Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XPSUDTARW' = '"<Full path to file>"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\decryptfiles.txt
- %APPDATA%\microsoft\word\startup\decryptfiles.txt
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\events\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite-wal.lqvv
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\minidumps\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite-wal.mrso
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt.piee
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt.hgjr
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.fil...
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\parent.lock.pbxi
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\security_state\decryptfiles.txt
- %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.hkit
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\maintenance\decryptfiles.txt
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.whej
- %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.yqjb
- %APPDATA%\microsoft\windows\start menu\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\decryptfiles.txt
- %APPDATA%\microsoft\windows\sendto\documents.mydocs.ojfu
- %APPDATA%\microsoft\windows\start menu\programs\accessories\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\administrative tools\decryptfiles.txt
- %APPDATA%\mozilla\firefox\pending pings\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\winrar\decryptfiles.txt
- %APPDATA%\microsoft\windows\templates\decryptfiles.txt
- %APPDATA%\microsoft\windows\themes\decryptfiles.txt
- %APPDATA%\microsoft\word\decryptfiles.txt
- %APPDATA%\mozilla\decryptfiles.txt
- %APPDATA%\mozilla\extensions\decryptfiles.txt
- %APPDATA%\mozilla\firefox\decryptfiles.txt
- %APPDATA%\mozilla\firefox\crash reports\decryptfiles.txt
- %APPDATA%\mozilla\firefox\crash reports\events\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\google chrome\decryptfiles.txt
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\decryptfiles.txt
- %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.reon
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\default\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt.qtxj
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\decryptfiles.txt
- %HOMEPATH%\contacts\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt.vduq
- %HOMEPATH%\documents\decryptfiles.txt
- %HOMEPATH%\favorites\links\decryptfiles.txt
- %HOMEPATH%\favorites\links for united states\decryptfiles.txt
- %HOMEPATH%\favorites\microsoft websites\decryptfiles.txt
- %HOMEPATH%\favorites\msn websites\decryptfiles.txt
- %HOMEPATH%\favorites\windows live\decryptfiles.txt
- %HOMEPATH%\links\decryptfiles.txt
- %HOMEPATH%\ntuser.dat.log1.gkfq
- %HOMEPATH%\ntuser.dat.log2.vtwa
- %HOMEPATH%\saved games\decryptfiles.txt
- %HOMEPATH%\downloads\decryptfiles.txt
- %HOMEPATH%\favorites\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt.rcsm
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite-wal.svqd
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\decryptfiles.txt
- %APPDATA%\mozilla\systemextensionsdev\decryptfiles.txt
- %APPDATA%\telegram desktop\decryptfiles.txt
- %APPDATA%\thunderbird\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\minidumps\decryptfiles.txt
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\parent.lock.rcqj
- %APPDATA%\thunderbird\crash reports\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\dm02c46v.default\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\events\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt.kzot
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\decryptfiles.txt
- %APPDATA%\thunderbird\crash reports\events\decryptfiles.txt
- %APPDATA%\thunderbird\pending pings\decryptfiles.txt
- %APPDATA%\thunderbird\profiles\decryptfiles.txt
- %APPDATA%\microsoft\windows\sendto\decryptfiles.txt
- %APPDATA%\microsoft\windows\recent\customdestinations\decryptfiles.txt
- %APPDATA%\microsoft\windows\recent\automaticdestinations\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\templates\decryptfiles.txt
- C:\users\default\desktop\decryptfiles.txt
- C:\users\default\documents\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink.jwrm
- C:\users\public\documents\my pictures\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.dawg
- C:\users\default\downloads\decryptfiles.txt
- C:\users\default\favorites\decryptfiles.txt
- C:\users\default\links\decryptfiles.txt
- C:\users\default\ntuser.dat.log2.ikwb
- C:\users\default\saved games\decryptfiles.txt
- C:\users\public\decryptfiles.txt
- C:\users\public\desktop\decryptfiles.txt
- C:\users\public\documents\decryptfiles.txt
- C:\users\public\documents\my music\decryptfiles.txt
- C:\users\default\documents\my pictures\decryptfiles.txt
- C:\users\default\documents\my music\decryptfiles.txt
- C:\users\default\documents\my videos\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\recent\decryptfiles.txt
- C:\users\default\appdata\decryptfiles.txt
- %HOMEPATH%\documents\my music\decryptfiles.txt
- %HOMEPATH%\documents\my pictures\decryptfiles.txt
- %HOMEPATH%\documents\my videos\decryptfiles.txt
- C:\documents and settings\decryptfiles.txt
- C:\kms\decryptfiles.txt
- C:\msocache\decryptfiles.txt
- C:\perflogs\decryptfiles.txt
- C:\perflogs\admin\decryptfiles.txt
- C:\recovery\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\sendto\decryptfiles.txt
- C:\users\public\documents\my videos\decryptfiles.txt
- %HOMEPATH%\desktop\decryptfiles.txt
- C:\users\default\appdata\roaming\decryptfiles.txt
- C:\users\default\appdata\roaming\media center programs\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\internet explorer\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\cookies\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\decryptfiles.txt
- C:\users\default\decryptfiles.txt
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\decryptfiles.txt
- C:\users\default\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail.wvpc
- C:\users\public\downloads\decryptfiles.txt
- %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\decryptfiles.txt
- %APPDATA%\microsoft\systemcertificates\my\decryptfiles.txt
- %APPDATA%\microsoft\systemcertificates\my\certificates\decryptfiles.txt
- %APPDATA%\microsoft\systemcertificates\my\crls\decryptfiles.txt
- %APPDATA%\microsoft\systemcertificates\my\ctls\decryptfiles.txt
- %APPDATA%\microsoft\templates\decryptfiles.txt
- %APPDATA%\microsoft\uproof\decryptfiles.txt
- %APPDATA%\microsoft\windows\decryptfiles.txt
- %APPDATA%\microsoft\windows\cookies\decryptfiles.txt
- %APPDATA%\microsoft\protect\decryptfiles.txt
- %APPDATA%\microsoft\office\recent\decryptfiles.txt
- %APPDATA%\microsoft\systemcertificates\decryptfiles.txt
- %APPDATA%\microsoft\windows\cookies\low\decryptfiles.txt
- %APPDATA%\microsoft\windows\ietldcache\low\decryptfiles.txt
- %APPDATA%\microsoft\uproof\custom.dic.nrms
- %APPDATA%\microsoft\windows\libraries\decryptfiles.txt
- %APPDATA%\microsoft\windows\network shortcuts\decryptfiles.txt
- %APPDATA%\microsoft\windows\printer shortcuts\decryptfiles.txt
- %APPDATA%\microsoft\windows\privacie\decryptfiles.txt
- %APPDATA%\microsoft\windows\privacie\low\decryptfiles.txt
- %APPDATA%\microsoft\windows\recent\decryptfiles.txt
- %APPDATA%\microsoft\windows\iecompatcache\decryptfiles.txt
- %APPDATA%\microsoft\windows\iecompatcache\low\decryptfiles.txt
- %APPDATA%\microsoft\windows\ietldcache\decryptfiles.txt
- %APPDATA%\microsoft\proof\decryptfiles.txt
- %APPDATA%\microsoft\office\decryptfiles.txt
- C:\users\public\favorites\decryptfiles.txt
- C:\users\public\music\sample music\decryptfiles.txt
- C:\users\public\pictures\sample pictures\decryptfiles.txt
- C:\users\public\recorded tv\decryptfiles.txt
- C:\users\public\recorded tv\sample media\decryptfiles.txt
- C:\users\public\videos\sample videos\decryptfiles.txt
- %HOMEPATH%\decryptfiles.txt
- %HOMEPATH%\appdata\decryptfiles.txt
- %APPDATA%\decryptfiles.txt
- %APPDATA%\identities\decryptfiles.txt
- %APPDATA%\identities\{1bba5dcd-58f3-46ae-861d-68cf42722c36}\decryptfiles.txt
- C:\users\public\libraries\decryptfiles.txt
- %APPDATA%\media center programs\decryptfiles.txt
- %APPDATA%\microsoft\addins\decryptfiles.txt
- %APPDATA%\microsoft\credentials\decryptfiles.txt
- %APPDATA%\microsoft\crypto\decryptfiles.txt
- %APPDATA%\microsoft\crypto\rsa\decryptfiles.txt
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\decryptfiles.txt
- %APPDATA%\microsoft\internet explorer\decryptfiles.txt
- %APPDATA%\microsoft\internet explorer\quick launch\decryptfiles.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\decryptfiles.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decryptfiles.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\decryptfiles.txt
- %APPDATA%\microsoft\decryptfiles.txt
- %HOMEPATH%\searches\decryptfiles.txt
- nul
Moves the following files
- from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814 to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814.heuq
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json.obon
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json.wpcf
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json.gezp
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.yams
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.xvlb
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.jtam
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4.fvhb
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4.rghx
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json.xful
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini.aedm
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.lqkg
- from %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json to %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json.adjt
- from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.fyco
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.fgud
- from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.eokn
- from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json.fbpk
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js.zrab
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.tsxd
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9.jgnl
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json.djik
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.ggpl
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.irgl
- from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js.zlxy
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.kdzi
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4.dntw
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.yecj
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.kuln
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.zffk
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json.vcre
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.xaob
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json.swnv
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.qugr
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2.uxvc
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.yzum
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8.jcei
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4.zdir
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4.vhwa
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4.gnat
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.jnue
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.fpsj
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json.qtzi
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json.jkfz
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.lkoy
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.jjty
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite.lhhl
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.jfhs
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite.foha
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json.upgd
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2.jvfu
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json.rzmt
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.lqiu
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
- from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.xixr
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4.cfzt
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json.njck
- from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.dokj
- from %APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini.exob
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini.nadp
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.szvl
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.elvc
- from %APPDATA%\microsoft\windows\sendto\desktop.ini to %APPDATA%\microsoft\windows\sendto\desktop.ini.tdxp
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2024-09-04_11_de2a2eo29nunltkagq5ija==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2024-09-04_11_de2a2eo29nunltkagq5ija==.jsonlz4.gyws
- from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\music.library-ms.jdct
- from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\pictures.library-ms.kxnm
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.gzhh
- from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\normal.dotm.nkuz
- from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\videos.library-ms.emdf
- from %APPDATA%\microsoft\office\recent\templates.lnk to %APPDATA%\microsoft\office\recent\templates.lnk.mkwa
- from %APPDATA%\Microsoft\Templates\~$Normal.dotm to %APPDATA%\microsoft\templates\~$normal.dotm.ohxe
- from %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c to %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c.qple
- from %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred.rapu
- from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.dxty
- from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\mso1033.acl.loiw
- from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\documents.library-ms.tknf
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4.vltg
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json.kjcp
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json.juvb
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2.drsr
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json.zwfr
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071.jkzu
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.udfh
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2.rmkc
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.gdhk
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json.pljn
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4.xlks
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858.qteq
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4.fepq
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4.bfub
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177.oxzj
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js.kecm
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini.bfzh
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.yhpd
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json.jsoa
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4.cckl
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4.xezg
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json.bhzj
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4.qfwg
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4.njvo
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json.drfg
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json.eclq
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json.iqhk
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.btew
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.klih
Modifies the following files
- %HOMEPATH%\desktop\508softwareandos.doc
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
- C:\users\public\music\sample music\maid with the flaxen hair.mp3
- C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms
- C:\users\public\libraries\recordedtv.library-ms
- C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms
- C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\boot.sdi
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\desktop.ini
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\desktop.ini
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini
- C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop.ini
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\archer.avi
- %APPDATA%\microsoft\office\mso1033.acl
- %APPDATA%\microsoft\protect\credhist
Modifies multiple files.
Deletes itself.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.#.1.1 -n 1 -w 3000 > Nul & Del /f /q "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' 1.#.1.1 -n 1 -w 3000
- '<SYSTEM32>\wbem\wmic.exe' shadowcopy delete' (with hidden window)