decrypt files bluesky #.txt
C:\users\public\recorded tv\sample media\# decrypt files bluesky #.txt
C:\users\public\videos\# decrypt files bluesky #.txt
C:\users\default\links\# decrypt files bluesky #.txt
C:\users\public\videos\sample videos\# decrypt files bluesky #.txt
%HOMEPATH%\contacts\# decrypt files bluesky #.txt
%HOMEPATH%\desktop\# decrypt files bluesky #.txt
%HOMEPATH%\documents\# decrypt files bluesky #.txt
%HOMEPATH%\downloads\# decrypt files bluesky #.txt
%HOMEPATH%\favorites\# decrypt files bluesky #.txt
%HOMEPATH%\favorites\links\# decrypt files bluesky #.txt
C:\users\public\libraries\# decrypt files bluesky #.txt
C:\users\public\music\# decrypt files bluesky #.txt
C:\users\public\favorites\# decrypt files bluesky #.txt
C:\users\public\downloads\# decrypt files bluesky #.txt
C:\users\public\documents\# decrypt files bluesky #.txt
C:\msocache\# decrypt files bluesky #.txt
<Текущая директория>\# decrypt files bluesky #.txt
C:\users\# decrypt files bluesky #.txt
C:\users\default\# decrypt files bluesky #.txt
C:\users\default\desktop\# decrypt files bluesky #.txt
C:\users\default\documents\# decrypt files bluesky #.txt
D:\# decrypt files bluesky #.txt
%HOMEPATH%\# decrypt files bluesky #.txt
C:\users\default\favorites\# decrypt files bluesky #.txt
C:\users\default\downloads\# decrypt files bluesky #.txt
C:\users\default\pictures\# decrypt files bluesky #.txt
C:\users\default\saved games\# decrypt files bluesky #.txt
C:\users\default\videos\# decrypt files bluesky #.txt
C:\users\public\# decrypt files bluesky #.txt
C:\users\public\desktop\# decrypt files bluesky #.txt
C:\kms\# decrypt files bluesky #.txt
C:\users\default\music\# decrypt files bluesky #.txt
%HOMEPATH%\favorites\links for united states\# decrypt files bluesky #.txt

Изменяет следующие файлы

C:\kms\kms_vl_all_aio_debug.log
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\contacts\user.contact
C:\users\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv
C:\users\public\videos\sample videos\wildlife.wmv
C:\users\public\pictures\sample pictures\tulips.jpg
C:\users\public\pictures\sample pictures\lighthouse.jpg
C:\users\public\pictures\sample pictures\penguins.jpg
C:\users\public\pictures\sample pictures\koala.jpg
C:\users\public\pictures\sample pictures\jellyfish.jpg
C:\users\public\pictures\sample pictures\hydrangeas.jpg
C:\users\public\pictures\sample pictures\chrysanthemum.jpg
C:\users\public\pictures\sample pictures\desert.jpg
C:\users\public\music\sample music\maid with the flaxen hair.mp3
C:\users\public\music\sample music\sleep away.mp3
C:\users\public\libraries\recordedtv.library-ms
C:\users\public\music\sample music\kalimba.mp3
C:\users\default\ntuser.dat.log1
%HOMEPATH%\favorites\links\web slice gallery.url
D:\install.log

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Сетевая активность

Подключается к

'<LOCALNET>.37.0':445
'<LOCALNET>.37.161':445
'<LOCALNET>.37.162':445
'<LOCALNET>.37.163':445
'<LOCALNET>.37.164':445
'<LOCALNET>.37.165':445
'<LOCALNET>.37.166':445
'<LOCALNET>.37.167':445
'<LOCALNET>.37.168':445
'<LOCALNET>.37.169':445
'<LOCALNET>.37.170':445
'<LOCALNET>.37.171':445
'<LOCALNET>.37.172':445
'<LOCALNET>.37.173':445
'<LOCALNET>.37.175':445
'<LOCALNET>.37.189':445
'<LOCALNET>.37.176':445
'<LOCALNET>.37.177':445
'<LOCALNET>.37.178':445
'<LOCALNET>.37.179':445
'<LOCALNET>.37.180':445
'<LOCALNET>.37.181':445
'<LOCALNET>.37.182':445
'<LOCALNET>.37.183':445
'<LOCALNET>.37.184':445
'<LOCALNET>.37.185':445
'<LOCALNET>.37.186':445
'<LOCALNET>.37.187':445
'<LOCALNET>.37.188':445
'<LOCALNET>.37.160':445
'<LOCALNET>.37.174':445
'<LOCALNET>.37.159':445
'<LOCALNET>.37.142':445
'<LOCALNET>.37.129':445
'<LOCALNET>.37.130':445
'<LOCALNET>.37.131':445
'<LOCALNET>.37.132':445
'<LOCALNET>.37.133':445
'<LOCALNET>.37.134':445
'<LOCALNET>.37.135':445
'<LOCALNET>.37.136':445
'<LOCALNET>.37.137':445
'<LOCALNET>.37.138':445
'<LOCALNET>.37.139':445
'<LOCALNET>.37.140':445
'<LOCALNET>.37.141':445
'<LOCALNET>.37.143':445
'<LOCALNET>.37.157':445
'<LOCALNET>.37.144':445
'<LOCALNET>.37.145':445
'<LOCALNET>.37.146':445
'<LOCALNET>.37.147':445
'<LOCALNET>.37.148':445
'<LOCALNET>.37.149':445
'<LOCALNET>.37.150':445
'<LOCALNET>.37.151':445
'<LOCALNET>.37.152':445
'<LOCALNET>.37.153':445
'<LOCALNET>.37.154':445
'<LOCALNET>.37.155':445
'<LOCALNET>.37.156':445
'<LOCALNET>.37.158':445
'<LOCALNET>.37.207':445
'<LOCALNET>.37.253':445
'<LOCALNET>.37.192':445
'<LOCALNET>.37.225':445
'<LOCALNET>.37.226':445
'<LOCALNET>.37.227':445
'<LOCALNET>.37.228':445
'<LOCALNET>.37.229':445
'<LOCALNET>.37.230':445
'<LOCALNET>.37.231':445
'<LOCALNET>.37.232':445
'<LOCALNET>.37.233':445
'<LOCALNET>.37.234':445
'<LOCALNET>.37.235':445
'<LOCALNET>.37.236':445
'<LOCALNET>.37.237':445
'<LOCALNET>.37.239':445
'<LOCALNET>.37.191':445
'<LOCALNET>.37.240':445
'<LOCALNET>.37.241':445
'<LOCALNET>.37.242':445
'<LOCALNET>.37.243':445
'<LOCALNET>.37.244':445
'<LOCALNET>.37.245':445
'<LOCALNET>.37.246':445
'<LOCALNET>.37.247':445
'<LOCALNET>.37.248':445
'<LOCALNET>.37.249':445
'<LOCALNET>.37.250':445
'<LOCALNET>.37.251':445
'<LOCALNET>.37.252':445
'<LOCALNET>.37.224':445
'<LOCALNET>.37.128':445
'<LOCALNET>.37.223':445
'<LOCALNET>.37.206':445
'<LOCALNET>.37.193':445
'<LOCALNET>.37.194':445
'<LOCALNET>.37.195':445
'<LOCALNET>.37.196':445
'<LOCALNET>.37.197':445
'<LOCALNET>.37.198':445
'<LOCALNET>.37.199':445
'<LOCALNET>.37.200':445
'<LOCALNET>.37.201':445
'<LOCALNET>.37.202':445
'<LOCALNET>.37.203':445
'<LOCALNET>.37.204':445
'<LOCALNET>.37.205':445
'<LOCALNET>.37.190':445
'<LOCALNET>.37.221':445
'<LOCALNET>.37.208':445
'<LOCALNET>.37.209':445
'<LOCALNET>.37.210':445
'<LOCALNET>.37.211':445
'<LOCALNET>.37.212':445
'<LOCALNET>.37.213':445
'<LOCALNET>.37.214':445
'<LOCALNET>.37.215':445
'<LOCALNET>.37.216':445
'<LOCALNET>.37.217':445
'<LOCALNET>.37.218':445
'<LOCALNET>.37.219':445
'<LOCALNET>.37.220':445
'<LOCALNET>.37.222':445
'<LOCALNET>.37.238':445
'<LOCALNET>.37.127':445
'<LOCALNET>.37.110':445
'<LOCALNET>.37.33':445
'<LOCALNET>.37.34':445
'<LOCALNET>.37.35':445
'<LOCALNET>.37.36':445
'<LOCALNET>.37.37':445
'<LOCALNET>.37.38':445
'<LOCALNET>.37.39':445
'<LOCALNET>.37.40':445
'<LOCALNET>.37.41':445
'<LOCALNET>.37.42':445
'<LOCALNET>.37.43':445
'<LOCALNET>.37.44':445
'<LOCALNET>.37.45':445
'<LOCALNET>.37.47':445
'<LOCALNET>.37.61':445
'<LOCALNET>.37.48':445
'<LOCALNET>.37.49':445
'<LOCALNET>.37.50':445
'<LOCALNET>.37.51':445
'<LOCALNET>.37.52':445
'<LOCALNET>.37.53':445
'<LOCALNET>.37.54':445
'<LOCALNET>.37.55':445
'<LOCALNET>.37.56':445
'<LOCALNET>.37.57':445
'<LOCALNET>.37.58':445
'<LOCALNET>.37.59':445
'<LOCALNET>.37.60':445
'<LOCALNET>.37.32':445
'<LOCALNET>.37.46':445
'<LOCALNET>.37.31':445
'<LOCALNET>.37.14':445
'<LOCALNET>.37.1':445
'<LOCALNET>.37.2':445
'<LOCALNET>.37.3':445
'<LOCALNET>.37.4':445
'<LOCALNET>.37.5':445
'<LOCALNET>.37.6':445
'<LOCALNET>.37.7':445
'<LOCALNET>.37.8':445
'<LOCALNET>.37.9':445
'<LOCALNET>.37.10':445
'<LOCALNET>.37.11':445
'<LOCALNET>.37.12':445
'<LOCALNET>.37.13':445
'<LOCALNET>.37.15':445
'<LOCALNET>.37.29':445
'<LOCALNET>.37.16':445
'<LOCALNET>.37.17':445
'<LOCALNET>.37.18':445
'<LOCALNET>.37.19':445
'<LOCALNET>.37.20':445
'<LOCALNET>.37.21':445
'<LOCALNET>.37.22':445
'<LOCALNET>.37.23':445
'<LOCALNET>.37.24':445
'<LOCALNET>.37.25':445
'<LOCALNET>.37.26':445
'<LOCALNET>.37.27':445
'<LOCALNET>.37.28':445
'<LOCALNET>.37.30':445
'<LOCALNET>.37.79':445
'<LOCALNET>.37.125':445
'<LOCALNET>.37.64':445
'<LOCALNET>.37.97':445
'<LOCALNET>.37.98':445
'<LOCALNET>.37.99':445
'<LOCALNET>.37.100':445
'<LOCALNET>.37.101':445
'<LOCALNET>.37.102':445
'<LOCALNET>.37.103':445
'<LOCALNET>.37.104':445
'<LOCALNET>.37.105':445
'<LOCALNET>.37.106':445
'<LOCALNET>.37.107':445
'<LOCALNET>.37.108':445
'<LOCALNET>.37.109':445
'<LOCALNET>.37.111':445
'<LOCALNET>.37.63':445
'<LOCALNET>.37.112':445
'<LOCALNET>.37.113':445
'<LOCALNET>.37.114':445
'<LOCALNET>.37.115':445
'<LOCALNET>.37.116':445
'<LOCALNET>.37.117':445
'<LOCALNET>.37.118':445
'<LOCALNET>.37.119':445
'<LOCALNET>.37.120':445
'<LOCALNET>.37.121':445
'<LOCALNET>.37.122':445
'<LOCALNET>.37.123':445
'<LOCALNET>.37.124':445
'<LOCALNET>.37.96':445
'<LOCALNET>.37.126':445
'<LOCALNET>.37.95':445
'<LOCALNET>.37.78':445
'<LOCALNET>.37.65':445
'<LOCALNET>.37.66':445
'<LOCALNET>.37.67':445
'<LOCALNET>.37.68':445
'<LOCALNET>.37.69':445
'<LOCALNET>.37.70':445
'<LOCALNET>.37.71':445
'<LOCALNET>.37.72':445
'<LOCALNET>.37.73':445
'<LOCALNET>.37.74':445
'<LOCALNET>.37.75':445
'<LOCALNET>.37.76':445
'<LOCALNET>.37.77':445
'<LOCALNET>.37.62':445
'<LOCALNET>.37.93':445
'<LOCALNET>.37.80':445
'<LOCALNET>.37.81':445
'<LOCALNET>.37.82':445
'<LOCALNET>.37.83':445
'<LOCALNET>.37.84':445
'<LOCALNET>.37.85':445
'<LOCALNET>.37.86':445
'<LOCALNET>.37.87':445
'<LOCALNET>.37.88':445
'<LOCALNET>.37.89':445
'<LOCALNET>.37.90':445
'<LOCALNET>.37.91':445
'<LOCALNET>.37.92':445
'<LOCALNET>.37.94':445
'<LOCALNET>.37.254':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней