Trojan.Encoder.10362

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SoftWare\Microsoft\Windows\CurrentVersion\Run] 'Oracle Microsoft' = '"%PROGRAMDATA%\MicroSoftTMP\system32\conhost.exe"'
[<HKCU>\SoftWare\Microsoft\Windows\CurrentVersion\RunOnce] '*Oracle Microsoft' = '"%PROGRAMDATA%\MicroSoftTMP\system32\conhost.exe"'
[<HKCU>\SoftWare\Microsoft\Windows\CurrentVersion\Run] 'Oracle Microsoft Updater' = '"<Full path to file>"'
[<HKCU>\SoftWare\Microsoft\Windows\CurrentVersion\RunOnce] '*Oracle Microsoft Updater' = '"<Full path to file>"'

Creates the following files on removable media

<Drive name for removable media>:\gvyrvzntr.ozc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
<Drive name for removable media>:\pbssrr.ozc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
<Drive name for removable media>:\qvny.ozc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
<Drive name for removable media>:\qnfuobeqre_96.ozc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
<Drive name for removable media>:\qnfuobeqre_120.ozc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
<Drive name for removable media>:\qnfuobeqre_192.ozc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
<Drive name for removable media>:\pbagbfbebbg_1.pre.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
<Drive name for removable media>:\fqxfnzcyrhaceviqrirybcre.pre.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
<Drive name for removable media>:\grfgrr.pre.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
<Drive name for removable media>:\pbagbfb.pre.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
<Drive name for removable media>:\pbagbfbebbg.pre.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
<Drive name for removable media>:\czq.pre.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\13.jpg
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\region-north-karelia.jpg
%HOMEPATH%\desktop\pushkin.jpeg
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\trivial-merge.htm
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\2.jpg
%HOMEPATH%\desktop\2.jpeg
%HOMEPATH%\desktop\168.jpeg
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

%PROGRAMDATA%\microsofttmp\system32\conhost.exe
C:\users\public\documents\my music\# restoring files #.html
C:\users\public\# restoring files #.txt
C:\users\public\# restoring files #.html
C:\users\default\templates\# restoring files #.txt
C:\users\default\templates\# restoring files #.html
C:\users\default\start menu\# restoring files #.txt
C:\users\default\start menu\# restoring files #.html
C:\users\default\sendto\# restoring files #.txt
C:\users\default\sendto\# restoring files #.html
C:\users\default\saved games\# restoring files #.txt
C:\users\default\saved games\# restoring files #.html
C:\users\default\recent\# restoring files #.txt
C:\users\default\recent\# restoring files #.html
C:\users\default\printhood\# restoring files #.txt
C:\users\default\printhood\# restoring files #.html
C:\users\default\nethood\# restoring files #.txt
C:\users\default\nethood\# restoring files #.html
C:\users\default\local settings\# restoring files #.txt
C:\users\default\local settings\# restoring files #.html
C:\users\default\links\# restoring files #.html
C:\users\default\links\# restoring files #.txt
C:\users\public\documents\my music\# restoring files #.txt
C:\users\public\documents\my pictures\# restoring files #.html
C:\users\public\pictures\sample pictures\wryylsvfu.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\public\pictures\sample pictures\ulqenatrnf.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\public\pictures\sample pictures\qrfreg.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\public\pictures\sample pictures\puelfnagurzhz.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\public\music\sample music\# restoring files #.txt
C:\users\public\music\sample music\# restoring files #.html
C:\users\public\music\sample music\fyrrc njnl.zc3.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\public\music\sample music\znvq jvgu gur synkra unve.zc3.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\public\music\sample music\xnyvzon.zc3.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\public\music\sample music\nyohzneg_{5sn05q35-n682-4ns6-96s7-0773r42q4q16}_fznyy.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\default\favorites\# restoring files #.html
C:\users\public\music\sample music\nyohzneg_{5sn05q35-n682-4ns6-96s7-0773r42q4q16}_ynetr.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\public\music\sample music\nyohznegfznyy.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\public\libraries\# restoring files #.txt
C:\users\public\libraries\# restoring files #.html
C:\users\public\downloads\# restoring files #.txt
C:\users\public\downloads\# restoring files #.html
C:\users\public\documents\my videos\# restoring files #.txt
C:\users\public\documents\my videos\# restoring files #.html
C:\users\public\documents\my pictures\# restoring files #.txt
C:\users\default\favorites\# restoring files #.txt
C:\users\default\downloads\# restoring files #.txt
C:\users\public\pictures\sample pictures\yvtugubhfr.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%ALLUSERSPROFILE%\templates\# restoring files #.html
%ALLUSERSPROFILE%\sun\java\java update\wnhertyvfg.kzy.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%ALLUSERSPROFILE%\sun\java\# restoring files #.txt
%ALLUSERSPROFILE%\sun\java\# restoring files #.html
%ALLUSERSPROFILE%\sun\# restoring files #.txt
%ALLUSERSPROFILE%\sun\# restoring files #.html
%ALLUSERSPROFILE%\start menu\# restoring files #.txt
%ALLUSERSPROFILE%\start menu\# restoring files #.html
%ALLUSERSPROFILE%\package cache\# restoring files #.txt
%ALLUSERSPROFILE%\package cache\# restoring files #.html
%ALLUSERSPROFILE%\oracle\java\javapath\# restoring files #.txt
%ALLUSERSPROFILE%\oracle\java\javapath\# restoring files #.html
%ALLUSERSPROFILE%\oracle\java\installcache_x64\# restoring files #.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\# restoring files #.html
%ALLUSERSPROFILE%\oracle\java\# restoring files #.txt
%ALLUSERSPROFILE%\oracle\java\# restoring files #.html
%ALLUSERSPROFILE%\oracle\# restoring files #.txt
%ALLUSERSPROFILE%\oracle\# restoring files #.html
%ALLUSERSPROFILE%\mozilla\logs\# restoring files #.txt
%ALLUSERSPROFILE%\templates\# restoring files #.txt
C:\users\default\aghfre.qng.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\default\downloads\# restoring files #.html
C:\users\default\desktop\# restoring files #.html
C:\users\default\desktop\# restoring files #.txt
C:\users\default\documents\my videos\# restoring files #.txt
C:\users\default\documents\my videos\# restoring files #.html
C:\users\default\documents\my pictures\# restoring files #.txt
C:\users\default\documents\my pictures\# restoring files #.html
C:\users\default\documents\my music\# restoring files #.txt
C:\users\default\documents\my music\# restoring files #.html
C:\users\default\documents\# restoring files #.txt
C:\users\default\documents\# restoring files #.html
C:\users\public\music\sample music\sbyqre.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\public\pictures\sample pictures\xbnyn.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%ALLUSERSPROFILE%\sun\java\java update\# restoring files #.html
C:\users\default\cookies\# restoring files #.html
C:\users\default\application data\# restoring files #.txt
C:\users\default\application data\# restoring files #.html
C:\users\default\appdata\# restoring files #.txt
C:\users\default\appdata\# restoring files #.html
C:\users\default\# restoring files #.txt
C:\users\default\# restoring files #.html
C:\users\default\aghfre.qng.ybt.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\default\cookies\# restoring files #.txt
C:\msocache\# restoring files #.txt
C:\users\public\pictures\sample pictures\crathvaf.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\local settings\# restoring files #.txt
%HOMEPATH%\local settings\# restoring files #.html
%HOMEPATH%\links\# restoring files #.txt
%HOMEPATH%\links\# restoring files #.html
%HOMEPATH%\favorites\windows live\# restoring files #.txt
%HOMEPATH%\favorites\windows live\# restoring files #.html
%HOMEPATH%\favorites\msn websites\# restoring files #.txt
%HOMEPATH%\favorites\msn websites\# restoring files #.html
%HOMEPATH%\favorites\microsoft websites\# restoring files #.txt
%HOMEPATH%\favorites\microsoft websites\# restoring files #.html
%HOMEPATH%\favorites\links for united states\# restoring files #.txt
%HOMEPATH%\favorites\links for united states\# restoring files #.html
%HOMEPATH%\favorites\links\# restoring files #.txt
%HOMEPATH%\favorites\links\# restoring files #.html
%HOMEPATH%\favorites\# restoring files #.txt
%HOMEPATH%\favorites\# restoring files #.html
%HOMEPATH%\downloads\# restoring files #.txt
%HOMEPATH%\downloads\# restoring files #.html
%HOMEPATH%\documents\my videos\# restoring files #.txt
%HOMEPATH%\nethood\# restoring files #.html
%HOMEPATH%\nethood\# restoring files #.txt
%HOMEPATH%\printhood\# restoring files #.html
%HOMEPATH%\printhood\# restoring files #.txt
D:\$recycle.bin\# restoring files #.html
D:\# restoring files #.txt
D:\# restoring files #.html
D:\vafgnyy.ybt.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%WINDIR%\# restoring files #.txt
%WINDIR%\# restoring files #.html
%HOMEPATH%\voip\# restoring files #.txt
%HOMEPATH%\voip\# restoring files #.html
%HOMEPATH%\templates\# restoring files #.txt
%HOMEPATH%\documents\my videos\# restoring files #.html
%ALLUSERSPROFILE%\mozilla\logs\# restoring files #.html
%HOMEPATH%\start menu\# restoring files #.html
%HOMEPATH%\sendto\# restoring files #.txt
%HOMEPATH%\sendto\# restoring files #.html
%HOMEPATH%\searches\# restoring files #.txt
%HOMEPATH%\searches\# restoring files #.html
%HOMEPATH%\saved games\# restoring files #.txt
%HOMEPATH%\saved games\# restoring files #.html
%HOMEPATH%\recent\# restoring files #.txt
%HOMEPATH%\recent\# restoring files #.html
%HOMEPATH%\start menu\# restoring files #.txt
%HOMEPATH%\documents\my pictures\# restoring files #.txt
%ALLUSERSPROFILE%\sun\java\java update\# restoring files #.txt
%HOMEPATH%\documents\my music\# restoring files #.txt
%HOMEPATH%\desktop\tyvqrfpbcr_erivrj_eri_010.qbpk.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\cookies\# restoring files #.html
%HOMEPATH%\contacts\# restoring files #.txt
%HOMEPATH%\contacts\# restoring files #.html
%HOMEPATH%\application data\# restoring files #.txt
%HOMEPATH%\application data\# restoring files #.html
%HOMEPATH%\appdata\# restoring files #.txt
%HOMEPATH%\appdata\# restoring files #.html
%HOMEPATH%\# restoring files #.txt
%HOMEPATH%\# restoring files #.html
C:\users\public\videos\sample videos\# restoring files #.txt
C:\users\public\videos\sample videos\# restoring files #.html
C:\users\public\videos\sample videos\jvyqyvsr.jzi.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\users\public\recorded tv\sample media\# restoring files #.txt
C:\users\public\recorded tv\sample media\# restoring files #.html
C:\users\public\recorded tv\# restoring files #.txt
C:\users\public\recorded tv\# restoring files #.html
C:\users\public\pictures\sample pictures\# restoring files #.txt
C:\users\public\pictures\sample pictures\# restoring files #.html
%HOMEPATH%\desktop\13.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\168.wcrt.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\2.wcrt.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\2.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\documents\my music\# restoring files #.html
%HOMEPATH%\documents\# restoring files #.txt
%HOMEPATH%\documents\# restoring files #.html
%HOMEPATH%\desktop\jrrxylfurrg1215.qbp.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\gevivny-zretr.ugz.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\guycf_xrrcre_znlre_1965.qbpk.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\fqfmsb.qbpk.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\ertvba-abegu-xneryvn.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\chfuxva.wcrt.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\documents\my pictures\# restoring files #.html
C:\users\public\pictures\sample pictures\ghyvcf.wct.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\svyr_c_00000000_1371597592.qbpk.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\sv51.qbp.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\qnfuobeqre_192.ozc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\qnfuobeqre_120.ozc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\pbagbfbebbg.pre.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\pbagbfb.pre.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\nccyvpnagsbez_ra.qbp.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\nyreg.ugzy.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\nyreg.ugz.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\desktop\tneqra.ugz.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\cookies\# restoring files #.txt
%ALLUSERSPROFILE%\mozilla\logs\znvagranaprfreivpr-havafgnyy.ybt.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%ALLUSERSPROFILE%\mozilla\logs\znvagranaprfreivpr-vafgnyy.ybt.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%ALLUSERSPROFILE%\mozilla\# restoring files #.txt
C:\far2\plugins\brackets\# restoring files #.txt
C:\far2\plugins\autowrap\# restoring files #.txt
C:\far2\plugins\autowrap\# restoring files #.html
C:\far2\plugins\autowrap\nhgbjenc.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\arclite\# restoring files #.txt
C:\far2\plugins\arclite\# restoring files #.html
C:\far2\plugins\arclite\nepyvgr.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\align\# restoring files #.txt
C:\far2\plugins\align\# restoring files #.html
C:\far2\plugins\align\nyvta.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\# restoring files #.txt
C:\far2\plugins\# restoring files #.html
C:\far2\fexcept\# restoring files #.txt
C:\far2\fexcept\# restoring files #.html
C:\far2\encyclopedia\tap\# restoring files #.txt
C:\far2\encyclopedia\tap\# restoring files #.html
C:\far2\encyclopedia\# restoring files #.txt
C:\far2\encyclopedia\# restoring files #.html
C:\far2\documentation\rus\# restoring files #.txt
C:\far2\plugins\compare\pbzcner.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\compare\# restoring files #.html
C:\far2\plugins\ftp\abgrf.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\emenu\# restoring files #.txt
C:\far2\plugins\farcmds\snepzqf.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\ftp\sgcpzqf_ehf.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\ftp\sgcpzqf.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\ftp\snesgc.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\filecase\# restoring files #.txt
C:\far2\plugins\filecase\# restoring files #.html
C:\far2\plugins\filecase\svyrpnfr.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\farcmds\# restoring files #.txt
C:\far2\plugins\farcmds\# restoring files #.html
C:\far2\plugins\brackets\# restoring files #.html
C:\far2\documentation\rus\# restoring files #.html
C:\far2\documentation\eng\nep_fhccbeg.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\emenu\rzrah.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\editcase\# restoring files #.txt
C:\far2\plugins\editcase\# restoring files #.html
C:\far2\plugins\editcase\rqvgpnfr.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\drawline\# restoring files #.txt
C:\far2\plugins\drawline\# restoring files #.html
C:\far2\plugins\drawline\qenjyvar.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\compare\# restoring files #.txt
C:\far2\plugins\emenu\# restoring files #.html
D:\$recycle.bin\# restoring files #.txt
C:\far2\plugins\ftp\abgrf_ehf.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\documentation\rus\cyhtvaf_vafgnyy.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\addons\colors\default_highlighting\# restoring files #.html
C:\far2\addons\colors\custom_highlighting\# restoring files #.txt
C:\far2\addons\colors\custom_highlighting\# restoring files #.html
C:\far2\addons\colors\# restoring files #.txt
C:\far2\addons\colors\# restoring files #.html
C:\far2\addons\# restoring files #.txt
C:\far2\addons\# restoring files #.html
C:\far2\addons\ernqzr.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\# restoring files #.txt
C:\far2\# restoring files #.html
C:\far2\svyr_vq.qvm.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\sne.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\documents and settings\# restoring files #.txt
C:\documents and settings\# restoring files #.html
C:\$recycle.bin\# restoring files #.txt
C:\$recycle.bin\# restoring files #.html
C:\# restoring files #.txt
C:\# restoring files #.html
C:\far2\addons\macros\# restoring files #.html
C:\far2\addons\macros\# restoring files #.txt
C:\far2\addons\colors\default_highlighting\# restoring files #.txt
C:\far2\addons\setup\# restoring files #.html
C:\far2\documentation\rus\sne_snd.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\addons\setup\# restoring files #.txt
C:\far2\documentation\rus\oht_ercbeg.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\documentation\rus\nep_fhccbeg.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\documentation\eng\# restoring files #.txt
C:\far2\documentation\eng\# restoring files #.html
C:\far2\documentation\eng\grpuvasb.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\documentation\eng\cyhtvaf_erivrj.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\documentation\eng\cyhtvaf_vafgnyy.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\documentation\eng\sne_snd.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\documentation\rus\grpuvasb.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\documentation\rus\cyhtvaf_erivrj.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\documentation\# restoring files #.txt
C:\far2\documentation\# restoring files #.html
C:\far2\addons\xlat\russian\# restoring files #.txt
C:\far2\addons\xlat\russian\# restoring files #.html
C:\far2\addons\xlat\# restoring files #.txt
C:\far2\addons\xlat\# restoring files #.html
C:\far2\addons\shell\# restoring files #.txt
C:\far2\addons\shell\# restoring files #.html
C:\far2\addons\shell\sneurer.vas.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\documentation\eng\oht_ercbeg.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%HOMEPATH%\templates\# restoring files #.html
C:\far2\plugins\ftp\# restoring files #.html
C:\far2\plugins\ftp\lib\sgccebterff.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%ALLUSERSPROFILE%\adobe\arm\s\# restoring files #.txt
%ALLUSERSPROFILE%\adobe\arm\s\# restoring files #.html
%ALLUSERSPROFILE%\adobe\arm\reader_15.008.20082\# restoring files #.txt
%ALLUSERSPROFILE%\adobe\arm\reader_15.008.20082\# restoring files #.html
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\# restoring files #.txt
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\# restoring files #.html
%ALLUSERSPROFILE%\adobe\arm\# restoring files #.txt
%ALLUSERSPROFILE%\adobe\arm\# restoring files #.html
%ALLUSERSPROFILE%\adobe\# restoring files #.txt
%ALLUSERSPROFILE%\adobe\# restoring files #.html
C:\totalcmd\language\# restoring files #.txt
C:\totalcmd\language\# restoring files #.html
C:\totalcmd\# restoring files #.txt
C:\totalcmd\# restoring files #.html
C:\totalcmd\fvmr!.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\totalcmd\ertvfgre.egs.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\totalcmd\ab.one.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\totalcmd\xrlobneq.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\totalcmd\uvfgbel.gkg.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%ALLUSERSPROFILE%\adobe\arm\s\10428\# restoring files #.html
%ALLUSERSPROFILE%\adobe\arm\s\10428\# restoring files #.txt
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\# restoring files #.html
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\# restoring files #.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\# restoring files #.txt
%ALLUSERSPROFILE%\mozilla\# restoring files #.html
%ALLUSERSPROFILE%\microsofttmp\# restoring files #.txt
%ALLUSERSPROFILE%\microsofttmp\# restoring files #.html
%ALLUSERSPROFILE%\microsoft toolkit\# restoring files #.txt
%ALLUSERSPROFILE%\microsoft toolkit\# restoring files #.html
%ALLUSERSPROFILE%\microsoft help\# restoring files #.txt
%ALLUSERSPROFILE%\microsoft help\# restoring files #.html
%ALLUSERSPROFILE%\microsoft\# restoring files #.txt
C:\totalcmd\qrsnhyg.one.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%ALLUSERSPROFILE%\microsoft\# restoring files #.html
C:\far2\plugins\ftp\# restoring files #.txt
%ALLUSERSPROFILE%\documents\# restoring files #.txt
%ALLUSERSPROFILE%\documents\# restoring files #.html
%ALLUSERSPROFILE%\desktop\# restoring files #.txt
%ALLUSERSPROFILE%\desktop\# restoring files #.html
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\# restoring files #.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\# restoring files #.html
%ALLUSERSPROFILE%\adobe\setup\# restoring files #.txt
%ALLUSERSPROFILE%\adobe\setup\# restoring files #.html
%ALLUSERSPROFILE%\favorites\# restoring files #.txt
C:\far2\plugins\ftp\lib\sgcqveyvfg.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
%ALLUSERSPROFILE%\favorites\# restoring files #.html
C:\far2\plugins\brackets\oenpxrgf.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\pluginsdk\headers.c\snepbybe.ucc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\pluginsdk\# restoring files #.txt
C:\far2\pluginsdk\# restoring files #.html
C:\far2\plugins\tmppanel\# restoring files #.txt
C:\far2\plugins\tmppanel\# restoring files #.html
C:\far2\plugins\proclist\# restoring files #.txt
C:\far2\plugins\proclist\# restoring files #.html
C:\far2\plugins\proclist\cebpyvfg.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\network\# restoring files #.txt
C:\far2\plugins\network\# restoring files #.html
C:\far2\plugins\network\argjbex.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\macroview\# restoring files #.txt
C:\far2\plugins\macroview\# restoring files #.html
C:\far2\plugins\macroview\znpebivrj.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\hlfviewer\# restoring files #.txt
C:\far2\plugins\hlfviewer\# restoring files #.html
C:\far2\plugins\hlfviewer\uysivrjre.znc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\plugins\ftp\lib\# restoring files #.txt
C:\far2\plugins\ftp\lib\# restoring files #.html
C:\far2\pluginsdk\headers.c\snexrlf.ucc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\pluginsdk\headers.c\cyhtva.ucc.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\pluginsdk\headers.c\# restoring files #.html
C:\far2\pluginsdk\headers.c\# restoring files #.txt
C:\recovery\# restoring files #.txt
%PROGRAMDATA%\# restoring files #.txt
%PROGRAMDATA%\# restoring files #.html
%ProgramFiles(x86)%\# restoring files #.txt
%ProgramFiles(x86)%\# restoring files #.html
%ProgramFiles%\# restoring files #.txt
%ProgramFiles%\# restoring files #.html
C:\perflogs\admin\# restoring files #.txt
C:\perflogs\admin\# restoring files #.html
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\# restoring files #.html
C:\perflogs\# restoring files #.txt
C:\recovery\# restoring files #.html
C:\msocache\# restoring files #.html
<Current directory>\# restoring files #.txt
<Current directory>\# restoring files #.html
C:\far2\pluginsdk\headers.pas\# restoring files #.txt
C:\far2\pluginsdk\headers.pas\# restoring files #.html
C:\far2\pluginsdk\headers.pas\cyhtvaj.cnf.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\pluginsdk\headers.pas\snexrlfj.cnf.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\far2\pluginsdk\headers.pas\snepbybej.cnf.[r_sp@india.com].id[0ebcf2f2ddebae46].cryptoshield.
C:\perflogs\# restoring files #.html
%APPDATA%\ffae0118cda2.tmpfsp

Network activity

Connects to

'5.###.191.90':80

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial