Trojan.Encoder.31563

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\split.avi
<Drive name for removable media>:\7790_preview.pdf
<Drive name for removable media>:\51.mp4
<Drive name for removable media>:\video_1.mp4
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4
<Drive name for removable media>:\spanner.mov
<Drive name for removable media>:\210252809.jpg
<Drive name for removable media>:\fil_20060629111052.pdf
<Drive name for removable media>:\3.jpg
<Drive name for removable media>:\2.jpeg
<Drive name for removable media>:\210252809.jpeg
<Drive name for removable media>:\13.jpeg
<Drive name for removable media>:\1189.jpeg
<Drive name for removable media>:\parnas_01.jpeg
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\region-north-karelia.jpg
<Drive name for removable media>:\ff_ot_user_guide.pdf
<Drive name for removable media>:\bc01.pdf
<Drive name for removable media>:\dualectls.pdf
<Drive name for removable media>:\proposaltemplates.ppt
<Drive name for removable media>:\accountsreceivable.ppt
<Drive name for removable media>:\ksearch_esa_talk.ppt
<Drive name for removable media>:\metac.ppt
<Drive name for removable media>:\calibre.png
<Drive name for removable media>:\cbz.png
<Drive name for removable media>:\arrow-down.png
<Drive name for removable media>:\asm.png
<Drive name for removable media>:\hhhlcert.pem
<Drive name for removable media>:\investmentbankca_ca8.pem
<Drive name for removable media>:\systisoft.pem
<Drive name for removable media>:\ck_ugo.pem
<Drive name for removable media>:\delongcacert.pem
<Drive name for removable media>:\ck.pem
<Drive name for removable media>:\irgeek.pem
<Drive name for removable media>:\pushkin.jpeg
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\alert.html
<Drive name for removable media>:\tree_view.html
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\issi2013_template_for_posters.docx
<Drive name for removable media>:\file_p_00000000_1371597592.docx
<Drive name for removable media>:\about.html
<Drive name for removable media>:\garden.htm
<Drive name for removable media>:\browse.htm
<Drive name for removable media>:\advice_process.htm
<Drive name for removable media>:\tree_view.htm
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\notepad.exe
<Drive name for removable media>:\calc.exe
<Drive name for removable media>:\dotnetfx45_full_setup.exe
<Drive name for removable media>:\chromesetup.exe
<Drive name for removable media>:\winmine.exe
<Drive name for removable media>:\utorrent.exe
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\api-hashmap.html
<Drive name for removable media>:\waterresourcesag.pptx

Modifies file system

Creates the following files

C:\!!! read this !!!.hta
C:\far2\plugins\autowrap\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\propmap\how to recover encrypted files.txt
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\propmap\!!! read this !!!.hta
C:\far2\plugins\arclite\how to recover encrypted files.txt
C:\far2\plugins\arclite\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\how to recover encrypted files.txt
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\how to recover encrypted files.txt
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\how to recover encrypted files.txt
C:\far2\plugins\autowrap\how to recover encrypted files.txt
C:\far2\plugins\align\how to recover encrypted files.txt
C:\far2\plugins\align\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\!!! read this !!!.hta
C:\far2\plugins\how to recover encrypted files.txt
C:\far2\plugins\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\applications\windows\projects\how to recover encrypted files.txt
C:\users\all users\microsoft\search\data\applications\windows\projects\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\secstore\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\ait\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\ait\!!! read this !!!.hta
C:\users\all users\microsoft\windows\how to recover encrypted files.txt
C:\far2\plugins\editcase\!!! read this !!!.hta
C:\users\all users\microsoft\windows\!!! read this !!!.hta
C:\users\all users\microsoft\vault\how to recover encrypted files.txt
C:\users\all users\microsoft\vault\!!! read this !!!.hta
C:\far2\plugins\drawline\how to recover encrypted files.txt
C:\users\all users\microsoft\search\data\applications\windows\gatherlogs\systemindex\how to recover encrypted files.txt
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\secstore\!!! read this !!!.hta
C:\far2\plugins\compare\!!! read this !!!.hta
C:\users\all users\microsoft\user account pictures\default pictures\how to recover encrypted files.txt
C:\users\all users\microsoft\user account pictures\default pictures\!!! read this !!!.hta
C:\far2\plugins\brackets\how to recover encrypted files.txt
C:\far2\plugins\brackets\!!! read this !!!.hta
C:\users\all users\microsoft\user account pictures\how to recover encrypted files.txt
C:\users\all users\microsoft\user account pictures\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\temp\how to recover encrypted files.txt
C:\far2\plugins\compare\how to recover encrypted files.txt
C:\users\all users\microsoft\search\data\temp\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\applications\windows\gatherlogs\systemindex\!!! read this !!!.hta
C:\far2\fexcept\how to recover encrypted files.txt
C:\users\all users\microsoft\search\data\applications\windows\gatherlogs\how to recover encrypted files.txt
C:\far2\documentation\rus\!!! read this !!!.hta
C:\users\all users\microsoft\rac\!!! read this !!!.hta
C:\far2\encyclopedia\how to recover encrypted files.txt
C:\users\all users\microsoft\officesoftwareprotectionplatform\cache\how to recover encrypted files.txt
C:\far2\encyclopedia\!!! read this !!!.hta
C:\users\all users\microsoft\officesoftwareprotectionplatform\cache\!!! read this !!!.hta
C:\users\all users\microsoft\officesoftwareprotectionplatform\how to recover encrypted files.txt
C:\users\all users\microsoft\officesoftwareprotectionplatform\!!! read this !!!.hta
C:\users\all users\microsoft\windows\caches\!!! read this !!!.hta
C:\users\all users\microsoft\rac\outbound\!!! read this !!!.hta
C:\users\all users\microsoft\office\uicaptions\3082\how to recover encrypted files.txt
C:\users\all users\microsoft\office\uicaptions\3082\!!! read this !!!.hta
C:\far2\documentation\eng\how to recover encrypted files.txt
C:\far2\documentation\eng\!!! read this !!!.hta
C:\far2\documentation\how to recover encrypted files.txt
C:\far2\documentation\!!! read this !!!.hta
C:\far2\addons\xlat\russian\how to recover encrypted files.txt
C:\far2\addons\xlat\russian\!!! read this !!!.hta
C:\far2\documentation\rus\how to recover encrypted files.txt
C:\far2\plugins\drawline\!!! read this !!!.hta
C:\users\all users\microsoft\rac\outbound\how to recover encrypted files.txt
C:\far2\encyclopedia\tap\!!! read this !!!.hta
C:\users\all users\microsoft\rac\publisheddata\!!! read this !!!.hta
C:\far2\fexcept\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\applications\windows\gatherlogs\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\applications\windows\config\how to recover encrypted files.txt
C:\users\all users\microsoft\search\data\applications\windows\config\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\applications\windows\how to recover encrypted files.txt
C:\users\all users\microsoft\search\data\applications\windows\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\applications\how to recover encrypted files.txt
C:\users\all users\microsoft\rac\publisheddata\how to recover encrypted files.txt
C:\users\all users\microsoft\search\data\applications\!!! read this !!!.hta
C:\users\all users\microsoft\rac\how to recover encrypted files.txt
C:\users\all users\microsoft\search\how to recover encrypted files.txt
C:\users\all users\microsoft\search\!!! read this !!!.hta
C:\users\all users\microsoft\rac\temp\how to recover encrypted files.txt
C:\users\all users\microsoft\rac\temp\!!! read this !!!.hta
C:\far2\encyclopedia\tap\how to recover encrypted files.txt
C:\users\all users\microsoft\rac\statedata\how to recover encrypted files.txt
C:\users\all users\microsoft\rac\statedata\!!! read this !!!.hta
C:\users\all users\microsoft\search\data\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\sqm\upload\how to recover encrypted files.txt
C:\msocache\all users\!!! read this !!!.hta
C:\far2\plugins\emenu\!!! read this !!!.hta
C:\far2\pluginsdk\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\google chrome\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\games\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\games\!!! read this !!!.hta
C:\far2\plugins\tmppanel\how to recover encrypted files.txt
C:\far2\plugins\tmppanel\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\java\!!! read this !!!.hta
C:\far2\plugins\proclist\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\!!! read this !!!.hta
C:\far2\plugins\network\how to recover encrypted files.txt
C:\far2\plugins\network\!!! read this !!!.hta
C:\far2\plugins\macroview\how to recover encrypted files.txt
C:\far2\plugins\proclist\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\caches\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\java\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\maintenance\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\maintenance\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\how to recover encrypted files.txt
C:\msocache\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\!!! read this !!!.hta
C:\msocache\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\!!! read this !!!.hta
C:\far2\plugins\macroview\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\google chrome\how to recover encrypted files.txt
C:\far2\pluginsdk\headers.pas\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\help\!!! read this !!!.hta
C:\far2\pluginsdk\headers.c\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\!!! read this !!!.hta
C:\far2\pluginsdk\headers.c\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\!!! read this !!!.hta
C:\far2\pluginsdk\headers.pas\how to recover encrypted files.txt
C:\far2\pluginsdk\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\accessories\accessibility\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\drm\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\ringtones\!!! read this !!!.hta
C:\far2\plugins\filecase\!!! read this !!!.hta
C:\users\all users\microsoft\windows\power efficiency diagnostics\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\power efficiency diagnostics\!!! read this !!!.hta
C:\users\all users\microsoft\windows\gameexplorer\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\gameexplorer\!!! read this !!!.hta
C:\users\all users\microsoft\windows\drm\cache\how to recover encrypted files.txt
C:\far2\plugins\editcase\how to recover encrypted files.txt
C:\far2\plugins\filecase\how to recover encrypted files.txt
C:\far2\plugins\farcmds\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\drm\!!! read this !!!.hta
C:\far2\plugins\farcmds\!!! read this !!!.hta
C:\users\all users\microsoft\windows\devicemetadatastore\en-us\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\devicemetadatastore\en-us\!!! read this !!!.hta
C:\users\all users\microsoft\windows\devicemetadatastore\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\devicemetadatastore\!!! read this !!!.hta
C:\far2\plugins\emenu\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\drm\cache\!!! read this !!!.hta
C:\far2\addons\xlat\how to recover encrypted files.txt
C:\far2\plugins\ftp\!!! read this !!!.hta
C:\users\all users\microsoft\windows\sqm\how to recover encrypted files.txt
C:\far2\plugins\ftp\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\accessories\accessibility\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\accessories\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\accessories\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\start menu\programs\!!! read this !!!.hta
C:\far2\plugins\hlfviewer\how to recover encrypted files.txt
C:\far2\plugins\hlfviewer\!!! read this !!!.hta
C:\users\all users\microsoft\windows\sqm\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\ringtones\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\sqm\upload\!!! read this !!!.hta
C:\users\all users\microsoft\windows\sqm\sessions\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\sqm\sessions\!!! read this !!!.hta
C:\users\all users\microsoft\windows\sqm\manifest\how to recover encrypted files.txt
C:\users\all users\microsoft\windows\sqm\manifest\!!! read this !!!.hta
C:\far2\plugins\ftp\lib\how to recover encrypted files.txt
C:\far2\plugins\ftp\lib\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\!!! read this !!!.hta
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\help\how to recover encrypted files.txt
C:\far2\addons\xlat\!!! read this !!!.hta
C:\users\all users\microsoft\office\how to recover encrypted files.txt
C:\users\all users\microsoft\crypto\rsa\!!! read this !!!.hta
C:\users\all users\microsoft\crypto\keys\how to recover encrypted files.txt
C:\users\all users\microsoft\crypto\keys\!!! read this !!!.hta
C:\far2\addons\how to recover encrypted files.txt
C:\far2\addons\!!! read this !!!.hta
C:\far2\how to recover encrypted files.txt
C:\far2\!!! read this !!!.hta
C:\documents and settings\how to recover encrypted files.txt
C:\users\all users\microsoft\crypto\dss\machinekeys\how to recover encrypted files.txt
C:\users\all users\microsoft\crypto\rsa\how to recover encrypted files.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how to recover encrypted files.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\!!! read this !!!.hta
D:\$recycle.bin\how to recover encrypted files.txt
D:\$recycle.bin\!!! read this !!!.hta
C:\users\all users\microsoft\crypto\dss\machinekeys\!!! read this !!!.hta
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how to recover encrypted files.txt
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\!!! read this !!!.hta
C:\documents and settings\!!! read this !!!.hta
C:\users\all users\microsoft\assistance\!!! read this !!!.hta
C:\far2\addons\colors\how to recover encrypted files.txt
C:\users\all users\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\!!! read this !!!.hta
C:\users\all users\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\how to recover encrypted files.txt
C:\users\all users\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\!!! read this !!!.hta
C:\users\all users\microsoft\device stage\device\how to recover encrypted files.txt
C:\users\all users\microsoft\device stage\device\!!! read this !!!.hta
C:\users\all users\microsoft\device stage\how to recover encrypted files.txt
C:\users\all users\microsoft\device stage\!!! read this !!!.hta
C:\users\all users\microsoft\dbgclr\7.1\1033\how to recover encrypted files.txt
C:\$recycle.bin\how to recover encrypted files.txt
C:\far2\addons\colors\!!! read this !!!.hta
C:\users\all users\microsoft\dbgclr\7.1\!!! read this !!!.hta
C:\users\all users\microsoft\dbgclr\how to recover encrypted files.txt
C:\users\all users\microsoft\dbgclr\!!! read this !!!.hta
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\how to recover encrypted files.txt
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\!!! read this !!!.hta
C:\users\all users\microsoft\crypto\rsa\machinekeys\how to recover encrypted files.txt
C:\users\all users\microsoft\crypto\rsa\machinekeys\!!! read this !!!.hta
C:\far2\addons\colors\custom_highlighting\how to recover encrypted files.txt
C:\users\all users\microsoft\dbgclr\7.1\how to recover encrypted files.txt
C:\far2\addons\colors\custom_highlighting\!!! read this !!!.hta
C:\users\all users\microsoft\crypto\dss\how to recover encrypted files.txt
C:\$recycle.bin\!!! read this !!!.hta
C:\users\all users\microsoft\crypto\dss\!!! read this !!!.hta
C:\users\all users\adobe\arm\reader_15.008.20082\!!! read this !!!.hta
C:\users\all users\adobe\setup\!!! read this !!!.hta
C:\users\all users\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\how to recover encrypted files.txt
C:\users\all users\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\!!! read this !!!.hta
C:\users\all users\adobe\arm\s\10428\how to recover encrypted files.txt
C:\users\all users\adobe\arm\s\10428\!!! read this !!!.hta
C:\users\all users\adobe\arm\s\how to recover encrypted files.txt
C:\users\all users\adobe\arm\s\!!! read this !!!.hta
C:\users\all users\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\how to recover encrypted files.txt
C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\!!! read this !!!.hta
C:\users\all users\adobe\arm\reader_15.007.20033\how to recover encrypted files.txt
C:\users\all users\adobe\arm\reader_15.007.20033\!!! read this !!!.hta
C:\users\all users\adobe\arm\how to recover encrypted files.txt
C:\users\all users\adobe\arm\!!! read this !!!.hta
C:\users\all users\adobe\how to recover encrypted files.txt
C:\users\all users\adobe\!!! read this !!!.hta
C:\users\all users\how to recover encrypted files.txt
C:\users\all users\!!! read this !!!.hta
C:\users\all users\adobe\arm\reader_15.008.20082\how to recover encrypted files.txt
C:\users\all users\microsoft\dbgclr\7.1\1033\!!! read this !!!.hta
C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\how to recover encrypted files.txt
C:\users\all users\desktop\!!! read this !!!.hta
C:\users\all users\application data\!!! read this !!!.hta
C:\users\all users\microsoft\crypto\how to recover encrypted files.txt
C:\users\all users\microsoft\crypto\!!! read this !!!.hta
C:\users\all users\microsoft\assistance\client\1.0\en-us\how to recover encrypted files.txt
C:\users\all users\microsoft\assistance\client\1.0\en-us\!!! read this !!!.hta
C:\users\all users\microsoft\assistance\client\1.0\how to recover encrypted files.txt
C:\users\all users\microsoft\assistance\client\1.0\!!! read this !!!.hta
C:\users\all users\microsoft\assistance\client\how to recover encrypted files.txt
C:\users\all users\application data\how to recover encrypted files.txt
C:\users\all users\microsoft\assistance\client\!!! read this !!!.hta
C:\users\all users\adobe\setup\how to recover encrypted files.txt
C:\users\all users\microsoft\how to recover encrypted files.txt
C:\users\all users\microsoft\!!! read this !!!.hta
C:\users\all users\favorites\how to recover encrypted files.txt
C:\users\all users\favorites\!!! read this !!!.hta
C:\users\all users\documents\how to recover encrypted files.txt
C:\users\all users\documents\!!! read this !!!.hta
C:\users\all users\desktop\how to recover encrypted files.txt
C:\users\all users\microsoft\assistance\how to recover encrypted files.txt
C:\users\all users\microsoft\mf\how to recover encrypted files.txt
C:\far2\addons\shell\!!! read this !!!.hta
C:\users\all users\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\!!! read this !!!.hta
C:\far2\addons\colors\default_highlighting\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\3082\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\3082\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\7.0\2052\how to recover encrypted files.txt
C:\far2\addons\colors\default_highlighting\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\7.0\2052\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\7.0\1050\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\1050\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\7.0\1049\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\8.0\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\1046\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\1046\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\7.0\1042\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\1042\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\7.0\1041\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\1041\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\7.0\1040\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\1049\how to recover encrypted files.txt
C:\users\all users\microsoft\device stage\task\!!! read this !!!.hta
C:\users\all users\microsoft\netframework\!!! read this !!!.hta
C:\far2\addons\setup\how to recover encrypted files.txt
C:\far2\addons\setup\!!! read this !!!.hta
C:\users\all users\microsoft\office\uicaptions\1036\how to recover encrypted files.txt
C:\users\all users\microsoft\office\uicaptions\1036\!!! read this !!!.hta
C:\users\all users\microsoft\office\uicaptions\how to recover encrypted files.txt
C:\users\all users\microsoft\office\uicaptions\!!! read this !!!.hta
C:\far2\addons\macros\how to recover encrypted files.txt
C:\far2\addons\macros\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\7.0\1040\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\8.0\!!! read this !!!.hta
C:\users\all users\microsoft\network\downloader\how to recover encrypted files.txt
C:\users\all users\microsoft\network\downloader\!!! read this !!!.hta
C:\users\all users\microsoft\network\connections\how to recover encrypted files.txt
C:\users\all users\microsoft\network\connections\!!! read this !!!.hta
C:\users\all users\microsoft\network\how to recover encrypted files.txt
C:\users\all users\microsoft\network\!!! read this !!!.hta
C:\users\all users\microsoft\netframework\breadcrumbstore\how to recover encrypted files.txt
C:\users\all users\microsoft\netframework\breadcrumbstore\!!! read this !!!.hta
C:\users\all users\microsoft\office\!!! read this !!!.hta
C:\users\all users\microsoft\netframework\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\1036\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\1036\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\7.0\1033\how to recover encrypted files.txt
C:\users\all users\microsoft\devicesync\how to recover encrypted files.txt
C:\users\all users\microsoft\ehome\logs\how to recover encrypted files.txt
C:\users\all users\microsoft\ehome\logs\!!! read this !!!.hta
C:\users\all users\microsoft\ehome\how to recover encrypted files.txt
C:\users\all users\microsoft\ehome\!!! read this !!!.hta
C:\users\all users\microsoft\drm\server\how to recover encrypted files.txt
C:\users\all users\microsoft\drm\server\!!! read this !!!.hta
C:\users\all users\microsoft\drm\how to recover encrypted files.txt
C:\users\all users\microsoft\device stage\task\how to recover encrypted files.txt
C:\users\all users\microsoft\event viewer\how to recover encrypted files.txt
C:\users\all users\microsoft\devicesync\!!! read this !!!.hta
C:\users\all users\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\how to recover encrypted files.txt
C:\users\all users\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\!!! read this !!!.hta
C:\users\all users\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\how to recover encrypted files.txt
C:\users\all users\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\!!! read this !!!.hta
C:\users\all users\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\how to recover encrypted files.txt
C:\users\all users\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\!!! read this !!!.hta
C:\users\all users\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\how to recover encrypted files.txt
C:\users\all users\microsoft\drm\!!! read this !!!.hta
C:\far2\addons\shell\how to recover encrypted files.txt
C:\users\all users\microsoft\event viewer\views\!!! read this !!!.hta
C:\users\all users\microsoft\event viewer\views\applicationviewsrootnode\how to recover encrypted files.txt
C:\users\all users\microsoft\event viewer\views\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\1033\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\7.0\1031\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\1031\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\7.0\1028\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\1028\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\7.0\how to recover encrypted files.txt
C:\users\all users\microsoft\msdn\7.0\!!! read this !!!.hta
C:\users\all users\microsoft\event viewer\views\applicationviewsrootnode\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\how to recover encrypted files.txt
C:\users\all users\microsoft\event viewer\!!! read this !!!.hta
C:\users\all users\microsoft\mf\!!! read this !!!.hta
C:\users\all users\microsoft\media player\how to recover encrypted files.txt
C:\users\all users\microsoft\media player\!!! read this !!!.hta
C:\users\all users\microsoft\ilscache\how to recover encrypted files.txt
C:\users\all users\microsoft\ilscache\!!! read this !!!.hta
C:\users\all users\microsoft\identitycrl\how to recover encrypted files.txt
C:\users\all users\microsoft\identitycrl\!!! read this !!!.hta
C:\users\all users\microsoft\msdn\!!! read this !!!.hta
C:\msocache\all users\how to recover encrypted files.txt

Moves itself

from <Full path to file> to <Current directory>\[heeeh98@tutanota.com][id=abcbb3e8]<File name>.exe.notfound

Modifies user data files (Trojan.Encoder).

Network activity

TCP

HTTP GET requests

http://te########tion.000webhostapp.com/index.php?ui#############################################################################################################################################...

UDP

DNS ASK te########tion.000webhostapp.com

Miscellaneous

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c vol C

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial