Technical Information
Modifies file system
Moves the following files
- from %TEMP%\wallpaper.bmp to %TEMP%\8ur3zpzx.crypted
- from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\2uka5no1.crypted
- from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\3hrdur2f.crypted
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\4g7nguaj.crypted
- from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\1qdqjrgm.crypted
- from %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json to %APPDATA%\thunderbird\profiles\dm02c46v.default\2gk97ui8.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\j87qfdk3.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\o1qb0zq1.crypted
- from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\e7narw5p.crypted
- from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\hxko76by.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\kbu6d6ts.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cert9.db to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xc0eli71.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\w9s4t0k2.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\k30846fb.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\1ko14cyu.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\g12awatd.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\ybvkt1s2.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\4zqmori2.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\da1brdjb.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\4wlhjee0.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\8sm26w8x.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\8g31ky25.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\al9g3sz7.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2qplb8mp.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\0c5bpfn2.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\ilaolvou.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\yqo0bvej.crypted
- from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\z7wmdu7p.crypted
- from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\3keg2h5z.crypted
- from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\ddgpiuck.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\e0vs5cxa.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\eafbbqeu.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\tu6xnw6o.crypted to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\gkc9faxe.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pr87nawj.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\wlaxtga7.crypted to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\7fcjo83c.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\7gqz9nd7.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\8eh7fqmr.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\tc8vt6ky.crypted to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\84k8vv6y.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\ec6ur4ci.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\6cvfkne6.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\f6jsn6vj.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\mhqxo5fi.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\tl6bev8j.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\tbb4ax87.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\6o3779b3.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\wuugzc3r.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\4san4df5.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\eh8yo7eg.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\vvpkrya5.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\tvr635i8.crypted to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\59jxs04g.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sl9z4jf8.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\wiglpek6.crypted to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\4ws7969k.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xc0eli71.crypted to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\n5390svi.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\kuaini8h.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\ybvkt1s2.crypted to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\kh3eoum3.crypted
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\6ouati5i.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\vvpkrya5.crypted to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\gtou90n6.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\w9s4t0k2.crypted to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\hkggiacj.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\s8csuv8p.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\e189lafc.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\9wfw4q1q.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\g1sf3cj2.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\nsjegmtf.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\tvr635i8.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\mev3in6w.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\m42mvyo1.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\hu2o1r5o.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\19bh1iwg.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\1a9upswq.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\h57v5vzz.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\parent.lock to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\wiglpek6.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\856gybwx.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\n7j1s498.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\7eidaig1.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\axapxkuc.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\key4.db to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\qw5rmwjs.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\mailviews.dat to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\jyd7bv6e.crypted
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\8dyw8s45.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\x9iflv2p.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\a2i5w1vd.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\vazuwgz1.crypted
- from %APPDATA%\microsoft\windows\sendto\documents.mydocs to %APPDATA%\microsoft\windows\sendto\1b7p5dk9.crypted
- from %APPDATA%\microsoft\windows\sendto\fax recipient.lnk to %APPDATA%\microsoft\windows\sendto\6a44y6cr.crypted
- from %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail to %APPDATA%\microsoft\windows\sendto\f0bnyg8q.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\0xk3c9p2.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\e1cgidyc.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\k0l3zsmm.crypted
- from %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget to %APPDATA%\microsoft\windows\sendto\ru91i35u.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk to %APPDATA%\microsoft\windows\start menu\programs\google chrome\6h0x3tjb.crypted
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\frzc3mo8.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\0zq877ei.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\34rr6j2a.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\fhozziny.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\kjldhetb.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\nn4znlve.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\0nik94gb.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\2r9ui0pn.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\340dnl3a.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\faj71h8b.crypted
- from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\9208vq8k.crypted
- from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\microsoft\internet explorer\quick launch\o78o47vu.crypted
- from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\8ur3zpzx.crypted
- from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\microsoft\internet explorer\quick launch\h0da1yoj.crypted
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\e8760xls.crypted
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\ls7e9th4.crypted
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\lpcv7uvh.crypted
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\32x6k7vh.crypted
- from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\dxh7nl7p.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk to %APPDATA%\microsoft\windows\start menu\programs\mi633azk.crypted
- from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\f98er24s.crypted
- from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\jxaka686.crypted
- from %APPDATA%\microsoft\office\recent\templates.lnk to %APPDATA%\microsoft\office\recent\92ydct3k.crypted
- from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\047rjl54.crypted
- from %APPDATA%\microsoft\uproof\custom.dic to %APPDATA%\microsoft\uproof\y4jc34rr.crypted
- from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\62g73vvy.crypted
- from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\kgry99dw.crypted
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\akeoeeoj.crypted
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\lvzwelog.crypted
- from %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink to %APPDATA%\microsoft\windows\sendto\k162m3no.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk to %APPDATA%\microsoft\windows\start menu\programs\4knem0bb.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\jm33pjb3.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\4qbf6lp9.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\lhxy5o1c.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\oafmnjtp.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\j26x39y2.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pluginreg.dat to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\2n1npqyv.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\7pbvi0z6.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\byhmt2yk.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\heml3gu8.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\rabtxv32.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\rtsxk5vy.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\6sx75i4q.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\4fh1pkcp.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\metirxru.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\o4f8xr36.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\voj3thfq.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\mv21getq.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\54swxpy9.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\5na6g74b.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\rtb0ya7y.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk to %APPDATA%\microsoft\windows\start menu\programs\maintenance\1cn0uxmp.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\koio5f4l.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\ozrw0m40.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\a9z09b4f.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\zo9eurgu.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\r5o5975q.crypted
- from %APPDATA%\microsoft\windows\themes\transcodedwallpaper.jpg to %APPDATA%\microsoft\windows\themes\hu37hajr.crypted
- from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\j968oc6q.crypted
- from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\jis03vk7.crypted
- from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\9ivooktr.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\5ylbiwow.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\tc8vt6ky.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2024-08-28_11_de2a2eo29nunltkagq5ija==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\xe2p2skf.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\wlaxtga7.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\n6hi0wpi.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\3nhreqkq.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\459qzu76.crypted
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\tu6xnw6o.crypted
- from %TEMP%\8ur3zpzx.crypted to %TEMP%\ru1nz9ya.crypted
- from %TEMP%\wallpaper.bmp to %TEMP%\n3csnvgs.crypted
Modifies the following files
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\dial.bmp
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk
- %HOMEPATH%\desktop\dashborder_144.bmp
- %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk
- %TEMP%\wallpaper.bmp
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %TEMP%\fxsapidebuglogfile.txt
- %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
Modifies multiple files.
Substitutes the following files
- %HOMEPATH%\Desktop\508softwareandos.doc
- %TEMP%\wallpaper.bmp
- %HOMEPATH%\Desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\Desktop\dashBorder_144.bmp
- %HOMEPATH%\Desktop\dashBorder_96.bmp
- %HOMEPATH%\Desktop\default.bmp
- %HOMEPATH%\Desktop\dial.bmp
- %HOMEPATH%\Desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\Desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\Desktop\Google Chrome.lnk
- %HOMEPATH%\Desktop\hanni_umami_chapter.doc
- %HOMEPATH%\Desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\Desktop\Telegram.lnk
- %HOMEPATH%\Desktop\TestCertificate.cer
- %HOMEPATH%\Desktop\tileimage.bmp
- %HOMEPATH%\Desktop\toolbar.bmp
Modifies user data files (Trojan.Encoder).