Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\desktop.ini.ransom
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\tree_view.html
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\howto-index.html
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %APPDATA%\thunderbird\profiles.ini
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %APPDATA%\mozilla\firefox\profiles.ini
Modifies file system
Creates the following files
- %HOMEPATH%\ntuser.dat.ransom
- %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt.ransom
- %TEMP%\jusched.log.ransom
- %TEMP%\javadeployreg.log.ransom
- %TEMP%\fxsapidebuglogfile.txt.ransom
- %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt.ransom
- %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt.ransom
- %TEMP%\dd_vcredist_x86_20230912172350.log.ransom
- %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log.ransom
- %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log.ransom
- %TEMP%\dd_vcredist_x86_20230912172322.log.ransom
- %TEMP%\dd_vcredist_x86_20230912172224.log.ransom
- %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log.ransom
- %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log.ransom
- %TEMP%\dd_vcredist_x86_20230912172157.log.ransom
- %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log.ransom
- %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log.ransom
- %TEMP%\dd_vcredist_x86_20230912171936.log.ransom
- %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log.ransom
- %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log.ransom
- %TEMP%\dd_vcredist_x86_20230912171759.log.ransom
- %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log.ransom
- %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log.ransom
- %TEMP%\dd_vcredist_x86_20230912171710.log.ransom
- %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt.ransom
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\offlinecache\index.sqlite.ransom
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\webext.sc.lz4.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\urlcache.bin.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\urlcache-current.bin.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\startupcache.8.little.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\scriptcache.bin.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\scriptcache-current.bin.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\scriptcache-child.bin.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\scriptcache-child-current.bin.ransom
- %TEMP%\opera installer\opera_installer_20230912173246.log.ransom
- %TEMP%\opera installer\opera_installer_20230912173243.log.ransom
- %TEMP%\~df993335c28e365ac9.tmp.ransom
- %TEMP%\~df5b5e6824bf550804.tmp.ransom
- %TEMP%\~df48dcd50ba54f361f.tmp.ransom
- %TEMP%\~df310e06bda3607483.tmp.ransom
- %TEMP%\~df2487d5516ff7b25f.tmp.ransom
- %TEMP%\~df1e6aeb10f7aa841a.tmp.ransom
- %TEMP%\wmsetup.log.ransom
- %TEMP%\tmpaddon.ransom
- %TEMP%\setupexe(202309121734336dc).log.ransom
- %TEMP%\rgia609.tmp-tmp.ransom
- %TEMP%\rgia609.tmp.ransom
- %TEMP%\ose00000.exe.ransom
- %TEMP%\opera_crashreporter.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912172315.log.ransom
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt.ransom
- %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log.ransom
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\startupcache\webext.sc.lz4.ransom
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\.startup-incomplete.ransom
- %LOCALAPPDATA%low\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico.ransom
- %LOCALAPPDATA%low\oracle\java\au\au.msi.ransom
- %LOCALAPPDATA%low\sun\java\deployment\deployment.properties.ransom
- %LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\jre1.8.0_45.msi.ransom
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47.ransom
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk.ransom
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk.ransom
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk.ransom
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk.ransom
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk.ransom
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk.ransom
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini.ransom
- %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.ransom
- %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.ransom
- %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.ransom
- %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.ransom
- %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini.ransom
- %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred.ransom
- %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a.ransom
- %APPDATA%\microsoft\protect\credhist.ransom
- %APPDATA%\microsoft\windows\libraries\videos.library-ms.ransom
- %APPDATA%\microsoft\windows\libraries\pictures.library-ms.ransom
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\startupcache\startupcache.8.little.ransom
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\entries\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f.ransom
- %TEMP%\dd_vcredist_amd64_20230912172247.log.ransom
- %TEMP%\adobearm.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912172134.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912172034.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912171824.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912171735.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912171641.log.ransom
- %TEMP%\dd_vcredistui12db.txt.ransom
- %TEMP%\dd_vcredistmsi12db.txt.ransom
- %TEMP%\dd_setuputility.txt.ransom
- %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.ransom
- %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.ransom
- %TEMP%\chrome_installer.log.ransom
- %TEMP%\aspnetsetup_00001.log.ransom
- %TEMP%\aspnetsetup_00000.log.ransom
- %TEMP%\armui.ini.ransom
- %TEMP%\adobesfx.log.ransom
- %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\0e0c6fa1da983516c579dee2be5f4bd13fd21317.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\15412bf73cd66dfbf0403d9720224a2654b18e14.ransom
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\08_video_rated_at_4_or_5_stars.wpl.ransom
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\07_tv_recorded_in_the_last_week.wpl.ransom
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\06_pictures_rated_4_or_5_stars.wpl.ransom
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\05_pictures_taken_in_the_last_month.wpl.ransom
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\04_music_played_in_the_last_month.wpl.ransom
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\03_music_rated_at_4_or_5_stars.wpl.ransom
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\02_music_added_in_the_last_month.wpl.ransom
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\01_music_auto_rated_at_5_stars.wpl.ransom
- %LOCALAPPDATA%\microsoft\media player\localmls_3.wmdb.ransom
- %LOCALAPPDATA%\microsoft\media player\currentdatabase_372.wmdb.ransom
- %LOCALAPPDATA%\microsoft\windows\burn\burn\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl.ransom
- %LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog.etl.ransom
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\windows\history\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\favicon[1].ico.ransom
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\windows\wer\reportqueue\critical_microsoft .net f_5deabd23d637fc27acf7bfdd613025667396c824_cab_0fbabd8f\report.wer.ransom
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat{62676190-51ca-11ee-be5d-0800276b50ae}.tmcontainer00000000000000000001.regtrans-ms.ransom
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat{62676190-51ca-11ee-be5d-0800276b50ae}.tmcontainer00000000000000000002.regtrans-ms.ransom
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\09_music_played_the_most.wpl.ransom
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\10_all_music.wpl.ransom
- %LOCALAPPDATA%\google\chrome\user data\local state.ransom
- %LOCALAPPDATA%\google\chrome\user data\first run.ransom
- %LOCALAPPDATA%\microsoft\feeds\feeds for united states~\usa~dgov updates~c news and features~.feed-ms.ransom
- %LOCALAPPDATA%\microsoft\feeds\feeds for united states~\popular government questions from usa~dgov~.feed-ms.ransom
- %LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\msnbc news~.feed-ms.ransom
- %LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\microsoft at work~.feed-ms.ransom
- %LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\microsoft at home~.feed-ms.ransom
- %LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\web slice gallery~.feed-ms.ransom
- %LOCALAPPDATA%\microsoft\feeds\feedsstore.feedsdb-ms.ransom
- %LOCALAPPDATA%\microsoft\feeds cache\15ivkcr3\fwlink[2].ransom
- %LOCALAPPDATA%\microsoft\feeds cache\15ivkcr3\fwlink[1].ransom
- %LOCALAPPDATA%\microsoft\feeds cache\6fwa5ftw\fwlink[1].ransom
- %LOCALAPPDATA%\google\chrome\user data\safe browsing cookies.ransom
- %LOCALAPPDATA%\microsoft\feeds cache\6fwa5ftw\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\feeds cache\bbs9hw0e\fwlink[1].ransom
- %LOCALAPPDATA%\microsoft\feeds cache\bbs9hw0e\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\feeds cache\xwtafhng\fwlink[2].ransom
- %LOCALAPPDATA%\microsoft\feeds cache\xwtafhng\fwlink[1].ransom
- %LOCALAPPDATA%\microsoft\feeds cache\xwtafhng\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\feeds cache\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.ransom
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.bak.ransom
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\12_all_video.wpl.ransom
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\11_all_pictures.wpl.ransom
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat{62676190-51ca-11ee-be5d-0800276b50ae}.tm.blf.ransom
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat.log2.ransom
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1.ransom
- %LOCALAPPDATA%\microsoft\windows mail\account{4c634590-60c3-4959-860f-6056b0519de7}.oeaccount.ransom
- %LOCALAPPDATA%\microsoft\windows mail\account{4c503e7d-fe8a-4399-baf5-0c5cf32e3de3}.oeaccount.ransom
- %LOCALAPPDATA%\microsoft\windows media\12.0\wmsdkns.dtd.ransom
- %LOCALAPPDATA%\microsoft\windows sidebar\settings.ini.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\dfdc36497a0baee2972009ee6deccc06c2e352c6.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\ca7b107e288f94eb98b38094e8c5546e41a7b930.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\bc9a334d14ae8d5cdcf1f5f5128ba1f4cdd083ac.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\a2f1b3da369eab62efa8bdaf2aaad94562df2b2f.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\a0a0f4e954265c3d7b4b176a57c2f52a8d15aa8c.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\9c571ec4d1abdf04dec3542cba1cbcdb49632bf7.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\8f309f195c567383add46eada887534dcd3e0fbd.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\887d2630f86b33d07a56262f006c5766c0dc38b0.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\82c47fa9f5f29d08908329a836215460fd85b37b.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\7330b218fe46e63c30e077c3456a7239baaead12.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\58a756a796a86993036e1f0f79183245ee2abf58.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\4c5a1680d3b63616e845aca183dd3af5ad89c635.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\39d80535a21e286b3c662765c5f09aceb927e77d.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\340a10d652987df5e54312e31f5c22f6e8dba574.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\2cb84dd9abb4e1485d83397c59b193094e1abfc7.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\2b8fb3a7c1e8990ce64886d66718692d2b2ed2bc.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\299eb705093e52d32165bfb83e05061ad4e4b4e6.ransom
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\1b9444b4039e68c2fcb46d72fc90a4ec81d1c92b.ransom
- %LOCALAPPDATA%\microsoft\windows mail\edb.chk.ransom
- %LOCALAPPDATA%\microsoft\windows mail\edb.log.ransom
- %LOCALAPPDATA%\microsoft\windows mail\account{b2d5c61a-2fda-49ff-b49b-bb441d95d33a}.oeaccount.ransom
- %LOCALAPPDATA%\microsoft\windows mail\edb00001.log.ransom
- %LOCALAPPDATA%\microsoft\windows mail\backup\new\windowsmail.pat.ransom
- %LOCALAPPDATA%\microsoft\windows mail\edbres00001.jrs.ransom
- %LOCALAPPDATA%\microsoft\windows mail\backup\new\windowsmail.msmessagestore.ransom
- %LOCALAPPDATA%\microsoft\windows mail\backup\new\edb00001.log.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\wrinkled_paper.gif.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\to_do_list.emf.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\tiki.gif.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\stucco.gif.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\shorthand.emf.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\seyes.emf.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\music.emf.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\month_calendar.emf.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\grid_(inch).wmf.ransom
- %APPDATA%\microsoft\windows\libraries\music.library-ms.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\grid_(cm).wmf.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\graph.emf.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\genko_2.emf.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\genko_1.emf.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\dotted_lines.emf.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\desktop.ini.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\connectivity.gif.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\cave_drawings.gif.ransom
- %LOCALAPPDATA%\microsoft\windows mail\windowsmail.pat.ransom
- %LOCALAPPDATA%\microsoft\windows mail\windowsmail.msmessagestore.ransom
- %LOCALAPPDATA%\microsoft\windows mail\edbres00002.jrs.ransom
- %LOCALAPPDATA%\microsoft\windows mail\stationery\memo.emf.ransom
- %LOCALAPPDATA%\microsoft\feeds cache\15ivkcr3\desktop.ini.ransom
- %APPDATA%\microsoft\windows\libraries\documents.library-ms.ransom
- %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\parent.lock.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\compatibility.ini.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json.ransom
- %APPDATA%\mozilla\firefox\profiles.ini.ransom
- %APPDATA%\mozilla\firefox\installs.ini.ransom
- %APPDATA%\telegram desktop\updater.exe.ransom
- %APPDATA%\telegram desktop\unins000.exe.ransom
- %APPDATA%\telegram desktop\telegram.exe.ransom
- %APPDATA%\thunderbird\crash reports\installtime20210406220621.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite.ransom
- %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.ransom
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt.ransom
- %APPDATA%\thunderbird\profiles.ini.ransom
- %HOMEPATH%\favorites\msn websites\msn money.url.ransom
- %HOMEPATH%\favorites\msn websites\msn autos.url.ransom
- %HOMEPATH%\favorites\windows live\windows live spaces.url.ransom
- %HOMEPATH%\favorites\windows live\windows live mail.url.ransom
- %HOMEPATH%\favorites\windows live\windows live gallery.url.ransom
- %HOMEPATH%\favorites\windows live\get windows live.url.ransom
- %HOMEPATH%\favorites\desktop.ini.ransom
- %HOMEPATH%\links\recentplaces.lnk.ransom
- %HOMEPATH%\links\downloads.lnk.ransom
- %HOMEPATH%\links\desktop.lnk.ransom
- %HOMEPATH%\links\desktop.ini.ransom
- %HOMEPATH%\music\desktop.ini.ransom
- %HOMEPATH%\pictures\desktop.ini.ransom
- %HOMEPATH%\saved games\desktop.ini.ransom
- %HOMEPATH%\searches\indexed locations.search-ms.ransom
- %HOMEPATH%\searches\everywhere.search-ms.ransom
- %HOMEPATH%\searches\desktop.ini.ransom
- %HOMEPATH%\videos\desktop.ini.ransom
- %HOMEPATH%\ntuser.ini.ransom
- %HOMEPATH%\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.ransom
- %HOMEPATH%\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.ransom
- %HOMEPATH%\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.ransom
- %HOMEPATH%\ntuser.dat.log2.ransom
- %HOMEPATH%\ntuser.dat.log1.ransom
- %HOMEPATH%\favorites\msn websites\msn entertainment.url.ransom
- %HOMEPATH%\favorites\msn websites\msn sports.url.ransom
- %HOMEPATH%\contacts\user.contact.ransom
- %HOMEPATH%\favorites\msn websites\msn.url.ransom
- %HOMEPATH%\contacts\desktop.ini.ransom
- %HOMEPATH%\desktop\telegram.lnk.ransom
- %HOMEPATH%\desktop\skypesetup.exe.ransom
- %HOMEPATH%\desktop\google chrome.lnk.ransom
- %HOMEPATH%\desktop\desktop.ini.ransom
- %HOMEPATH%\desktop\alert.html.ransom
- %HOMEPATH%\desktop\alert.htm.ransom
- %HOMEPATH%\desktop\adadsi.html.ransom
- %HOMEPATH%\desktop\64bit_notes.htm.ransom
- %HOMEPATH%\desktop\000814251_video_01.avi.ransom
- %HOMEPATH%\documents\desktop.ini.ransom
- %HOMEPATH%\downloads\desktop.ini.ransom
- %HOMEPATH%\favorites\links\web slice gallery.url.ransom
- %HOMEPATH%\favorites\links\desktop.ini.ransom
- %HOMEPATH%\favorites\links for united states\usa.gov.url.ransom
- %HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.ransom
- %HOMEPATH%\favorites\links for united states\desktop.ini.ransom
- %HOMEPATH%\favorites\microsoft websites\microsoft store.url.ransom
- %HOMEPATH%\favorites\microsoft websites\microsoft at work.url.ransom
- %HOMEPATH%\favorites\microsoft websites\microsoft at home.url.ransom
- %HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.ransom
- %HOMEPATH%\favorites\microsoft websites\ie add-on site.url.ransom
- %HOMEPATH%\favorites\msn websites\msnbc news.url.ransom
- %APPDATA%\thunderbird\installs.ini.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\content-prefs.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cookies.sqlite.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\administrative tools\desktop.ini.ransom
- %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini.ransom
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\desktop.ini.ransom
- %APPDATA%\microsoft\windows\start menu\desktop.ini.ransom
- %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.ransom
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js.ransom
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2023-09-29_11_w-7ab47btxtewdh4a2yehg==.jsonlz4.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk.ransom
- %APPDATA%\microsoft\windows\recent\customdestinations\7e4dca80246863e3.customdestinations-ms.ransom
- %APPDATA%\microsoft\windows\recent\customdestinations\6824f4a902c78fbd.customdestinations-ms.ransom
- %APPDATA%\microsoft\windows\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms.ransom
- %APPDATA%\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms.ransom
- %APPDATA%\microsoft\windows\recent\customdestinations\21ec1aac5c9ba09b.customdestinations-ms.ransom
- %APPDATA%\microsoft\windows\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms.ransom
- %APPDATA%\microsoft\windows\recent\desktop.ini.ransom
- %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.ransom
- %APPDATA%\microsoft\windows\sendto\fax recipient.lnk.ransom
- %APPDATA%\microsoft\windows\sendto\documents.mydocs.ransom
- %APPDATA%\microsoft\windows\sendto\desktop.ini.ransom
- %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.ransom
- %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk.ransom
- %APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\places.sqlite-wal.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\places.sqlite-shm.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\places.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\permissions.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\parent.lock.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\formhistory.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\favicons.sqlite-wal.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\favicons.sqlite-shm.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\favicons.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cookies.sqlite-wal.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cookies.sqlite-shm.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\webappsstore.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\webappsstore.sqlite-shm.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\data.safe.bin.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4.ransom
- %APPDATA%\microsoft\windows\libraries\desktop.ini.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\.metadata-v2.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\webappsstore.sqlite-wal.ransom
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4.ransom
- %LOCALAPPDATA%\google\chrome\user data\safe browsing cookies-journal.ransom
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C cls' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C cls