Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\trivial-merge.html
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\508softwareandos.doc
- %APPDATA%\thunderbird\profiles.ini
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\prefs.js
Moves the following files
- from %TEMP%\adobearm.log to %TEMP%\adobearm.log.crypted
- from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\history.crypted
- from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\history-journal.crypted
- from %APPDATA%\opera software\opera stable\jump list icons\6f34.tmp to %APPDATA%\opera software\opera stable\jump list icons\6f34.tmp.crypted
- from %APPDATA%\opera software\opera stable\jump list icons\6f35.tmp to %APPDATA%\opera software\opera stable\jump list icons\6f35.tmp.crypted
- from %APPDATA%\opera software\opera stable\jump list icons\6f36.tmp to %APPDATA%\opera software\opera stable\jump list icons\6f36.tmp.crypted
- from %APPDATA%\opera software\opera stable\jump list icons\6f37.tmp to %APPDATA%\opera software\opera stable\jump list icons\6f37.tmp.crypted
- from %APPDATA%\opera software\opera stable\jump list icons\6f38.tmp to %APPDATA%\opera software\opera stable\jump list icons\6f38.tmp.crypted
- from %APPDATA%\opera software\opera stable\jump list icons\6f58.tmp to %APPDATA%\opera software\opera stable\jump list icons\6f58.tmp.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\user.js.crypted
- from %APPDATA%\opera software\opera stable\jump list icons\6f59.tmp to %APPDATA%\opera software\opera stable\jump list icons\6f59.tmp.crypted
- from %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage to %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage.crypted
- from %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage-journal.crypted
- from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\login data.crypted
- from %APPDATA%\opera software\opera stable\login data-journal to %APPDATA%\opera software\opera stable\login data-journal.crypted
- from %APPDATA%\opera software\opera stable\network persistent state to %APPDATA%\opera software\opera stable\network persistent state.crypted
- from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\opera_autoupdate.log.crypted
- from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\preferences.crypted
- from %APPDATA%\opera software\opera stable\ssdfp3452.0.1677946767 to %APPDATA%\opera software\opera stable\ssdfp3452.0.1677946767.crypted
- from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\favicons.crypted
- from %APPDATA%\opera software\opera stable\favicons-journal to %APPDATA%\opera software\opera stable\favicons-journal.crypted
- from %APPDATA%\opera software\opera stable\extension state\manifest-000001 to %APPDATA%\opera software\opera stable\extension state\manifest-000001.crypted
- from %APPDATA%\opera software\opera stable\extension state\log to %APPDATA%\opera software\opera stable\extension state\log.crypted
- from %APPDATA%\opera software\opera stable\extension state\lock to %APPDATA%\opera software\opera stable\extension state\lock.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sitesecurityservicestate.txt.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\.metadata-v2.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.crypted
- from %APPDATA%\opera software\opera stable\ssdfp3452.6.1348684681 to %APPDATA%\opera software\opera stable\ssdfp3452.6.1348684681.crypted
- from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\local state.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\times.json.crypted
- from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.crypted
- from %APPDATA%\opera software\opera stable\cookies to %APPDATA%\opera software\opera stable\cookies.crypted
- from %APPDATA%\opera software\opera stable\cookies-journal to %APPDATA%\opera software\opera stable\cookies-journal.crypted
- from %APPDATA%\opera software\opera stable\current session to %APPDATA%\opera software\opera stable\current session.crypted
- from %APPDATA%\opera software\opera stable\d438.tmp to %APPDATA%\opera software\opera stable\d438.tmp.crypted
- from %APPDATA%\opera software\opera stable\default_partner_content.json to %APPDATA%\opera software\opera stable\default_partner_content.json.crypted
- from %APPDATA%\opera software\opera stable\extension state\000003.log to %APPDATA%\opera software\opera stable\extension state\000003.log.crypted
- from %APPDATA%\opera software\opera stable\extension state\current to %APPDATA%\opera software\opera stable\extension state\current.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\shield-preference-experiments.json.crypted
- from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\compatibility.ini.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\xulstore.json.crypted
- from %APPDATA%\opera software\opera stable\visited links to %APPDATA%\opera software\opera stable\visited links.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\history.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\openpgp.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\permissions.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\pkcs11.txt.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\places.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\prefs.js to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\prefs.js.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\saved-telemetry-pings\7c60a762-ce1a-4213-a806-472d9b56a5d3 to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\saved-telemetry-pings\7c60a762-ce1a-4213-a806-472d9b56a5d3.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\saved-telemetry-pings\cfac4984-9ad3-4e2b-b0c2-a02f3ed65e98 to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\saved-telemetry-pings\cfac4984-9ad3-4e2b-b0c2-a02f3ed65e98.crypted
- from %APPDATA%\opera software\opera stable\transportsecurity to %APPDATA%\opera software\opera stable\transportsecurity.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\saved-telemetry-pings\e973cedb-0948-4fd0-8858-de529a873a0c to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\saved-telemetry-pings\e973cedb-0948-4fd0-8858-de529a873a0c.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\securitypreloadstate.txt to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\securitypreloadstate.txt.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\sessioncheckpoints.json.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\sitesecurityservicestate.txt to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\sitesecurityservicestate.txt.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage\permanent\chrome\.metadata-v2.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\times.json to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\times.json.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\webappsstore.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\formhistory.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\global-messages-db.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\favicons.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\extensions.json to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\extensions.json.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\extension-preferences.json.crypted
- from %APPDATA%\opera software\opera stable\web data-journal to %APPDATA%\opera software\opera stable\web data-journal.crypted
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.crypted
- from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.crypted
- from %APPDATA%\thunderbird\profiles\mt2yxlwj.default\times.json to %APPDATA%\thunderbird\profiles\mt2yxlwj.default\times.json.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\abook.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\addons.json to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\addons.json.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\addonstartup.json.lz4.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\alternateservices.txt to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\alternateservices.txt.crypted
- from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\update_prefs.json.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\upgrade.jsonlz4-20210823123856 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\upgrade.jsonlz4-20210823123856.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\blist.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\crashes\store.json.mozlz4.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\archived\2022-09\1664420269989.cfac4984-9ad3-4e2b-b0c2-a02f3ed65e98.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\archived\2022-09\1664420269989.cfac4984-9ad3-4e2b-b0c2-a02f3ed65e98.new-profile.jsonlz4.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\archived\2022-09\1664420270572.7c60a762-ce1a-4213-a806-472d9b56a5d3.main.jsonlz4 to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\archived\2022-09\1664420270572.7c60a762-ce1a-4213-a806-472d9b56a5d3.main.jsonlz4.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\archived\2022-09\1664420270573.e973cedb-0948-4fd0-8858-de529a873a0c.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\archived\2022-09\1664420270573.e973cedb-0948-4fd0-8858-de529a873a0c.first-shutdown.jsonlz4.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\session-state.json.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\datareporting\state.json.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\directorytree.json.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\enigmail.sqlite.crypted
- from %APPDATA%\opera software\opera stable\web data to %APPDATA%\opera software\opera stable\web data.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\cookies.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\search.json.mozlz4.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\recovery.jsonlz4.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\handlers.json.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192439_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928192439_001_vcruntimeadditional_x64.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192454.log to %TEMP%\dd_vcredist_amd64_20220928192454.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192236.log to %TEMP%\dd_vcredist_x86_20220928192236.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192236_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928192236_0_vcruntimeminimum_x86.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192236_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928192236_1_vcruntimeadditional_x86.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192307.log to %TEMP%\dd_vcredist_x86_20220928192307.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192307_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928192307_0_vcruntimeminimum_x86.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192307_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928192307_1_vcruntimeadditional_x86.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192052.log to %TEMP%\dd_vcredist_amd64_20220928192052.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192338.log to %TEMP%\dd_vcredist_x86_20220928192338.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192338_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928192338_001_vcruntimeadditional_x86.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192417.log to %TEMP%\dd_vcredist_x86_20220928192417.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192417_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928192417_000_vcruntimeminimum_x86.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192417_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928192417_001_vcruntimeadditional_x86.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192428.log to %TEMP%\dd_vcredist_x86_20220928192428.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192505.log to %TEMP%\dd_vcredist_x86_20220928192505.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192505_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928192505_000_vcruntimeminimum_x86.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192505_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928192505_001_vcruntimeadditional_x86.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192439.log to %TEMP%\dd_vcredist_amd64_20220928192439.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192439_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928192439_000_vcruntimeminimum_x64.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192407.log to %TEMP%\dd_vcredist_amd64_20220928192407.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192354_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928192354_001_vcruntimeadditional_x64.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192354_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928192354_000_vcruntimeminimum_x64.log.crypted
- from %TEMP%\aria-debug-3788.log to %TEMP%\aria-debug-3788.log.crypted
- from %TEMP%\aria-debug-3868.log to %TEMP%\aria-debug-3868.log.crypted
- from %TEMP%\aria-debug-4480.log to %TEMP%\aria-debug-4480.log.crypted
- from %TEMP%\chrome_installer.log to %TEMP%\chrome_installer.log.crypted
- from %TEMP%\content\5104-4540-powershell.exe-14-23-34-122.dump to %TEMP%\content\5104-4540-powershell.exe-14-23-34-122.dump.crypted
- from %TEMP%\content\5104-4540-powershell.exe-14-23-34-181.dump to %TEMP%\content\5104-4540-powershell.exe-14-23-34-181.dump.crypted
- from %TEMP%\dd_ndp462-kb3151800-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp462-kb3151800-x86-x64-allos-enu_decompression_log.txt.crypted
- from %TEMP%\dd_vcredistmsi6d07.txt to %TEMP%\dd_vcredistmsi6d07.txt.crypted
- from %TEMP%\dd_vcredist_x86_20220928192519.log to %TEMP%\dd_vcredist_x86_20220928192519.log.crypted
- from %TEMP%\dd_vcredist_x86_20220928192338_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928192338_000_vcruntimeminimum_x86.log.crypted
- from %TEMP%\dd_vcredistui6d07.txt to %TEMP%\dd_vcredistui6d07.txt.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192052_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928192052_1_vcruntimeadditional_x64.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192251.log to %TEMP%\dd_vcredist_amd64_20220928192251.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192251_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928192251_0_vcruntimeminimum_x64.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192251_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928192251_1_vcruntimeadditional_x64.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192323.log to %TEMP%\dd_vcredist_amd64_20220928192323.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192323_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928192323_000_vcruntimeminimum_x64.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192323_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928192323_001_vcruntimeadditional_x64.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192354.log to %TEMP%\dd_vcredist_amd64_20220928192354.log.crypted
- from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.crypted
- from %TEMP%\dd_vcredist_amd64_20220928192052_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928192052_0_vcruntimeminimum_x64.log.crypted
- from %TEMP%\wmsetup.log to %TEMP%\wmsetup.log.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\previous.jsonlz4.crypted
- from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_191926081-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_191926081-msi_vc_red.msi.txt.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273890.ef50c0d6-c7b7-4b83-9eab-158d565b3460.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273890.ef50c0d6-c7b7-4b83-9eab-158d565b3460.first-shutdown.jsonlz4.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\session-state.json.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\state.json.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\extension-preferences.json.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\extensions.json.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\license.txt to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\license.txt.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib.crypted
- from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\pkcs11.txt.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\prefs.js.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\4083ce93-ca4d-4a59-8edf-1582589874a7 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\4083ce93-ca4d-4a59-8edf-1582589874a7.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\8f28423a-eb63-498c-b4cf-6b59560738b5 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\8f28423a-eb63-498c-b4cf-6b59560738b5.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\ef50c0d6-c7b7-4b83-9eab-158d565b3460 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\ef50c0d6-c7b7-4b83-9eab-158d565b3460.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\f30a84a1-1e03-4e9c-82d2-cc25a2de2285 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\saved-telemetry-pings\f30a84a1-1e03-4e9c-82d2-cc25a2de2285.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\search.json.mozlz4.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessioncheckpoints.json.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273787.f30a84a1-1e03-4e9c-82d2-cc25a2de2285.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273787.f30a84a1-1e03-4e9c-82d2-cc25a2de2285.event.jsonlz4.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273885.4083ce93-ca4d-4a59-8edf-1582589874a7.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273885.4083ce93-ca4d-4a59-8edf-1582589874a7.main.jsonlz4.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273695.8f28423a-eb63-498c-b4cf-6b59560738b5.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\archived\2022-09\1664420273695.8f28423a-eb63-498c-b4cf-6b59560738b5.new-profile.jsonlz4.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\crashes\store.json.mozlz4.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\containers.json.crypted
- from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_192036284-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_192036284-msi_vc_red.msi.txt.crypted
- from %TEMP%\opera installer\opera_installer_20220928193645.log to %TEMP%\opera installer\opera_installer_20220928193645.log.crypted
- from %TEMP%\opera installer\opera_installer_20220928193650.log to %TEMP%\opera installer\opera_installer_20220928193650.log.crypted
- from %TEMP%\opera installer\opera_installer_20220928193703.log to %TEMP%\opera installer\opera_installer_20220928193703.log.crypted
- from %TEMP%\opera_crashreporter.log to %TEMP%\opera_crashreporter.log.crypted
- from %TEMP%\setupexe(202209281941061420).log to %TEMP%\setupexe(202209281941061420).log.crypted
- from %TEMP%\tmp620.tmp to %TEMP%\tmp620.tmp.crypted
- from %TEMP%\tmpf827.tmp to %TEMP%\tmpf827.tmp.crypted
- from %TEMP%\jusched.log to %TEMP%\jusched.log.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\recovery.baklz4 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sessionstore-backups\recovery.baklz4.crypted
- from %TEMP%\wctebb3.tmp to %TEMP%\wctebb3.tmp.crypted
- from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.crypted
- from %APPDATA%\mozilla\firefox\profiles\jkail15y.default\times.json to %APPDATA%\mozilla\firefox\profiles\jkail15y.default\times.json.crypted
- from %APPDATA%\mozilla\firefox\profiles\jkail15y.default\user.js to %APPDATA%\mozilla\firefox\profiles\jkail15y.default\user.js.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\addons.json.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\addonstartup.json.lz4.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\bookmarkbackups\bookmarks-2024-03-11_11_jdggz7aqnesichxf13zoqq==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\bookmarkbackups\bookmarks-2024-03-11_11_jdggz7aqnesichxf13zoqq==.jsonlz4.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\broadcast-listeners.json.crypted
- from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\compatibility.ini.crypted
- from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_192019924-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_192019924-msi_vc_red.msi.txt.crypted
- from %APPDATA%\mozilla\firefox\crash reports\installtime20210823123856 to %APPDATA%\mozilla\firefox\crash reports\installtime20210823123856.crypted
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.crypted
Modifies the following files
- C:\kms\kms_vl_all_aio_debug.log
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.xml
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.xml
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.xml
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.xml
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.xml
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\setup.xml
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'ea########ing-weevil.ngrok-free.app':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'ea########ing-weevil.ngrok-free.app':443
UDP
- DNS ASK ea########ing-weevil.ngrok-free.app
- DNS ASK x1.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
