Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\file recovery.txt
Modifies file system
Creates the following files
- <Current directory>\weax.txt
- %ProgramFiles%\mozilla thunderbird\fonts\file recovery.txt
- %ProgramFiles%\mozilla firefox\file recovery.txt
- %ProgramFiles%\mozilla firefox\fonts\file recovery.txt
- %ProgramFiles%\mozilla firefox\browser\file recovery.txt
- %ProgramFiles%\mozilla firefox\browser\features\file recovery.txt
- %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\file recovery.txt
- %ProgramFiles%\microsoft sql server compact edition\v3.5\file recovery.txt
- %ProgramFiles%\microsoft office\templates\1033\file recovery.txt
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\file recovery.txt
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\file recovery.txt
- %ProgramFiles%\microsoft office\templates\1033\access\file recovery.txt
- %ProgramFiles%\microsoft office\templates\1033\access\part\file recovery.txt
- %ProgramFiles%\microsoft office\office14\file recovery.txt
- %ProgramFiles%\microsoft office\office14\pubwiz\file recovery.txt
- %ProgramFiles%\microsoft office\office14\proof\file recovery.txt
- %ProgramFiles%\microsoft office\office14\proof\3082\file recovery.txt
- %ProgramFiles%\microsoft office\office14\proof\1036\file recovery.txt
- %ProgramFiles%\microsoft office\office14\proof\1033\file recovery.txt
- %ProgramFiles%\microsoft office\office14\pagesize\file recovery.txt
- %ProgramFiles%\microsoft office\office14\library\file recovery.txt
- %ProgramFiles%\microsoft office\office14\library\solver\file recovery.txt
- %ProgramFiles%\mozilla thunderbird\file recovery.txt
- %ProgramFiles%\reference assemblies\microsoft\framework\v3.0\file recovery.txt
- %ProgramFiles%\reference assemblies\microsoft\framework\v3.5\file recovery.txt
- %ProgramFiles%\windows journal\file recovery.txt
- %ProgramFiles(x86)%\windows media player\file recovery.txt
- %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.5\file recovery.txt
- %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.0\file recovery.txt
- %ProgramFiles(x86)%\opera\29.0.1795.47\file recovery.txt
- %ProgramFiles(x86)%\opera\29.0.1795.47\localization\file recovery.txt
- %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\file recovery.txt
- %ProgramFiles(x86)%\microsoft office\office14\file recovery.txt
- %ProgramFiles(x86)%\microsoft office\office14\1033\file recovery.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\file recovery.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\file recovery.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\css\file recovery.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\js\file recovery.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\js\plugins\file recovery.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\js\plugins\rhp\file recovery.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\file recovery.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\file recovery.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\multimedia\mpp\file recovery.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\file recovery.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\file recovery.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\file recovery.txt
- %ProgramFiles%\winrar\file recovery.txt
- %ProgramFiles%\windows media player\file recovery.txt
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\file recovery.txt
- %ProgramFiles%\microsoft office\office14\document parts\1033\14\file recovery.txt
- %ProgramFiles%\microsoft office\office14\bibliography\style\file recovery.txt
- %ProgramFiles%\microsoft office\office14\addins\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\file recovery.txt
- C:\documents and settings\user\file recovery.txt
- C:\documents and settings\all users\documents\my videos\sample videos\wildlife.wmv
- C:\documents and settings\user\local settings\thunderbird\profiles\rehh7ft5.default-release\startupcache\file recovery.txt
- C:\documents and settings\user\local settings\temp\file recovery.txt
- C:\documents and settings\user\local settings\microsoft\media player\file recovery.txt
- C:\documents and settings\user\desktop\file recovery.txt
- C:\documents and settings\public\recorded tv\sample media\file recovery.txt
- C:\documents and settings\default\file recovery.txt
- C:\documents and settings\all users\oracle\java\installcache_x64\file recovery.txt
- C:\documents and settings\all users\microsoft\rac\statedata\file recovery.txt
- C:\documents and settings\all users\microsoft\rac\publisheddata\file recovery.txt
- C:\documents and settings\all users\microsoft\officesoftwareprotectionplatform\file recovery.txt
- C:\documents and settings\all users\microsoft\office\uicaptions\3082\file recovery.txt
- C:\documents and settings\all users\microsoft\office\uicaptions\1036\file recovery.txt
- C:\documents and settings\all users\microsoft\network\downloader\file recovery.txt
- C:\documents and settings\all users\microsoft\assistance\client\1.0\en-us\file recovery.txt
- C:\documents and settings\all users\documents\my music\sample music\kalimba.mp3
- C:\documents and settings\all users\documents\my videos\sample videos\file recovery.txt
- C:\documents and settings\all users\documents\my pictures\sample pictures\file recovery.txt
- C:\documents and settings\all users\documents\my music\sample music\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\performance\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\pets\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\file recovery.txt
- %ProgramFiles%\microsoft office\office14\1033\file recovery.txt
- %ProgramFiles%\microsoft office\office14\1033\quickstyles\file recovery.txt
- C:\documents and settings\all users\oracle\java\installcache_x64\baseimagefam8
- %ProgramFiles%\microsoft office\media\office14\file recovery.txt
- %ProgramFiles%\microsoft office\media\office14\1033\file recovery.txt
- %ProgramFiles%\microsoft office\media\cagcat10\file recovery.txt
- %ProgramFiles%\microsoft office\media\cagcat10\1033\file recovery.txt
- %ProgramFiles%\microsoft office\document themes 14\file recovery.txt
- %ProgramFiles%\microsoft office\document themes 14\theme effects\file recovery.txt
- %ProgramFiles%\microsoft office\clipart\pub60cor\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\fonts\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\ext\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\cmm\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\bin\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\bin\server\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\bin\plugin2\file recovery.txt
- %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\file recovery.txt
- %ProgramFiles%\dvd maker\file recovery.txt
- %ProgramFiles%\dvd maker\shared\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\travel\file recovery.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\sports\file recovery.txt
- %ProgramFiles%\microsoft office\office14\accwiz\file recovery.txt
- g:\file recovery.txt
Moves the following files
- from C:\documents and settings\all users\documents\my music\sample music\kalimba.mp3 to C:\documents and settings\all users\documents\my music\sample music\kalimba.mp3.weax
- from C:\documents and settings\all users\documents\my videos\sample videos\wildlife.wmv to C:\documents and settings\all users\documents\my videos\sample videos\wildlife.wmv.weax
- from C:\documents and settings\all users\oracle\java\installcache_x64\baseimagefam8 to C:\documents and settings\all users\oracle\java\installcache_x64\baseimagefam8.weax
- from %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.weax
- from %ProgramFiles%\microsoft office\templates\1033\fiverules.potx to %ProgramFiles%\microsoft office\templates\1033\fiverules.potx.weax
- from %ProgramFiles%\mozilla thunderbird\xul.dll to %ProgramFiles%\mozilla thunderbird\xul.dll.weax
Modifies the following files
- %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar
- %ProgramFiles%\microsoft office\templates\1033\fiverules.potx
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim
Network activity
Connects to
- 'ap#.#pify.org':80
- '19#.#43.1.153':80
TCP
HTTP GET requests
- http://ap#.#pify.org/
HTTP POST requests
- http://19#.#43.1.153/Ujdu8jjooue/biweax.php
UDP
- DNS ASK ap#.#pify.org
