Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XPSUDTARW' = '"<Full path to file>"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\decryptfiles.txt
- %APPDATA%\microsoft\word\startup\decryptfiles.txt
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\trivial-merge.htm
- %HOMEPATH%\desktop\tree_view.html
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\trivial-merge.html
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\parnas_01.jpg
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %APPDATA%\mozilla\firefox\profiles.ini
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\210252809.jpg
- %HOMEPATH%\desktop\join.avi
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt.kari
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\events\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite-wal.kysj
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite-wal.ntzj
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\parent.lock.lket
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt.pevx
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\security_state\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.fil...
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\minidumps\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\administrative tools\decryptfiles.txt
- %APPDATA%\microsoft\windows\sendto\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\decryptfiles.txt
- %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.ptea
- %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.xswq
- %APPDATA%\microsoft\windows\sendto\documents.mydocs.irvi
- %APPDATA%\microsoft\windows\start menu\programs\accessories\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\decryptfiles.txt
- %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.ayoe
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\google chrome\decryptfiles.txt
- %APPDATA%\mozilla\firefox\crash reports\events\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\maintenance\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\winrar\decryptfiles.txt
- %APPDATA%\microsoft\windows\templates\decryptfiles.txt
- %APPDATA%\microsoft\windows\themes\decryptfiles.txt
- %APPDATA%\microsoft\word\decryptfiles.txt
- %APPDATA%\mozilla\decryptfiles.txt
- %APPDATA%\mozilla\extensions\decryptfiles.txt
- %APPDATA%\mozilla\firefox\decryptfiles.txt
- %APPDATA%\mozilla\firefox\crash reports\decryptfiles.txt
- %APPDATA%\mozilla\firefox\pending pings\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\default\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt.sifb
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\decryptfiles.txt
- %HOMEPATH%\contacts\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt.juvx
- %HOMEPATH%\documents\decryptfiles.txt
- %HOMEPATH%\favorites\links\decryptfiles.txt
- %HOMEPATH%\favorites\links for united states\decryptfiles.txt
- %HOMEPATH%\favorites\microsoft websites\decryptfiles.txt
- %HOMEPATH%\favorites\msn websites\decryptfiles.txt
- %HOMEPATH%\favorites\windows live\decryptfiles.txt
- %HOMEPATH%\links\decryptfiles.txt
- %HOMEPATH%\ntuser.dat.log1.rssg
- %HOMEPATH%\ntuser.dat.log2.wnwl
- %HOMEPATH%\saved games\decryptfiles.txt
- %HOMEPATH%\downloads\decryptfiles.txt
- %HOMEPATH%\favorites\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\parent.lock.wgwc
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\minidumps\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt.omai
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite-wal.xoyz
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\decryptfiles.txt
- %APPDATA%\mozilla\systemextensionsdev\decryptfiles.txt
- %APPDATA%\telegram desktop\decryptfiles.txt
- %APPDATA%\thunderbird\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decryptfiles.txt
- %APPDATA%\thunderbird\crash reports\decryptfiles.txt
- %APPDATA%\thunderbird\pending pings\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\dm02c46v.default\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt.yuoa
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\events\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\decryptfiles.txt
- %APPDATA%\thunderbird\crash reports\events\decryptfiles.txt
- %APPDATA%\microsoft\windows\recent\customdestinations\decryptfiles.txt
- %HOMEPATH%\searches\decryptfiles.txt
- %APPDATA%\microsoft\windows\recent\automaticdestinations\decryptfiles.txt
- %APPDATA%\microsoft\windows\privacie\low\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink.oita
- C:\users\default\appdata\roaming\microsoft\windows\start menu\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail.ulba
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\templates\decryptfiles.txt
- C:\users\default\desktop\decryptfiles.txt
- C:\users\default\documents\my music\decryptfiles.txt
- C:\users\public\documents\my music\decryptfiles.txt
- C:\users\default\documents\my pictures\decryptfiles.txt
- C:\users\default\documents\my videos\decryptfiles.txt
- C:\users\default\downloads\decryptfiles.txt
- C:\users\default\favorites\decryptfiles.txt
- C:\users\default\links\decryptfiles.txt
- C:\users\default\ntuser.dat.log2.ndbx
- C:\users\default\saved games\decryptfiles.txt
- C:\users\public\decryptfiles.txt
- C:\users\public\desktop\decryptfiles.txt
- C:\users\public\documents\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.qgbh
- C:\users\default\documents\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\sendto\decryptfiles.txt
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\decryptfiles.txt
- %HOMEPATH%\desktop\decryptfiles.txt
- %HOMEPATH%\documents\my music\decryptfiles.txt
- %HOMEPATH%\documents\my pictures\decryptfiles.txt
- %HOMEPATH%\documents\my videos\decryptfiles.txt
- C:\kms\decryptfiles.txt
- C:\msocache\decryptfiles.txt
- <Current directory>\decryptfiles.txt
- C:\perflogs\decryptfiles.txt
- C:\perflogs\admin\decryptfiles.txt
- C:\recovery\decryptfiles.txt
- C:\users\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\decryptfiles.txt
- C:\users\default\decryptfiles.txt
- C:\users\default\appdata\decryptfiles.txt
- C:\users\default\appdata\roaming\decryptfiles.txt
- C:\users\default\appdata\roaming\media center programs\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\internet explorer\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\cookies\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\recent\decryptfiles.txt
- C:\users\public\documents\my pictures\decryptfiles.txt
- C:\users\public\documents\my videos\decryptfiles.txt
- C:\users\public\downloads\decryptfiles.txt
- %APPDATA%\microsoft\protect\decryptfiles.txt
- %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\decryptfiles.txt
- %APPDATA%\microsoft\systemcertificates\decryptfiles.txt
- %APPDATA%\microsoft\systemcertificates\my\decryptfiles.txt
- %APPDATA%\microsoft\systemcertificates\my\certificates\decryptfiles.txt
- %APPDATA%\microsoft\systemcertificates\my\crls\decryptfiles.txt
- %APPDATA%\microsoft\systemcertificates\my\ctls\decryptfiles.txt
- %APPDATA%\microsoft\templates\decryptfiles.txt
- %APPDATA%\microsoft\uproof\decryptfiles.txt
- %APPDATA%\microsoft\office\recent\decryptfiles.txt
- %APPDATA%\microsoft\proof\decryptfiles.txt
- %APPDATA%\microsoft\windows\decryptfiles.txt
- %APPDATA%\microsoft\windows\iecompatcache\decryptfiles.txt
- %APPDATA%\microsoft\windows\iecompatcache\low\decryptfiles.txt
- %APPDATA%\microsoft\windows\ietldcache\decryptfiles.txt
- %APPDATA%\microsoft\windows\ietldcache\low\decryptfiles.txt
- %APPDATA%\microsoft\windows\libraries\decryptfiles.txt
- %APPDATA%\microsoft\windows\network shortcuts\decryptfiles.txt
- %APPDATA%\microsoft\uproof\custom.dic.qkuc
- %APPDATA%\microsoft\windows\printer shortcuts\decryptfiles.txt
- %APPDATA%\microsoft\windows\privacie\decryptfiles.txt
- %APPDATA%\microsoft\windows\cookies\decryptfiles.txt
- %APPDATA%\microsoft\windows\cookies\low\decryptfiles.txt
- %APPDATA%\microsoft\office\decryptfiles.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\decryptfiles.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decryptfiles.txt
- C:\users\public\libraries\decryptfiles.txt
- C:\users\public\music\sample music\decryptfiles.txt
- C:\users\public\pictures\sample pictures\decryptfiles.txt
- C:\users\public\recorded tv\decryptfiles.txt
- C:\users\public\recorded tv\sample media\decryptfiles.txt
- C:\users\public\videos\sample videos\decryptfiles.txt
- %HOMEPATH%\decryptfiles.txt
- %HOMEPATH%\appdata\decryptfiles.txt
- %APPDATA%\decryptfiles.txt
- %APPDATA%\identities\decryptfiles.txt
- C:\users\public\favorites\decryptfiles.txt
- %APPDATA%\identities\{1bba5dcd-58f3-46ae-861d-68cf42722c36}\decryptfiles.txt
- %APPDATA%\microsoft\decryptfiles.txt
- %APPDATA%\microsoft\addins\decryptfiles.txt
- %APPDATA%\microsoft\credentials\decryptfiles.txt
- %APPDATA%\microsoft\crypto\decryptfiles.txt
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.kwzx
- %APPDATA%\microsoft\crypto\rsa\decryptfiles.txt
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\decryptfiles.txt
- %APPDATA%\microsoft\internet explorer\decryptfiles.txt
- %APPDATA%\microsoft\internet explorer\quick launch\decryptfiles.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\decryptfiles.txt
- %APPDATA%\media center programs\decryptfiles.txt
- %APPDATA%\microsoft\windows\recent\decryptfiles.txt
- nul
Moves the following files
- from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814 to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814.fcdl
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json.semu
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.dgow
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.qwju
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4.fgwr
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.dwbn
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4.nhfg
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini.cxdg
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json.eloq
- from %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json to %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json.ufok
- from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.pxyc
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json.ivzx
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json.razf
- from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.hrzi
- from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json.yzms
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json.brhm
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js.seuq
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.kmup
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json.tdld
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.dzog
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.qmkg
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.fibg
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.yexm
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.jbic
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json.acjt
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4.brek
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.ywhb
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.pxiu
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.ipqd
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.gvue
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.xikq
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json.myvb
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4.vlhp
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2.klsb
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json.jsek
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.yufk
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8.ezrt
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.enxk
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.yofy
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite.ygrn
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2.bfjv
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.apov
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.wudo
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.mnro
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.gkjl
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json.twae
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite.azio
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4.uenr
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4.qfsj
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
- from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js.gkmk
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9.yfag
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4.gntu
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2.owsw
- from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\documents.library-ms.dpxz
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4.pnbu
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json.czkb
- from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.gfwc
- from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.iwzx
- from %APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini.qust
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.lndp
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.gihe
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini.nyvt
- from %APPDATA%\microsoft\windows\sendto\desktop.ini to %APPDATA%\microsoft\windows\sendto\desktop.ini.wwgv
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.ifyt
- from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\normal.dotm.tweu
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json.psju
- from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\videos.library-ms.xafi
- from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\music.library-ms.onvr
- from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\pictures.library-ms.fqas
- from %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred.irkv
- from %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\e7b9399e-3392-43f5-af55-6a17db70251d to %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\e7b9399e-3392-43f5-af55-6a17db70251d.xzxy
- from %APPDATA%\Microsoft\Templates\~$Normal.dotm to %APPDATA%\microsoft\templates\~$normal.dotm.gpdj
- from %APPDATA%\microsoft\office\recent\templates.lnk to %APPDATA%\microsoft\office\recent\templates.lnk.kufh
- from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\mso1033.acl.ttef
- from %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c to %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c.iwbj
- from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.ptcq
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json.nlce
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json.wshi
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini.bedv
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4.eplp
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2025-02-03_11_de2a2eo29nunltkagq5ija==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2025-02-03_11_de2a2eo29nunltkagq5ija==.jsonlz4.vojo
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2.jxqy
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.qpll
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json.heuf
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.okzl
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.baklz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.baklz4.cczj
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4.kmzn
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4.fxqi
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071.kmvq
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json.khmn
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177.ohsm
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858.ewgi
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite.zyfv
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js.sapc
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.cxeg
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json.lqoy
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json.xzju
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4.otyn
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4.tkfa
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json.teus
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4.wlrn
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json.vxsc
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json.slsp
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4.qjbx
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.wjtc
Modifies the following files
- %HOMEPATH%\desktop\210252809.jpeg
- %APPDATA%\microsoft\windows\libraries\music.library-ms
- C:\users\public\music\sample music\kalimba.mp3
- %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred
- %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\e7b9399e-3392-43f5-af55-6a17db70251d
- %APPDATA%\Microsoft\Templates\~$Normal.dotm
- %APPDATA%\microsoft\office\recent\templates.lnk
- %APPDATA%\microsoft\office\mso1033.acl
- %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c
- %APPDATA%\microsoft\protect\credhist
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
- C:\users\public\music\sample music\maid with the flaxen hair.mp3
- C:\users\public\music\sample music\sleep away.mp3
- C:\users\public\libraries\recordedtv.library-ms
- C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms
- C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms
- C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\desktop.ini
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\desktop.ini
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini
- C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop.ini
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\boot.sdi
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\210252809.jpg
- %HOMEPATH%\desktop\about.html
- %APPDATA%\microsoft\windows\libraries\pictures.library-ms
- %APPDATA%\microsoft\windows\libraries\documents.library-ms
Modifies multiple files.
Deletes itself.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.#.1.1 -n 1 -w 3000 > Nul & Del /f /q "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' 1.#.1.1 -n 1 -w 3000
- '<SYSTEM32>\wbem\wmic.exe' shadowcopy delete' (with hidden window)
