Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AsE1axaLShzJkDwb"<Полный путь к вирусу>" /SkipReg' = '"<Полный путь к вирусу>" /SkipReg'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /Quiet /All
- '<SYSTEM32>\cmd.exe' /C vssadmin Delete Shadows /Quiet /All
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Graphics\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.5\SQL\EN\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\chrome\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\EN\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\CatRoot2\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pss\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\DirectX\Dinput\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\config\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\config\systemprofile\Templates\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\dllcache\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Web\printers\images\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\wbem\Repository\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Web\printers\readme_liesmich_encryptor_raas.txt
- %WINDIR%\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Web\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Web\Wallpaper\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\wbem\Repository\FS\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\ias\readme_liesmich_encryptor_raas.txt
- <DRIVERS>\readme_liesmich_encryptor_raas.txt
- <DRIVERS>\etc\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\oobe\html\mouse\images\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\wbem\Performance\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\Restore\readme_liesmich_encryptor_raas.txt
- <SYSTEM32>\oobe\images\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Graphics\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SQL\en\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\images\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\images\Expando\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\images\Centers\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\images\48x48\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\blurbs\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\Config\Cache\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\DVDUpgrd\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\images\32x32\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\images\24x24\readme_liesmich_encryptor_raas.txt
- %WINDIR%\pchealth\helpctr\System\images\16x16\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\printpreview\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\readme_liesmich_encryptor_raas.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\readme_liesmich_encryptor_raas.txt
- %APPDATA%\Microsoft\Internet Explorer\readme_liesmich_encryptor_raas.txt
- %APPDATA%\Microsoft\Address Book\readme_liesmich_encryptor_raas.txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\readme_liesmich_encryptor_raas.txt
- C:\Far2\Documentation\eng\readme_liesmich_encryptor_raas.txt
- C:\Far2\Addons\readme_liesmich_encryptor_raas.txt
- %HOMEPATH%\Templates\readme_liesmich_encryptor_raas.txt
- C:\Documents and Settings\Default User\Templates\readme_liesmich_encryptor_raas.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\readme_liesmich_encryptor_raas.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\readme_liesmich_encryptor_raas.txt
- <Текущая директория>\readme_liesmich_encryptor_raas.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\readme_liesmich_encryptor_raas.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\readme_liesmich_encryptor_raas.txt
- %ALLUSERSPROFILE%\DRM\readme_liesmich_encryptor_raas.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\readme_liesmich_encryptor_raas.txt
- C:\Far2\Documentation\rus\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\Microsoft Shared\Stationery\readme_liesmich_encryptor_raas.txt
- C:\Far2\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\Services\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\content\branding\readme_liesmich_encryptor_raas.txt
- C:\Far2\PluginSDK\Headers.c\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\Colorer\hrc\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\Colorer\hrc\auto\types\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\7-Zip\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\ExtSearch\doc\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\FTP\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\ExtSearch\sources\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\ExtSearch\sources\RegExp\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\mmTour\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\htmlTour\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\readme_liesmich_encryptor_raas.txt
- %WINDIR%\$NtUninstallWIC$\spuninst\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\Outlook Express\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\NetMeeting\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\Windows Media Player\readme_liesmich_encryptor_raas.txt
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\readme_liesmich_encryptor_raas.txt
- <Служебный элемент>
- %PROGRAM_FILES%\Windows NT\Pinball\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Media\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\readme_liesmich_encryptor_raas.txt
- %WINDIR%\inf\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v1.0.3705\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\radio\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\printpreview\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\media\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\tree\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\toolbar\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\splitter\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\icons\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\dirListing\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\console\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\checkbox\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\res\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\res\html\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\Movie Maker\Shared\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\Movie Maker\Shared\Profiles\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\Messenger\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\xpinstall\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\places\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\update\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\profile\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\plugins\readme_liesmich_encryptor_raas.txt
Сетевая активность:
Подключается к:
- 'de######raveidf7.onion.link':80
- 'localhost':1036
TCP:
Запросы HTTP GET:
- http://de######raveidf7.onion.link////vict?cu#####################################################################################
UDP:
- DNS ASK de######raveidf7.onion.link
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'ЉЈ $ќjYЌвP ®Ќл¶X хяЕН) †КчBFхжПnТmЯsf™"¦0vSд;™/C vssadmin Delete Shadows /Quiet /All'
- ClassName: '' WindowName: '?? $?jY??P ????X?????) ???BF???n?m?sf?"?0vS?;?/C vssadmin Delete Shadows /Quiet /All'
