Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Classes\.crypted\shell\Open\command] '' = 'explorer.exe HOWTORECOVER.html'
Creates the following files on removable media
- <Drive name for removable media>:\howtorecover.html
- <Drive name for removable media>:\archer.avi
Modifies file system
Creates the following files
- <Full path to file>.log
- %APPDATA%\thunderbird\howtorecover.html
- %APPDATA%\thunderbird\crash reports\howtorecover.html
- %APPDATA%\telegram desktop\howtorecover.html
- %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\howtorecover.html
- %APPDATA%\microsoft\protect\howtorecover.html
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\howtorecover.html
- %LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\howtorecover.html
- %LOCALAPPDATA%low\sun\java\deployment\howtorecover.html
- %LOCALAPPDATA%low\oracle\java\au\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds cache\howtorecover.html
- %LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\startupcache\howtorecover.html
- %LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\howtorecover.html
- %LOCALAPPDATA%\microsoft\windows sidebar\howtorecover.html
- %LOCALAPPDATA%\microsoft\windows media\12.0\howtorecover.html
- %LOCALAPPDATA%\microsoft\windows mail\stationery\howtorecover.html
- %LOCALAPPDATA%\microsoft\windows mail\backup\new\howtorecover.html
- %LOCALAPPDATA%\microsoft\windows mail\howtorecover.html
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\howtorecover.html
- %LOCALAPPDATA%\microsoft\media player\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds cache\q2xofo16\howtorecover.html
- %LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\cache2\entries\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds cache\id3ykpjl\howtorecover.html
- %APPDATA%\thunderbird\profiles\49zr3fqa.default\howtorecover.html
- %HOMEPATH%\favorites\howtorecover.html
- %HOMEPATH%\saved games\howtorecover.html
- %HOMEPATH%\pictures\howtorecover.html
- %HOMEPATH%\howtorecover.html
- %HOMEPATH%\music\howtorecover.html
- %HOMEPATH%\links\howtorecover.html
- %HOMEPATH%\favorites\windows live\howtorecover.html
- %HOMEPATH%\favorites\msn websites\howtorecover.html
- %HOMEPATH%\favorites\microsoft websites\howtorecover.html
- %HOMEPATH%\favorites\links for united states\howtorecover.html
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\howtorecover.html
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\howtorecover.html
- %HOMEPATH%\downloads\howtorecover.html
- %HOMEPATH%\documents\howtorecover.html
- %HOMEPATH%\desktop\howtorecover.html
- %HOMEPATH%\contacts\howtorecover.html
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\howtorecover.html
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\howtorecover.html
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\howtorecover.html
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\howtorecover.html
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\howtorecover.html
- %HOMEPATH%\favorites\links\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds cache\5uzys9tz\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds cache\1zlrvj28\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\howtorecover.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\howtorecover.html
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\howtorecover.html
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\howtorecover.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\howtorecover.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\howtorecover.html
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\howtorecover.html
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\howtorecover.html
- C:\kms\howtorecover.html
- D:\howtorecover.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\howtorecover.html
- %ProgramFiles%\howtorecover.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\howtorecover.html
- %ProgramFiles%\microsoft sql server compact edition\v3.5\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\howtorecover.html
- C:\users\public\music\sample music\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds\howtorecover.html
- %LOCALAPPDATA%\microsoft\feeds\feeds for united states~\howtorecover.html
- %LOCALAPPDATA%\howtorecover.html
- C:\users\public\videos\sample videos\howtorecover.html
- C:\users\public\videos\howtorecover.html
- C:\users\public\recorded tv\sample media\howtorecover.html
- C:\users\public\recorded tv\howtorecover.html
- C:\users\public\pictures\sample pictures\howtorecover.html
- C:\users\public\pictures\howtorecover.html
- C:\users\public\music\howtorecover.html
- %ProgramFiles(x86)%\howtorecover.html
- C:\users\public\libraries\howtorecover.html
- C:\users\public\downloads\howtorecover.html
- C:\users\public\documents\howtorecover.html
- C:\users\public\howtorecover.html
- C:\users\public\desktop\howtorecover.html
- C:\users\howtorecover.html
- C:\users\default\howtorecover.html
- C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\howtorecover.html
- <Current directory>\howtorecover.html
- %HOMEPATH%\searches\howtorecover.html
- %HOMEPATH%\videos\howtorecover.html
Moves the following files
- from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\f58155b4b1d5a524ca0261c3ee99fb50_d4602615-9d50-4880-be41-678935e93eaa to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\f58155b4b1d5a524ca0261c3ee99fb50_d4602615-9d50-4880-be41-678935e93eaa.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\a6077284-6dcc-4781-9fb7-7f9d7b5132bf to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\a6077284-6dcc-4781-9fb7-7f9d7b5132bf.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\d092fa80-6cc0-49cc-9da4-f67b3d6cdc55 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\e60182f3-3480-48d0-bc12-b3b897042a6b to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\e60182f3-3480-48d0-bc12-b3b897042a6b.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\search.json.mozlz4.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\.metadata-v2.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json.crypted
- from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.crypted
- from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\71e6321a-7203-4cd6-882b-58bcea299d05 to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\71e6321a-7203-4cd6-882b-58bcea299d05.crypted
- from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\ec2e5fbc-5cd2-48b5-bd25-b5b2c4d33d98 to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\ec2e5fbc-5cd2-48b5-bd25-b5b2c4d33d98.crypted
- from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\preferred.crypted
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.crypted
- from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.crypted
- from %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json to %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\compatibility.ini.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\store.json.mozlz4.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411763506.e60182f3-3480-48d0-bc12-b3b897042a6b.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411763506.e60182f3-3480-48d0-bc12-b3b897042a6b.new-profile.jsonlz4.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764034.d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.main.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764034.d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.main.jsonlz4.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764036.a6077284-6dcc-4781-9fb7-7f9d7b5132bf.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764036.a6077284-6dcc-4781-9fb7-7f9d7b5132bf.first-shutdown.jsonlz4.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json.crypted
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite.crypted
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.crypted
Modifies the following files
- C:\kms\kms_vl_all_aio_debug.log.crypted
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml.crypted
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\owow32lr.cab.crypted
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml.crypted
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml.crypted
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml.crypted
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml.crypted
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml.crypted
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml.crypted
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab.crypted
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.crypted
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab.crypted
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.crypted
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.crypted
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.crypted
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.crypted
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.crypted
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab.crypted
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.crypted
- <Drive name for removable media>:\archer.avi.crypted
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml.crypted
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml.crypted
Modifies multiple files.
Substitutes the following files
- C:\Users\Default\NTUSER.DAT
- C:\Users\Default\NTUSER.DAT.LOG
- C:\Users\Default\NTUSER.DAT.LOG1
Changes user data files extensions (Trojan.Encoder).