Trojan.Encoder.2506

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AsE1axaLShzJkDwb"<Full path to virus>" /SkipReg' = '"<Full path to virus>" /SkipReg'

Malicious functions:

Executes the following:

'<SYSTEM32>\vssadmin.exe' Delete Shadows /Quiet /All
'<SYSTEM32>\cmd.exe' /C vssadmin Delete Shadows /Quiet /All

Modifies file system :

Creates the following files:

%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Graphics\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v3.5\SQL\EN\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\chrome\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\EN\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\CatRoot2\readme_liesmich_encryptor_raas.txt
%WINDIR%\pss\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\DirectX\Dinput\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\config\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\config\systemprofile\Templates\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\Remote Assistance\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\dllcache\readme_liesmich_encryptor_raas.txt
%WINDIR%\Web\printers\images\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\wbem\Repository\readme_liesmich_encryptor_raas.txt
%WINDIR%\Web\printers\readme_liesmich_encryptor_raas.txt
%WINDIR%\readme_liesmich_encryptor_raas.txt
%WINDIR%\Web\readme_liesmich_encryptor_raas.txt
%WINDIR%\Web\Wallpaper\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\wbem\Repository\FS\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\ias\readme_liesmich_encryptor_raas.txt
<DRIVERS>\readme_liesmich_encryptor_raas.txt
<DRIVERS>\etc\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\oobe\html\mouse\images\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\wbem\Performance\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\Restore\readme_liesmich_encryptor_raas.txt
<SYSTEM32>\oobe\images\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Graphics\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SQL\en\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\images\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\images\Expando\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\images\Centers\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\images\48x48\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\blurbs\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\Config\Cache\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\images\32x32\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\images\24x24\readme_liesmich_encryptor_raas.txt
%WINDIR%\pchealth\helpctr\System\images\16x16\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\printpreview\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\readme_liesmich_encryptor_raas.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\readme_liesmich_encryptor_raas.txt
%APPDATA%\Microsoft\Internet Explorer\readme_liesmich_encryptor_raas.txt
%APPDATA%\Microsoft\Address Book\readme_liesmich_encryptor_raas.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\readme_liesmich_encryptor_raas.txt
C:\Far2\Documentation\eng\readme_liesmich_encryptor_raas.txt
C:\Far2\Addons\readme_liesmich_encryptor_raas.txt
%HOMEPATH%\Templates\readme_liesmich_encryptor_raas.txt
C:\Documents and Settings\Default User\Templates\readme_liesmich_encryptor_raas.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\readme_liesmich_encryptor_raas.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\readme_liesmich_encryptor_raas.txt
<Current directory>\readme_liesmich_encryptor_raas.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\readme_liesmich_encryptor_raas.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\readme_liesmich_encryptor_raas.txt
%ALLUSERSPROFILE%\DRM\readme_liesmich_encryptor_raas.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\readme_liesmich_encryptor_raas.txt
C:\Far2\Documentation\rus\readme_liesmich_encryptor_raas.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\readme_liesmich_encryptor_raas.txt
%CommonProgramFiles%\Microsoft Shared\Stationery\readme_liesmich_encryptor_raas.txt
C:\Far2\readme_liesmich_encryptor_raas.txt
%CommonProgramFiles%\Services\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\branding\readme_liesmich_encryptor_raas.txt
C:\Far2\PluginSDK\Headers.c\readme_liesmich_encryptor_raas.txt
C:\Far2\Plugins\Colorer\hrc\readme_liesmich_encryptor_raas.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\readme_liesmich_encryptor_raas.txt
C:\Far2\Plugins\7-Zip\readme_liesmich_encryptor_raas.txt
C:\Far2\Plugins\ExtSearch\doc\readme_liesmich_encryptor_raas.txt
C:\Far2\Plugins\FTP\readme_liesmich_encryptor_raas.txt
C:\Far2\Plugins\ExtSearch\sources\readme_liesmich_encryptor_raas.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\readme_liesmich_encryptor_raas.txt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\readme_liesmich_encryptor_raas.txt
%WINDIR%\Help\Tours\mmTour\readme_liesmich_encryptor_raas.txt
%WINDIR%\Help\Tours\htmlTour\readme_liesmich_encryptor_raas.txt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\readme_liesmich_encryptor_raas.txt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Video\readme_liesmich_encryptor_raas.txt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\readme_liesmich_encryptor_raas.txt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\readme_liesmich_encryptor_raas.txt
%WINDIR%\$NtUninstallWIC$\spuninst\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\Outlook Express\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\NetMeeting\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\Windows Media Player\readme_liesmich_encryptor_raas.txt
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\readme_liesmich_encryptor_raas.txt
<Auxiliary element>
%PROGRAM_FILES%\Windows NT\Pinball\readme_liesmich_encryptor_raas.txt
%WINDIR%\Help\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\readme_liesmich_encryptor_raas.txt
%WINDIR%\Media\readme_liesmich_encryptor_raas.txt
%WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\readme_liesmich_encryptor_raas.txt
%WINDIR%\inf\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v1.0.3705\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\readme_liesmich_encryptor_raas.txt
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\radio\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\printpreview\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\media\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\tree\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\toolbar\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\splitter\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\icons\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\dirListing\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\console\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\checkbox\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\res\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\res\html\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\Movie Maker\Shared\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\Movie Maker\Shared\Profiles\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\Messenger\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\xpinstall\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\places\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\update\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\profile\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\plugins\readme_liesmich_encryptor_raas.txt

Network activity:

Connects to:

'de######raveidf7.onion.link':80
'localhost':1036

TCP:

HTTP GET requests:

http://de######raveidf7.onion.link////vict?cu#####################################################################################

UDP:

DNS ASK de######raveidf7.onion.link

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'ЉЈ $ќjYЌвP ®Ќл¶X хяЕН) †КчBFхжПnТmЯsf™"¦0vSд;™/C vssadmin Delete Shadows /Quiet /All'
ClassName: '' WindowName: '??$?jY??P ????X?????) ???BF???n?m?sf?"?0vS?;?/C vssadmin Delete Shadows /Quiet /All'

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial