Trojan.Encoder.31929

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\ransom.exe
%APPDATA%\microsoft\windows\start menu\programs\startup\info.hta

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'<SYSTEM32>\netsh.exe' netsh firewall set opmode mode=disable

Reads files which store third party applications passwords

%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\toolbar.bmp

Modifies file system

Creates the following files

C:\users\default\readme.txt
%ProgramFiles%\bdswitch\readme.txt
%ProgramFiles%\bdwizreg\readme.txt
%ProgramFiles%\blackd\readme.txt
%ProgramFiles%\blackice\readme.txt
%ProgramFiles%\blindman\readme.txt
%ProgramFiles%\btini\readme.txt
%ProgramFiles%\btinint\readme.txt
%ProgramFiles%\cabalmain\readme.txt
%ProgramFiles%\cafix\readme.txt
%ProgramFiles%\cavapp\readme.txt
%ProgramFiles%\cavasm\readme.txt
%HOMEPATH%\favorites\windows live\readme.txt
%ProgramFiles%\cavaud\readme.txt
%ProgramFiles%\cavemsrv\readme.txt
%ProgramFiles%\cavmr\readme.txt
%ProgramFiles%\cavmud\readme.txt
%ProgramFiles%\cavoar\readme.txt
%ProgramFiles%\cavq\readme.txt
%ProgramFiles%\cavscons\readme.txt
%ProgramFiles%\cavse\readme.txt
%ProgramFiles%\cavsn\readme.txt
%ProgramFiles%\bdsurvey\readme.txt
%ProgramFiles%\cavsub\readme.txt
%ProgramFiles%\bdsubmitwiz\readme.txt
%ProgramFiles%\bdss\readme.txt
%ProgramFiles%\avgscan\readme.txt
%ProgramFiles%\avgupden\readme.txt
%ProgramFiles%\avgupsvc\readme.txt
%ProgramFiles%\avgvv\readme.txt
%ProgramFiles%\avgw\readme.txt
%ProgramFiles%\avgwizfw\readme.txt
%ProgramFiles%\avinitnt\readme.txt
%ProgramFiles%\avkserv\readme.txt
%ProgramFiles%\avkservice\readme.txt
%ProgramFiles%\avkwctl\readme.txt
%ProgramFiles%\avnotify\readme.txt
%ProgramFiles%\avpcc\readme.txt
%ProgramFiles%\avpm\readme.txt
%ProgramFiles%\avscan\readme.txt
%ProgramFiles%\avsynmgr\readme.txt
%ProgramFiles%\b2\readme.txt
%ProgramFiles%\backweb-4476822\readme.txt
%ProgramFiles%\bdagent\readme.txt
%ProgramFiles%\bdmcon\readme.txt
%ProgramFiles%\bdnews\readme.txt
%ProgramFiles%\bdoesrv\readme.txt
%ProgramFiles%\bdsubmit\readme.txt
%ProgramFiles%\cavsubmit\readme.txt
%ProgramFiles%\cavumas\readme.txt
%ProgramFiles%\cavuserupd\readme.txt
%ProgramFiles(x86)%\readme.txt
C:\far2\addons\colors\readme.txt
C:\far2\addons\colors\custom_highlighting\readme.txt
C:\far2\addons\colors\default_highlighting\readme.txt
C:\far2\addons\macros\readme.txt
C:\far2\addons\setup\readme.txt
%PROGRAMDATA%\readme.txt
%ProgramFiles(x86)%\adobe\readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\readme.txt
%PROGRAMDATA%\adobe\arm\readme.txt
C:\far2\addons\shell\readme.txt
C:\totalcmd\readme.txt
C:\far2\addons\xlat\readme.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\readme.txt
%CommonProgramFiles%\microsoft shared\grphflt\readme.txt
C:\far2\addons\xlat\russian\readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\readme.txt
%PROGRAMDATA%\adobe\readme.txt
C:\far2\documentation\readme.txt
C:\far2\documentation\eng\readme.txt
%CommonProgramFiles%\microsoft shared\euro\readme.txt
%CommonProgramFiles%\microsoft shared\filters\readme.txt
%CommonProgramFiles%\microsoft shared\equation\1033\readme.txt
%CommonProgramFiles%\microsoft shared\equation\readme.txt
%CommonProgramFiles%\microsoft shared\dw\readme.txt
%ProgramFiles%\ccapp\readme.txt
%ProgramFiles%\ccevtmgr\readme.txt
%ProgramFiles%\ccleaner\readme.txt
%ProgramFiles%\ccproxy\readme.txt
%ProgramFiles%\ccsetmgr\readme.txt
%ProgramFiles%\cemrep\readme.txt
%ProgramFiles%\chrome\readme.txt
%ProgramFiles%\clamscan\readme.txt
%ProgramFiles%\clamtray\readme.txt
%ProgramFiles%\avgrssvc\readme.txt
%ProgramFiles%\claw95\readme.txt
%ProgramFiles%\clamwin\readme.txt
%ProgramFiles%\cleaner\readme.txt
%ProgramFiles%\cleaner3\readme.txt
%ProgramFiles%\clisvc\readme.txt
%ProgramFiles%\clrcche\readme.txt
%ProgramFiles%\cmain\readme.txt
%ProgramFiles%\cmgrdian\readme.txt
%CommonProgramFiles%\readme.txt
%CommonProgramFiles%\designer\readme.txt
%CommonProgramFiles%\microsoft shared\readme.txt
%ProgramFiles%\cavvl\readme.txt
%ProgramFiles%\claw95cf\readme.txt
C:\recovery\readme.txt
%ProgramFiles%\avgnpsvc\readme.txt
%ProgramFiles%\avcenter\readme.txt
<Current directory>\readme.txt
C:\far2\readme.txt
C:\perflogs\readme.txt
C:\msocache\readme.txt
C:\msocache\all users\readme.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme.txt
%HOMEPATH%\favorites\microsoft websites\readme.txt
%ProgramFiles%\readme.txt
%ProgramFiles%\360tray\readme.txt
%ProgramFiles%\a2cmd\readme.txt
%ProgramFiles%\a2guard\readme.txt
%ProgramFiles%\a2hijackfree\readme.txt
%ProgramFiles%\a2scan\readme.txt
%ProgramFiles%\a2service\readme.txt
%ProgramFiles%\a2start\readme.txt
%ProgramFiles%\a2upd\readme.txt
%ProgramFiles%\a2wizard\readme.txt
%ProgramFiles%\aavshield\readme.txt
%ProgramFiles%\about\readme.txt
%ProgramFiles%\ackwin32\readme.txt
%ProgramFiles%\admunch\readme.txt
C:\readme.txt
%ProgramFiles%\agb5\readme.txt
%HOMEPATH%\favorites\links for united states\readme.txt
C:\users\public\music\sample music\readme.txt
C:\users\public\readme.txt
C:\users\public\desktop\readme.txt
C:\users\public\videos\readme.txt
C:\users\public\pictures\readme.txt
C:\users\public\music\readme.txt
C:\users\public\downloads\readme.txt
C:\users\public\documents\readme.txt
%HOMEPATH%\readme.txt
%HOMEPATH%\videos\readme.txt
%HOMEPATH%\desktop\readme.txt
%HOMEPATH%\contacts\readme.txt
%HOMEPATH%\searches\readme.txt
%HOMEPATH%\saved games\readme.txt
%HOMEPATH%\pictures\readme.txt
%HOMEPATH%\music\readme.txt
C:\users\public\pictures\sample pictures\readme.txt
%HOMEPATH%\favorites\readme.txt
%HOMEPATH%\links\readme.txt
C:\users\public\videos\sample videos\readme.txt
%HOMEPATH%\downloads\readme.txt
%HOMEPATH%\documents\readme.txt
%HOMEPATH%\favorites\links\readme.txt
%ProgramFiles%\ageofconan\readme.txt
%ProgramFiles%\ahnsd\readme.txt
%ProgramFiles%\aim6\readme.txt
%ProgramFiles%\ashupd\readme.txt
%ProgramFiles%\ashwebsv\readme.txt
%ProgramFiles%\ash_updatemediator\readme.txt
%ProgramFiles%\aswregsvr\readme.txt
%ProgramFiles%\aswupdsv\readme.txt
%HOMEPATH%\favorites\msn websites\readme.txt
%ProgramFiles%\autodown\readme.txt
%ProgramFiles%\autostartexplorer\readme.txt
%ProgramFiles%\autotrace\readme.txt
%ProgramFiles%\avginet\readme.txt
%ProgramFiles%\avadmin\readme.txt
%ProgramFiles%\avciman\readme.txt
%ProgramFiles%\avcmd\readme.txt
%ProgramFiles%\avconfig\readme.txt
%ProgramFiles%\avconsol\readme.txt
%ProgramFiles%\avgamsvr\readme.txt
%ProgramFiles%\avgcc\readme.txt
%ProgramFiles%\avgdiag\readme.txt
%ProgramFiles%\avgemc\readme.txt
%ProgramFiles%\avgfwsrv\readme.txt
%ProgramFiles%\ashskpcc\readme.txt
%ProgramFiles%\ashskpck\readme.txt
%ProgramFiles%\ashsimpl\readme.txt
%ProgramFiles%\ashsimp2\readme.txt
%ProgramFiles%\ashserv\readme.txt
%ProgramFiles%\airdefense\readme.txt
%ProgramFiles%\almon\readme.txt
%ProgramFiles%\alsvc\readme.txt
%ProgramFiles%\amon\readme.txt
%ProgramFiles%\amsn\readme.txt
%ProgramFiles%\anti-trojan\readme.txt
%ProgramFiles%\antivirus\readme.txt
%ProgramFiles%\aoltbserver\readme.txt
%ProgramFiles%\armor2net\readme.txt
%ProgramFiles%\avgnpdln\readme.txt
%ProgramFiles%\ash\readme.txt
%ProgramFiles%\armorsurf\readme.txt
%ProgramFiles%\ashavsrv\readme.txt
%ProgramFiles%\ashchest\readme.txt
%ProgramFiles%\ashdisp\readme.txt
%ProgramFiles%\ashdug\readme.txt
%ProgramFiles%\ashenhcd\readme.txt
%ProgramFiles%\ashlogv\readme.txt
%ProgramFiles%\ashmaisv\readme.txt
%ProgramFiles%\ashpopwz\readme.txt
%ProgramFiles%\ashquick\readme.txt
%ProgramFiles%\aimpro\readme.txt
%ProgramFiles%\ashavast\readme.txt
%PROGRAMDATA%\adobe\arm\reader_15.007.20033\readme.txt

Moves the following files

from %ProgramFiles%\360tray\360tray.exe to %ProgramFiles%\360tray\360tray.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\bdss\bdss.exe to %ProgramFiles%\bdss\bdss.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\bdsubmit\bdsubmit.exe to %ProgramFiles%\bdsubmit\bdsubmit.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe to %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\bdsurvey\bdsurvey.exe to %ProgramFiles%\bdsurvey\bdsurvey.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\bdswitch\bdswitch.exe to %ProgramFiles%\bdswitch\bdswitch.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\bdwizreg\bdwizreg.exe to %ProgramFiles%\bdwizreg\bdwizreg.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\blackice\blackice.exe to %ProgramFiles%\blackice\blackice.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avpcc\avpcc.exe to %ProgramFiles%\avpcc\avpcc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\blindman\blindman.exe to %ProgramFiles%\blindman\blindman.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\btini\btini.exe to %ProgramFiles%\btini\btini.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\btinint\btinint.exe to %ProgramFiles%\btinint\btinint.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cabalmain\cabalmain.exe to %ProgramFiles%\cabalmain\cabalmain.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cafix\cafix.exe to %ProgramFiles%\cafix\cafix.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavapp\cavapp.exe to %ProgramFiles%\cavapp\cavapp.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\bdoesrv\bdoesrv.exe to %ProgramFiles%\bdoesrv\bdoesrv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\bdnews\bdnews.exe to %ProgramFiles%\bdnews\bdnews.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\bdmcon\bdmcon.exe to %ProgramFiles%\bdmcon\bdmcon.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\bdagent\bdagent.exe to %ProgramFiles%\bdagent\bdagent.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\backweb-4476822\backweb-4476822.exe to %ProgramFiles%\backweb-4476822\backweb-4476822.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\b2\b2.exe to %ProgramFiles%\b2\b2.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avsynmgr\avsynmgr.exe to %ProgramFiles%\avsynmgr\avsynmgr.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avscan\avscan.exe to %ProgramFiles%\avscan\avscan.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avpm\avpm.exe to %ProgramFiles%\avpm\avpm.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\blackd\blackd.exe to %ProgramFiles%\blackd\blackd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avnotify\avnotify.exe to %ProgramFiles%\avnotify\avnotify.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avkwctl\avkwctl.exe to %ProgramFiles%\avkwctl\avkwctl.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avkservice\avkservice.exe to %ProgramFiles%\avkservice\avkservice.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avkserv\avkserv.exe to %ProgramFiles%\avkserv\avkserv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avinitnt\avinitnt.exe to %ProgramFiles%\avinitnt\avinitnt.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgwizfw\avgwizfw.exe to %ProgramFiles%\avgwizfw\avgwizfw.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgw\avgw.exe to %ProgramFiles%\avgw\avgw.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavasm\cavasm.exe to %ProgramFiles%\cavasm\cavasm.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavsubmit\cavsubmit.exe to %ProgramFiles%\cavsubmit\cavsubmit.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavmr\cavmr.exe to %ProgramFiles%\cavmr\cavmr.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\chrome\chrome.exe to %ProgramFiles%\chrome\chrome.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\clamscan\clamscan.exe to %ProgramFiles%\clamscan\clamscan.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\clamtray\clamtray.exe to %ProgramFiles%\clamtray\clamtray.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\clamwin\clamwin.exe to %ProgramFiles%\clamwin\clamwin.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\claw95\claw95.exe to %ProgramFiles%\claw95\claw95.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\claw95cf\claw95cf.exe to %ProgramFiles%\claw95cf\claw95cf.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cleaner3\cleaner3.exe to %ProgramFiles%\cleaner3\cleaner3.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavaud\cavaud.exe to %ProgramFiles%\cavaud\cavaud.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\clisvc\clisvc.exe to %ProgramFiles%\clisvc\clisvc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\clrcche\clrcche.exe to %ProgramFiles%\clrcche\clrcche.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cmain\cmain.exe to %ProgramFiles%\cmain\cmain.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cmgrdian\cmgrdian.exe to %ProgramFiles%\cmgrdian\cmgrdian.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cemrep\cemrep.exe to %ProgramFiles%\cemrep\cemrep.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ccsetmgr\ccsetmgr.exe to %ProgramFiles%\ccsetmgr\ccsetmgr.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ccproxy\ccproxy.exe to %ProgramFiles%\ccproxy\ccproxy.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ccleaner\ccleaner.exe to %ProgramFiles%\ccleaner\ccleaner.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ccevtmgr\ccevtmgr.exe to %ProgramFiles%\ccevtmgr\ccevtmgr.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ccapp\ccapp.exe to %ProgramFiles%\ccapp\ccapp.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavvl\cavvl.exe to %ProgramFiles%\cavvl\cavvl.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavuserupd\cavuserupd.exe to %ProgramFiles%\cavuserupd\cavuserupd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavumas\cavumas.exe to %ProgramFiles%\cavumas\cavumas.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgvv\avgvv.exe to %ProgramFiles%\avgvv\avgvv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavsub\cavsub.exe to %ProgramFiles%\cavsub\cavsub.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavsn\cavsn.exe to %ProgramFiles%\cavsn\cavsn.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavse\cavse.exe to %ProgramFiles%\cavse\cavse.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavscons\cavscons.exe to %ProgramFiles%\cavscons\cavscons.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavq\cavq.exe to %ProgramFiles%\cavq\cavq.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavoar\cavoar.exe to %ProgramFiles%\cavoar\cavoar.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavmud\cavmud.exe to %ProgramFiles%\cavmud\cavmud.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cavemsrv\cavemsrv.exe to %ProgramFiles%\cavemsrv\cavemsrv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\cleaner\cleaner.exe to %ProgramFiles%\cleaner\cleaner.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgupsvc\avgupsvc.exe to %ProgramFiles%\avgupsvc\avgupsvc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgcc\avgcc.exe to %ProgramFiles%\avgcc\avgcc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\airdefense\airdefense.exe to %ProgramFiles%\airdefense\airdefense.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\almon\almon.exe to %ProgramFiles%\almon\almon.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\alsvc\alsvc.exe to %ProgramFiles%\alsvc\alsvc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\amon\amon.exe to %ProgramFiles%\amon\amon.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\amsn\amsn.exe to %ProgramFiles%\amsn\amsn.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\anti-trojan\anti-trojan.exe to %ProgramFiles%\anti-trojan\anti-trojan.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\aoltbserver\aoltbserver.exe to %ProgramFiles%\aoltbserver\aoltbserver.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\a2wizard.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\armor2net\armor2net.exe to %ProgramFiles%\armor2net\armor2net.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\armorsurf\armorsurf.exe to %ProgramFiles%\armorsurf\armorsurf.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ash\ash.exe to %ProgramFiles%\ash\ash.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashavast\ashavast.exe to %ProgramFiles%\ashavast\ashavast.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashavsrv\ashavsrv.exe to %ProgramFiles%\ashavsrv\ashavsrv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashchest\ashchest.exe to %ProgramFiles%\ashchest\ashchest.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\aimpro.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\aim6\aim6.exe to %ProgramFiles%\aim6\aim6.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ahnsd\ahnsd.exe to %ProgramFiles%\ahnsd\ahnsd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ageofconan\ageofconan.exe to %ProgramFiles%\ageofconan\ageofconan.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\agb5\agb5.exe to %ProgramFiles%\agb5\agb5.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\admunch\admunch.exe to %ProgramFiles%\admunch\admunch.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ackwin32\ackwin32.exe to %ProgramFiles%\ackwin32\ackwin32.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\about\about.exe to %ProgramFiles%\about\about.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\aavshield\aavshield.exe to %ProgramFiles%\aavshield\aavshield.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\antivirus\antivirus.exe to %ProgramFiles%\antivirus\antivirus.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\a2upd\a2upd.exe to %ProgramFiles%\a2upd\a2upd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\a2start\a2start.exe to %ProgramFiles%\a2start\a2start.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\a2service\a2service.exe to %ProgramFiles%\a2service\a2service.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\a2scan\a2scan.exe to %ProgramFiles%\a2scan\a2scan.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\a2hijackfree\a2hijackfree.exe to %ProgramFiles%\a2hijackfree\a2hijackfree.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\a2guard\a2guard.exe to %ProgramFiles%\a2guard\a2guard.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\a2cmd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashdisp\ashdisp.exe to %ProgramFiles%\ashdisp\ashdisp.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashskpck\ashskpck.exe to %ProgramFiles%\ashskpck\ashskpck.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgscan\avgscan.exe to %ProgramFiles%\avgscan\avgscan.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashlogv\ashlogv.exe to %ProgramFiles%\ashlogv\ashlogv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avcenter\avcenter.exe to %ProgramFiles%\avcenter\avcenter.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avciman\avciman.exe to %ProgramFiles%\avciman\avciman.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avcmd\avcmd.exe to %ProgramFiles%\avcmd\avcmd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avconfig\avconfig.exe to %ProgramFiles%\avconfig\avconfig.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avconsol\avconsol.exe to %ProgramFiles%\avconsol\avconsol.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgamsvr\avgamsvr.exe to %ProgramFiles%\avgamsvr\avgamsvr.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgdiag\avgdiag.exe to %ProgramFiles%\avgdiag\avgdiag.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashdug\ashdug.exe to %ProgramFiles%\ashdug\ashdug.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgemc\avgemc.exe to %ProgramFiles%\avgemc\avgemc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgfwsrv\avgfwsrv.exe to %ProgramFiles%\avgfwsrv\avgfwsrv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avginet\avginet.exe to %ProgramFiles%\avginet\avginet.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgnpdln\avgnpdln.exe to %ProgramFiles%\avgnpdln\avgnpdln.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgnpsvc\avgnpsvc.exe to %ProgramFiles%\avgnpsvc\avgnpsvc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgrssvc\avgrssvc.exe to %ProgramFiles%\avgrssvc\avgrssvc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avadmin\avadmin.exe to %ProgramFiles%\avadmin\avadmin.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\autotrace\autotrace.exe to %ProgramFiles%\autotrace\autotrace.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\autostartexplorer\autostartexplorer.exe to %ProgramFiles%\autostartexplorer\autostartexplorer.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\autodown\autodown.exe to %ProgramFiles%\autodown\autodown.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\aswupdsv\aswupdsv.exe to %ProgramFiles%\aswupdsv\aswupdsv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\aswregsvr\aswregsvr.exe to %ProgramFiles%\aswregsvr\aswregsvr.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe to %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashwebsv\ashwebsv.exe to %ProgramFiles%\ashwebsv\ashwebsv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashupd\ashupd.exe to %ProgramFiles%\ashupd\ashupd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\avgupden\avgupden.exe to %ProgramFiles%\avgupden\avgupden.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashskpcc\ashskpcc.exe to %ProgramFiles%\ashskpcc\ashskpcc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashsimpl\ashsimpl.exe to %ProgramFiles%\ashsimpl\ashsimpl.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashsimp2\ashsimp2.exe to %ProgramFiles%\ashsimp2\ashsimp2.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashserv\ashserv.exe to %ProgramFiles%\ashserv\ashserv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashquick\ashquick.exe to %ProgramFiles%\ashquick\ashquick.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashpopwz\ashpopwz.exe to %ProgramFiles%\ashpopwz\ashpopwz.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashmaisv\ashmaisv.exe to %ProgramFiles%\ashmaisv\ashmaisv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles%\ashenhcd\ashenhcd.exe to %ProgramFiles%\ashenhcd\ashenhcd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll.id-ece3edd5.[jerjis@tuta.io].banks1

Substitutes the following files

C:\Far2\Addons\README.TXT

Modifies user data files (Trojan.Encoder).

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe'
'<SYSTEM32>\netsh.exe' netsh advfirewall set currentprofile state off
'<SYSTEM32>\cmd.exe' /C vssadmin Delete Shadows /All /Quiet
'<SYSTEM32>\vssvc.exe'
'<SYSTEM32>\svchost.exe' -k swprv

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial