Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Classes\.crypted\shell\Open\command] '' = 'explorer.exe HOWTORECOVER.html'
Creates the following files on removable media
- <Drive name for removable media>:\howtorecover.html
- <Drive name for removable media>:\000814251_video_01.avi
Modifies file system
Creates the following files
- <Full path to file>.log
- %APPDATA%\thunderbird\howtorecover.html
- %APPDATA%\thunderbird\crash reports\howtorecover.html
- %APPDATA%\telegram desktop\howtorecover.html
- %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\howtorecover.html
- %APPDATA%\microsoft\protect\howtorecover.html
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\howtorecover.html
- %LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\howtorecover.html
- %LOCALAPPDATA%low\sun\java\deployment\howtorecover.html
- %LOCALAPPDATA%low\oracle\java\au\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds cache\bbs9hw0e\howtorecover.html
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\startupcache\howtorecover.html
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\howtorecover.html
- %LOCALAPPDATA%\microsoft\windows sidebar\howtorecover.html
- %LOCALAPPDATA%\microsoft\windows media\12.0\howtorecover.html
- %LOCALAPPDATA%\microsoft\windows mail\stationery\howtorecover.html
- %LOCALAPPDATA%\microsoft\windows mail\backup\new\howtorecover.html
- %LOCALAPPDATA%\microsoft\windows mail\howtorecover.html
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\howtorecover.html
- %LOCALAPPDATA%\microsoft\media player\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds cache\xwtafhng\howtorecover.html
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\entries\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds cache\howtorecover.html
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\howtorecover.html
- %HOMEPATH%\favorites\howtorecover.html
- %HOMEPATH%\saved games\howtorecover.html
- %HOMEPATH%\pictures\howtorecover.html
- %HOMEPATH%\howtorecover.html
- %HOMEPATH%\music\howtorecover.html
- %HOMEPATH%\links\howtorecover.html
- %HOMEPATH%\favorites\windows live\howtorecover.html
- %HOMEPATH%\favorites\msn websites\howtorecover.html
- %HOMEPATH%\favorites\microsoft websites\howtorecover.html
- %HOMEPATH%\favorites\links for united states\howtorecover.html
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\howtorecover.html
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\howtorecover.html
- %HOMEPATH%\downloads\howtorecover.html
- %HOMEPATH%\documents\howtorecover.html
- %HOMEPATH%\desktop\howtorecover.html
- %HOMEPATH%\contacts\howtorecover.html
- %APPDATA%\thunderbird\profiles\hmz1jddi.default\howtorecover.html
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\howtorecover.html
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\howtorecover.html
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\howtorecover.html
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\howtorecover.html
- %HOMEPATH%\favorites\links\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds cache\6fwa5ftw\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds cache\15ivkcr3\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\howtorecover.html
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\howtorecover.html
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\howtorecover.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\howtorecover.html
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\howtorecover.html
- D:\howtorecover.html
- C:\kms\howtorecover.html
- <Current directory>\howtorecover.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\howtorecover.html
- C:\howtorecover.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\howtorecover.html
- %ProgramFiles%\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\howtorecover.html
- C:\users\public\music\sample music\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds\feeds for united states~\howtorecover.html
- %LOCALAPPDATA%\howtorecover.html
- C:\users\public\videos\sample videos\howtorecover.html
- C:\users\public\videos\howtorecover.html
- C:\users\public\recorded tv\sample media\howtorecover.html
- C:\users\public\recorded tv\howtorecover.html
- C:\users\public\pictures\sample pictures\howtorecover.html
- C:\users\public\pictures\howtorecover.html
- C:\users\public\music\howtorecover.html
- %ProgramFiles%\microsoft sql server compact edition\v3.5\howtorecover.html
- C:\users\public\libraries\howtorecover.html
- C:\users\public\downloads\howtorecover.html
- C:\users\public\documents\howtorecover.html
- C:\users\public\howtorecover.html
- C:\users\public\desktop\howtorecover.html
- C:\users\howtorecover.html
- C:\users\default\howtorecover.html
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\howtorecover.html
- %ProgramFiles(x86)%\howtorecover.html
- %HOMEPATH%\searches\howtorecover.html
- %HOMEPATH%\videos\howtorecover.html
Moves the following files
- from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47 to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.crypted
- from %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a to %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a.crypted
- from %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred.crypted
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.crypted
- from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite.crypted
- from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json to %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.crypted
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.crypted
Modifies the following files
- C:\kms\kms_vl_all_aio_debug.log.crypted
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml.crypted
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\owow32lr.cab.crypted
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml.crypted
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml.crypted
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml.crypted
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml.crypted
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml.crypted
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml.crypted
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab.crypted
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.crypted
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab.crypted
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.crypted
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.crypted
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.crypted
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.crypted
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.crypted
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab.crypted
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.crypted
- <Drive name for removable media>:\000814251_video_01.avi.crypted
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml.crypted
Modifies multiple files.
Substitutes the following files
- C:\Users\Default\NTUSER.DAT
- C:\Users\Default\NTUSER.DAT.LOG
- C:\Users\Default\NTUSER.DAT.LOG1
Changes user data files extensions (Trojan.Encoder).
