Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Terminates or attempts to terminate
the following user processes:
- firefox.exe
- iexplore.exe
Modifies file system
Creates the following files
- C:\kms\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\56\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\57\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\58\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\59\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\6\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\60\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\61\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\62\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\63\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\7\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\54\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\55\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\8\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\muffin\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\security\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\how to restore your files.txt
- %LOCALAPPDATA%low\sun\how to restore your files.txt
- %LOCALAPPDATA%low\how to restore your files.txt
- %APPDATA%\identities\{1bc91121-7903-48ee-bf78-1bc7ca4b5761}\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\9\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\host\how to restore your files.txt
- %APPDATA%\media center programs\how to restore your files.txt
- %APPDATA%\identities\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\51\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\31\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\33\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\34\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\35\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\36\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\37\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\38\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\52\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\3\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\53\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\4\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\43\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\44\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\45\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\46\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\47\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\48\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\49\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\5\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\50\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\40\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\41\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\42\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\office\how to restore your files.txt
- %APPDATA%\microsoft\credentials\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\how to restore your files.txt
- %APPDATA%\thunderbird\how to restore your files.txt
- %APPDATA%\how to restore your files.txt
- %HOMEPATH%\appdata\how to restore your files.txt
- %HOMEPATH%\contacts\how to restore your files.txt
- %HOMEPATH%\desktop\how to restore your files.txt
- %HOMEPATH%\documents\how to restore your files.txt
- %HOMEPATH%\downloads\how to restore your files.txt
- %HOMEPATH%\favorites\links\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\how to restore your files.txt
- %HOMEPATH%\favorites\links for united states\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\hmz1jddi.default\how to restore your files.txt
- %HOMEPATH%\favorites\msn websites\how to restore your files.txt
- %HOMEPATH%\favorites\how to restore your files.txt
- %HOMEPATH%\links\how to restore your files.txt
- %HOMEPATH%\music\how to restore your files.txt
- %HOMEPATH%\pictures\how to restore your files.txt
- %HOMEPATH%\saved games\how to restore your files.txt
- %HOMEPATH%\searches\how to restore your files.txt
- %HOMEPATH%\videos\how to restore your files.txt
- %HOMEPATH%\how to restore your files.txt
- C:\users\how to restore your files.txt
- %HOMEPATH%\favorites\microsoft websites\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\temporary\how to restore your files.txt
- %HOMEPATH%\favorites\windows live\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\how to restore your files.txt
- %APPDATA%\microsoft\crypto\rsa\how to restore your files.txt
- %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\how to restore your files.txt
- %APPDATA%\microsoft\protect\how to restore your files.txt
- %APPDATA%\microsoft\systemcertificates\my\certificates\how to restore your files.txt
- %APPDATA%\microsoft\systemcertificates\my\crls\how to restore your files.txt
- %APPDATA%\microsoft\systemcertificates\my\ctls\how to restore your files.txt
- %APPDATA%\microsoft\systemcertificates\my\how to restore your files.txt
- %APPDATA%\microsoft\systemcertificates\how to restore your files.txt
- %APPDATA%\microsoft\how to restore your files.txt
- %APPDATA%\telegram desktop\how to restore your files.txt
- %APPDATA%\thunderbird\crash reports\events\how to restore your files.txt
- %APPDATA%\thunderbird\crash reports\how to restore your files.txt
- %APPDATA%\microsoft\crypto\how to restore your files.txt
- %APPDATA%\thunderbird\pending pings\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\minidumps\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\default\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\29\how to restore your files.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\events\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\30\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\28\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\27\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\26\how to restore your files.txt
- C:\users\public\pictures\how to restore your files.txt
- C:\users\public\recorded tv\sample media\how to restore your files.txt
- C:\users\public\recorded tv\how to restore your files.txt
- C:\users\public\videos\sample videos\how to restore your files.txt
- C:\users\public\videos\how to restore your files.txt
- C:\users\public\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\credentials\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds\feeds for united states~\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\how to restore your files.txt
- C:\users\public\music\sample music\how to restore your files.txt
- C:\users\public\favorites\how to restore your files.txt
- C:\users\public\pictures\sample pictures\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds cache\6fwa5ftw\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds cache\bbs9hw0e\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds cache\xwtafhng\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds cache\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\media player\sync playlists\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\media player\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\office\groove\system\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\feeds cache\15ivkcr3\how to restore your files.txt
- C:\users\public\libraries\how to restore your files.txt
- C:\users\public\downloads\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\office\groove\user\how to restore your files.txt
- <Current directory>\how to restore your files.txt
- C:\perflogs\admin\how to restore your files.txt
- C:\perflogs\how to restore your files.txt
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\how to restore your files.txt
- C:\recovery\how to restore your files.txt
- C:\users\default\appdata\local\microsoft\how to restore your files.txt
- C:\users\default\appdata\local\temp\how to restore your files.txt
- C:\users\default\appdata\local\how to restore your files.txt
- C:\users\default\appdata\roaming\media center programs\how to restore your files.txt
- C:\users\default\appdata\roaming\microsoft\how to restore your files.txt
- C:\users\default\appdata\roaming\how to restore your files.txt
- C:\msocache\how to restore your files.txt
- C:\users\default\appdata\how to restore your files.txt
- C:\users\default\documents\how to restore your files.txt
- C:\users\default\downloads\how to restore your files.txt
- C:\users\default\favorites\how to restore your files.txt
- C:\users\default\links\how to restore your files.txt
- C:\users\default\music\how to restore your files.txt
- C:\users\default\pictures\how to restore your files.txt
- C:\users\default\saved games\how to restore your files.txt
- C:\users\default\videos\how to restore your files.txt
- C:\users\default\how to restore your files.txt
- C:\users\public\desktop\how to restore your files.txt
- C:\users\public\documents\how to restore your files.txt
- C:\users\default\desktop\how to restore your files.txt
- C:\how to restore your files.txt
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\office\groove\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows mail\stationery\how to restore your files.txt
- %LOCALAPPDATA%low\oracle\java\au\how to restore your files.txt
- %LOCALAPPDATA%low\oracle\java\how to restore your files.txt
- %LOCALAPPDATA%low\oracle\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\0\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\10\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\11\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\12\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\13\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\14\how to restore your files.txt
- %LOCALAPPDATA%low\microsoft\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\16\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\18\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\19\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\2\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\20\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\21\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\22\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\23\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\24\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\25\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\15\how to restore your files.txt
- C:\users\public\music\how to restore your files.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\6.0\17\how to restore your files.txt
- %LOCALAPPDATA%\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\hmz1jddi.default\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows mail\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows media\12.0\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows media\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows sidebar\gadgets\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows sidebar\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\how to restore your files.txt
- %LOCALAPPDATA%\microsoft help\how to restore your files.txt
- %LOCALAPPDATA%\programs\common\how to restore your files.txt
- %LOCALAPPDATA%\programs\how to restore your files.txt
- %TEMP%\hsperfdata_user\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows mail\backup\how to restore your files.txt
- %TEMP%\low\how to restore your files.txt
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_10.0.30319\how to restore your files.txt
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\how to restore your files.txt
- %TEMP%\opera installer\how to restore your files.txt
- %TEMP%\wpdnse\how to restore your files.txt
- %TEMP%\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\doomed\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\entries\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\safebrowsing\google4\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\safebrowsing\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\startupcache\how to restore your files.txt
- %TEMP%\microsoft .net framework 4 setup_4.0.30319\how to restore your files.txt
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\how to restore your files.txt
- %LOCALAPPDATA%\microsoft\windows mail\backup\new\how to restore your files.txt
- D:\how to restore your files.txt
Moves the following files
- from %TEMP%\adobearm.log to %TEMP%\adobearm.log.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.babyk
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite.babyk
- from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.babyk
- from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4.babyk
- from %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.babyk
- from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\parent.lock to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\parent.lock.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite.babyk
- from %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred.babyk
- from %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a to %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a.babyk
- from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.babyk
- from %TEMP%\dd_vcredist_amd64_20230912171641.log to %TEMP%\dd_vcredist_amd64_20230912171641.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912172034.log to %TEMP%\dd_vcredist_amd64_20230912172034.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912171824.log to %TEMP%\dd_vcredist_amd64_20230912171824.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912171735.log to %TEMP%\dd_vcredist_amd64_20230912171735.log.babyk
- from %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json to %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.babyk
- from %TEMP%\dd_vcredist_amd64_20230912172134.log to %TEMP%\dd_vcredist_amd64_20230912172134.log.babyk
- from %TEMP%\dd_vcredistui12db.txt to %TEMP%\dd_vcredistui12db.txt.babyk
- from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.babyk
- from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.babyk
- from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.babyk
- from %TEMP%\chrome_installer.log to %TEMP%\chrome_installer.log.babyk
- from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.babyk
- from %TEMP%\armui.ini to %TEMP%\armui.ini.babyk
- from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.babyk
- from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.babyk
- from %TEMP%\dd_vcredistmsi12db.txt to %TEMP%\dd_vcredistmsi12db.txt.babyk
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt.babyk
- from %TEMP%\dd_vcredist_amd64_20230912172247.log to %TEMP%\dd_vcredist_amd64_20230912172247.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log.babyk
- from %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\34c07d51-7b4e-49a7-98b0-482d3ccb1276 to %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\34c07d51-7b4e-49a7-98b0-482d3ccb1276.babyk
- from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47 to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47.babyk
- from %TEMP%\opera installer\opera_installer_20230912173246.log to %TEMP%\opera installer\opera_installer_20230912173246.log.babyk
- from %TEMP%\opera installer\opera_installer_20230912173243.log to %TEMP%\opera installer\opera_installer_20230912173243.log.babyk
- from %TEMP%\dd_vcredist_x86_20230912172322.log to %TEMP%\dd_vcredist_x86_20230912172322.log.babyk
- from %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log.babyk
- from %TEMP%\dd_vcredist_x86_20230912172224.log to %TEMP%\dd_vcredist_x86_20230912172224.log.babyk
- from %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log.babyk
- from %TEMP%\dd_vcredist_x86_20230912172157.log to %TEMP%\dd_vcredist_x86_20230912172157.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log.babyk
- from %TEMP%\dd_vcredist_x86_20230912171936.log to %TEMP%\dd_vcredist_x86_20230912171936.log.babyk
- from %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log.babyk
- from %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log.babyk
- from %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log.babyk
- from %TEMP%\dd_vcredist_x86_20230912171759.log to %TEMP%\dd_vcredist_x86_20230912171759.log.babyk
- from %TEMP%\dd_vcredist_x86_20230912171710.log to %TEMP%\dd_vcredist_x86_20230912171710.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log.babyk
- from %TEMP%\dd_vcredist_amd64_20230912172315.log to %TEMP%\dd_vcredist_amd64_20230912172315.log.babyk
- from %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log.babyk
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.babyk
Modifies the following files
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet' (with hidden window)