Trojan.Encoder.35792

Technical Information

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Moves the following files

from %TEMP%\adobearm.log to %TEMP%\adobearm.log.protected
from %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf to %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf to %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf to %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\duh.swf to %APPDATA%\icqm\icq\smiles\flash\duh.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\gangsta.swf to %APPDATA%\icqm\icq\smiles\flash\gangsta.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\guby.swf to %APPDATA%\icqm\icq\smiles\flash\guby.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf to %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\drako_love.swf to %APPDATA%\icqm\icq\smiles\flash\drako_love.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\information.swf to %APPDATA%\icqm\icq\smiles\flash\information.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf to %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf to %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf to %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf to %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf to %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf to %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\joy.swf to %APPDATA%\icqm\icq\smiles\flash\joy.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\kisses.swf to %APPDATA%\icqm\icq\smiles\flash\kisses.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf to %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\devochka.swf to %APPDATA%\icqm\icq\smiles\flash\devochka.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\chillout.swf to %APPDATA%\icqm\icq\smiles\flash\chillout.swf.protected
from %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif.protected
from %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif.protected
from %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif.protected
from %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif.protected
from %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif.protected
from %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif.protected
from %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif.protected
from %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif.protected
from %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif.protected
from %APPDATA%\icqm\icq\smiles\flash\angel.swf to %APPDATA%\icqm\icq\smiles\flash\angel.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf to %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\beback.swf to %APPDATA%\icqm\icq\smiles\flash\beback.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\beer.swf to %APPDATA%\icqm\icq\smiles\flash\beer.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\bodun.swf to %APPDATA%\icqm\icq\smiles\flash\bodun.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\boo.swf to %APPDATA%\icqm\icq\smiles\flash\boo.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\canthearu.swf to %APPDATA%\icqm\icq\smiles\flash\canthearu.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\akitaka.swf to %APPDATA%\icqm\icq\smiles\flash\akitaka.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\krizis.swf to %APPDATA%\icqm\icq\smiles\flash\krizis.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\laugh.swf to %APPDATA%\icqm\icq\smiles\flash\laugh.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\likeu.swf to %APPDATA%\icqm\icq\smiles\flash\likeu.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif.protected
from %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif.protected
from %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\mad dog.swf to %APPDATA%\icqm\icq\smiles\flash\mad dog.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\missyou.swf to %APPDATA%\icqm\icq\smiles\flash\missyou.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf to %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\rosy.swf to %APPDATA%\icqm\icq\smiles\flash\rosy.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\serdze.swf to %APPDATA%\icqm\icq\smiles\flash\serdze.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\skratch.swf to %APPDATA%\icqm\icq\smiles\flash\skratch.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\smeh.swf to %APPDATA%\icqm\icq\smiles\flash\smeh.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\sobaka.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\sorry.swf to %APPDATA%\icqm\icq\smiles\flash\sorry.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\tank.swf to %APPDATA%\icqm\icq\smiles\flash\tank.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf.protected
from %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf to %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf.protected
from %APPDATA%\icqm\icq\smiles\skin.txt to %APPDATA%\icqm\icq\smiles\skin.txt.protected
from %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif.protected
from %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif.protected
from %APPDATA%\icqm\icq\dll\mratag.dll to %APPDATA%\icqm\icq\dll\mratag.dll.protected
from %APPDATA%\icqm\icq\fonts\segoesc.ttf to %APPDATA%\icqm\icq\fonts\segoesc.ttf.protected
from %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log.protected
from %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log.protected
from %TEMP%\dd_vcredist_x86_20151216210157.log to %TEMP%\dd_vcredist_x86_20151216210157.log.protected
from %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log.protected
from %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log.protected
from %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt to %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt.protected
from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.protected
from %TEMP%\dd_vcredist_amd64_20151216210341.log to %TEMP%\dd_vcredist_amd64_20151216210341.log.protected
from %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt to %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt.protected
from %TEMP%\dotnetfx.log to %TEMP%\dotnetfx.log.protected
from %TEMP%\dotnetfxsdk.log to %TEMP%\dotnetfxsdk.log.protected
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.protected
from %TEMP%\jusched.log to %TEMP%\jusched.log.protected
from %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txt to %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txt.protected
from %TEMP%\microsoft .net framework 4.7.1 setup_20200610_200621826-msi_netfx_full_x64.msi.txt to %TEMP%\microsoft .net framework 4.7.1 setup_20200610_200621826-msi_netfx_full_x64.msi.txt.protected
from %TEMP%\dd_wcf_ca_smci_20200611_031056_919.txt to %TEMP%\dd_wcf_ca_smci_20200611_031056_919.txt.protected
from %TEMP%\dd_wcf_ca_smci_20200611_031101_060.txt to %TEMP%\dd_wcf_ca_smci_20200611_031101_060.txt.protected
from %TEMP%\dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt.protected
from %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.protected
from %TEMP%\cvrf2a3.tmp.cvr to %TEMP%\cvrf2a3.tmp.cvr.protected
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.protected
from %TEMP%\adobe_admlogs\adobe_adm.log to %TEMP%\adobe_admlogs\adobe_adm.log.protected
from %TEMP%\adobe_admlogs\adobe_gde.log to %TEMP%\adobe_admlogs\adobe_gde.log.protected
from %TEMP%\aspnetsetup.log to %TEMP%\aspnetsetup.log.protected
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.protected
from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.protected
from %TEMP%\aspnetsetup_00002.log to %TEMP%\aspnetsetup_00002.log.protected
from %TEMP%\adobearm_notlocked.log to %TEMP%\adobearm_notlocked.log.protected
from %TEMP%\aspnetsetup_00003.log to %TEMP%\aspnetsetup_00003.log.protected
from %TEMP%\cprogram files (x86)opera29.0.1795.47opera_autoupdate.metrics.lock to %TEMP%\cprogram files (x86)opera29.0.1795.47opera_autoupdate.metrics.lock.protected
from %TEMP%\cvr6b9c.tmp.cvr to %TEMP%\cvr6b9c.tmp.cvr.protected
from %TEMP%\cvr6d44.tmp.cvr to %TEMP%\cvr6d44.tmp.cvr.protected
from %TEMP%\cvrbada.tmp.cvr to %TEMP%\cvrbada.tmp.cvr.protected
from %TEMP%\cvrc867.tmp.cvr to %TEMP%\cvrc867.tmp.cvr.protected
from %TEMP%\cvrde7f.tmp.cvr to %TEMP%\cvrde7f.tmp.cvr.protected
from %TEMP%\cvreaf2.tmp.cvr to %TEMP%\cvreaf2.tmp.cvr.protected
from %TEMP%\cprogram files (x86)opera29.0.1795.47opera_autoupdate.download.lock to %TEMP%\cprogram files (x86)opera29.0.1795.47opera_autoupdate.download.lock.protected
from %TEMP%\mirc741.exe to %TEMP%\mirc741.exe.protected
from %TEMP%\msi1cfbe.log to %TEMP%\msi1cfbe.log.protected
from %TEMP%\msic204f.log to %TEMP%\msic204f.log.protected
from %TEMP%\msid38c.log to %TEMP%\msid38c.log.protected
from %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav to %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav.protected
from %APPDATA%\adobe\flash player\nativecache\nativecache.directory to %APPDATA%\adobe\flash player\nativecache\nativecache.directory.protected
from %APPDATA%\adobe\logtransport2\logtransport2.cfg to %APPDATA%\adobe\logtransport2\logtransport2.cfg.protected
from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\mra.dbs.protected
from %APPDATA%\icq-profile\base\opt.dbs to %APPDATA%\icq-profile\base\opt.dbs.protected
from %APPDATA%\icq-profile\update\languages.aff to %APPDATA%\icq-profile\update\languages.aff.protected
from %APPDATA%\icq-profile\update\languages.dict to %APPDATA%\icq-profile\update\languages.dict.protected
from %APPDATA%\icq-profile\update\ver.txt to %APPDATA%\icq-profile\update\ver.txt.protected
from %APPDATA%\icq-profile\update\languages.hash to %APPDATA%\icq-profile\update\languages.hash.protected
from %APPDATA%\icqm\icq\database\citylist_en.csv to %APPDATA%\icqm\icq\database\citylist_en.csv.protected
from %APPDATA%\icqm\icq\database\citylist_kz.csv to %APPDATA%\icqm\icq\database\citylist_kz.csv.protected
from %APPDATA%\icqm\icq\database\citylist_ru.csv to %APPDATA%\icqm\icq\database\citylist_ru.csv.protected
from %APPDATA%\icqm\icq\database\citylist_tr.csv to %APPDATA%\icqm\icq\database\citylist_tr.csv.protected
from %APPDATA%\icqm\icq\database\citylist_ua.csv to %APPDATA%\icqm\icq\database\citylist_ua.csv.protected
from %APPDATA%\icqm\icq\database\citylist_uz.csv to %APPDATA%\icqm\icq\database\citylist_uz.csv.protected
from %APPDATA%\icqm\icq\dll\altergeo.msi to %APPDATA%\icqm\icq\dll\altergeo.msi.protected
from %APPDATA%\icqm\icq\dll\mousephone.dll to %APPDATA%\icqm\icq\dll\mousephone.dll.protected
from %APPDATA%\adobe\acrobat\dc\tmdocs.sav to %APPDATA%\adobe\acrobat\dc\tmdocs.sav.protected
from %APPDATA%\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl to %APPDATA%\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl.protected
from %APPDATA%\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl to %APPDATA%\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl.protected
from %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata to %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata.protected
from %TEMP%\msieb217.log to %TEMP%\msieb217.log.protected
from %TEMP%\msie45bf.log to %TEMP%\msie45bf.log.protected
from %TEMP%\opera_crashreporter.log to %TEMP%\opera_crashreporter.log.protected
from %TEMP%\opera installer\opera_installer_20150506170826.log to %TEMP%\opera installer\opera_installer_20150506170826.log.protected
from %TEMP%\opera installer\opera_installer_20150506170843.log to %TEMP%\opera installer\opera_installer_20150506170843.log.protected
from %TEMP%\opera installer\opera_installer_20150506170857.log to %TEMP%\opera installer\opera_installer_20150506170857.log.protected
from %TEMP%\rgi8564.tmp-tmp to %TEMP%\rgi8564.tmp-tmp.protected
from %TEMP%\rgie195.tmp-tmp to %TEMP%\rgie195.tmp-tmp.protected
from %TEMP%\setupexe(20151124155624744).log to %TEMP%\setupexe(20151124155624744).log.protected
from %TEMP%\setupexe(201603101200226dc).log to %TEMP%\setupexe(201603101200226dc).log.protected
from %TEMP%\setupexe(20160310140634718).log to %TEMP%\setupexe(20160310140634718).log.protected
from %TEMP%\webinstaller\qnzuposrqouvfisa\data.txt to %TEMP%\webinstaller\qnzuposrqouvfisa\data.txt.protected
from %TEMP%\webinstaller\qnzuposrqouvfisa\variant.js to %TEMP%\webinstaller\qnzuposrqouvfisa\variant.js.protected
from %TEMP%\wmsetup.log to %TEMP%\wmsetup.log.protected
from %TEMP%\temp1_fp_13.0.0.182_archive.zip\fp_13.0.0.182_archive\13_0_r0_182\flashplayer13_0r0_182_winax.msi to %TEMP%\temp1_fp_13.0.0.182_archive.zip\fp_13.0.0.182_archive\13_0_r0_182\flashplayer13_0r0_182_winax.msi.protected
from %APPDATA%\adobe\acrobat\dc\jscache\globdata to %APPDATA%\adobe\acrobat\dc\jscache\globdata.protected
from %APPDATA%\adobe\acrobat\dc\jscache\globsettings to %APPDATA%\adobe\acrobat\dc\jscache\globsettings.protected
from %APPDATA%\icqm\icq\dll\mailrusputnik.exe to %APPDATA%\icqm\icq\dll\mailrusputnik.exe.protected
from %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif.protected

Modifies the following files

%LOCALAPPDATA%\adobe\acrobat\dc\adobecmapfnt15.lst
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_2
%HOMEPATH%\favorites\microsoft websites\microsoft store.url
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_1
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_0
%HOMEPATH%\favorites\microsoft websites\microsoft at work.url
%HOMEPATH%\desktop\qip 2012.lnk
%HOMEPATH%\desktop\mail.ru agent.lnk
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\chromedwritefontcache
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url
%HOMEPATH%\links\recentplaces.lnk
%HOMEPATH%\desktop\icq.lnk
%HOMEPATH%\links\downloads.lnk
%LOCALAPPDATA%\adobe\acrobat\dc\usercache.bin
%HOMEPATH%\favorites\links for united states\usa.gov.url
%LOCALAPPDATA%\adobe\acrobat\dc\shareddataevents
%HOMEPATH%\favorites\links for united states\gobiernousa.gov.url
%HOMEPATH%\links\desktop.lnk
%HOMEPATH%\favorites\links\web slice gallery.url
%HOMEPATH%\desktop\delete.avi
%LOCALAPPDATA%\adobe\acrobat\dc\cache\acrofnt15.lst
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\contacts\user.contact
%LOCALAPPDATA%\adobe\acrobat\dc\adobesysfnt15.lst
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\favorites\msn websites\msn autos.url
%HOMEPATH%\desktop\telegram.lnk

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial