Trojan.Encoder.43595

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'CleanupEncryptor' = 'cmd.exe /C "<Current directory>\cleanup_after_restart.bat"'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\desktop.ini.sucka
%APPDATA%\microsoft\windows\start menu\programs\startup\decryptor.lnk

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Reads files which store third party applications passwords

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\iisstart.htm
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\trivial-merge.htm
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\weeklysheet1215.doc
%APPDATA%\mozilla\firefox\profiles.ini
%APPDATA%\opera software\opera stable\login data
%APPDATA%\thunderbird\profiles.ini

Modifies file system

Creates the following files

%HOMEPATH%\pictures\desktop.ini.sucka
%HOMEPATH%\pictures\camera roll\desktop.ini.sucka
%HOMEPATH%\documents\desktop.ini.sucka
%HOMEPATH%\music\desktop.ini.sucka
%HOMEPATH%\videos\desktop.ini.sucka
%HOMEPATH%\downloads\desktop.ini.sucka
%HOMEPATH%\desktop\alert.html.sucka
%HOMEPATH%\desktop\browse.htm.sucka
%HOMEPATH%\desktop\contoso.cer.sucka
%HOMEPATH%\desktop\contosoroot_1.cer.sucka
%HOMEPATH%\desktop\000814251_video_01.avi.sucka
%HOMEPATH%\desktop\desktop.ini.sucka
%HOMEPATH%\desktop\google chrome.lnk.sucka
%HOMEPATH%\desktop\dotnetfx45_full_setup.exe.sucka
%HOMEPATH%\desktop\telegram.lnk.sucka
%HOMEPATH%\desktop\winmine.exe.sucka
C:\users\public\documents\desktop.ini.sucka
%HOMEPATH%\desktop\utorrent.exe.sucka
%APPDATA%\microsoft\bibliography\style\apasixtheditionofficeonline.xsl.sucka
%APPDATA%\microsoft\bibliography\style\chicago.xsl.sucka
%APPDATA%\microsoft\bibliography\style\gb.xsl.sucka
%APPDATA%\microsoft\bibliography\style\gostname.xsl.sucka
%HOMEPATH%\desktop\wrar520.exe.sucka
%HOMEPATH%\desktop\tcm851ax32.exe.sucka
%APPDATA%\microsoft\bibliography\style\gosttitle.xsl.sucka
%APPDATA%\microsoft\bibliography\style\ieee2006officeonline.xsl.sucka
%APPDATA%\microsoft\bibliography\style\harvardanglia2008officeonline.xsl.sucka
%APPDATA%\microsoft\bibliography\style\iso690nmerical.xsl.sucka
%APPDATA%\microsoft\bibliography\style\iso690.xsl.sucka
%APPDATA%\microsoft\bibliography\style\sist02.xsl.sucka
%APPDATA%\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl.sucka
%APPDATA%\microsoft\crypto\keys\de7cf8a7901d2ad13e5c67c29e5d1662_8cf7b530-613e-439b-a8c5-ccfc0e745400.sucka
%APPDATA%\microsoft\internet explorer\quick launch\desktop.ini.sucka
%APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.sucka
%APPDATA%\microsoft\internet explorer\quick launch\microsoft edge.lnk.sucka
%APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.sucka
%APPDATA%\microsoft\bibliography\style\turabian.xsl.sucka
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\f58155b4b1d5a524ca0261c3ee99fb50_8cf7b530-613e-439b-a8c5-ccfc0e745400.sucka
%APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.sucka
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\file explorer.lnk.sucka
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini.sucka
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\microsoft edge.lnk.sucka
%APPDATA%\microsoft\office\mso1033.acl.sucka
%APPDATA%\microsoft\protect\credhist.sucka
%APPDATA%\microsoft\office\recent\templates.lnk.sucka
%APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\38ccf745-2ede-4301-8248-5a19e1f1901a.sucka
%APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\75d71836-8e2e-47dd-96e0-d8afa5b360d8.sucka
%APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\preferred.sucka
%APPDATA%\microsoft\uproof\custom.dic.sucka
%APPDATA%\microsoft\templates\~$normal.dotm.sucka
%APPDATA%\microsoft\windows\accountpictures\desktop.ini.sucka
%APPDATA%\microsoft\templates\normal.dotm.sucka
%APPDATA%\microsoft\windows\libraries\desktop.ini.sucka
%APPDATA%\microsoft\windows\libraries\cameraroll.library-ms.sucka
%APPDATA%\microsoft\windows\libraries\documents.library-ms.sucka
%APPDATA%\microsoft\windows\libraries\music.library-ms.sucka
%APPDATA%\microsoft\windows\libraries\pictures.library-ms.sucka
%APPDATA%\microsoft\windows\libraries\videos.library-ms.sucka
%APPDATA%\microsoft\windows\recent\automaticdestinations\5f7b5f1e01b83767.automaticdestinations-ms.sucka
%APPDATA%\microsoft\windows\recent\automaticdestinations\6824f4a902c78fbd.automaticdestinations-ms.sucka
%APPDATA%\microsoft\windows\recent\automaticdestinations\f01b4d95cf55d32a.automaticdestinations-ms.sucka
%APPDATA%\microsoft\windows\recent\automaticdestinations\f8f05350c84c9d76.automaticdestinations-ms.sucka
%APPDATA%\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms.sucka
%APPDATA%\microsoft\windows\recent\customdestinations\4ee0ff9da153c9a7.customdestinations-ms.sucka
%APPDATA%\microsoft\windows\recent\customdestinations\5cc8a0f642693576.customdestinations-ms.sucka
%APPDATA%\microsoft\windows\recent\customdestinations\6824f4a902c78fbd.customdestinations-ms.sucka
%APPDATA%\microsoft\windows\recent\customdestinations\7e4dca80246863e3.customdestinations-ms.sucka
%APPDATA%\microsoft\windows\recent\customdestinations\f01b4d95cf55d32a.customdestinations-ms.sucka
%APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.sucka
%APPDATA%\microsoft\windows\sendto\bluetooth file transfer.lnk.sucka
%APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.sucka
%APPDATA%\microsoft\windows\sendto\desktop.ini.sucka
%APPDATA%\microsoft\windows\recent\desktop.ini.sucka
%APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.sucka
%APPDATA%\microsoft\windows\sendto\fax recipient.lnk.sucka
%APPDATA%\microsoft\windows\start menu\desktop.ini.sucka
%APPDATA%\microsoft\windows\start menu\programs\accessibility\desktop.ini.sucka
%APPDATA%\microsoft\windows\start menu\programs\accessibility\magnify.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\accessibility\narrator.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\accessibility\on-screen keyboard.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\desktop.ini.sucka
%APPDATA%\microsoft\windows\start menu\programs\administrative tools\desktop.ini.sucka
%APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini.sucka
%APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini.sucka
%APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\accessories\internet explorer.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\onedrive.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\system tools\administrative tools.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\system tools\computer.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\system tools\command prompt.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\system tools\control panel.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\system tools\file explorer.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\system tools\desktop.ini.sucka
%APPDATA%\microsoft\windows\start menu\programs\system tools\run.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\windows powershell\windows powershell (x86).lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\windows powershell\windows powershell.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.sucka
%APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk.sucka
%APPDATA%\microsoft\word\~wra0003.wbk.sucka
%APPDATA%\mozilla\firefox\crash reports\installtime20210823123856.sucka
%APPDATA%\mozilla\firefox\installs.ini.sucka
%APPDATA%\microsoft\windows\themes\transcodedwallpaper.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addons.json.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addonstartup.json.lz4.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\broadcast-listeners.json.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\compatibility.ini.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\containers.json.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\bookmarkbackups\bookmarks-2025-10-27_11_kx2i12ignwmokjfhtrtlyq==.jsonlz4.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cookies.sqlite.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cookies.sqlite-shm.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\store.json.mozlz4.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186024.607ca866-e4d6-4cd9-8292-f41050b95703.new-profile.jsonlz4.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\content-prefs.sqlite.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186237.f25f5a62-89ef-4fa6-bcd1-17fb20e245e0.event.jsonlz4.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186300.bf64c134-4580-4cec-a821-b1c0a18188bf.main.jsonlz4.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186304.df151785-6317-4a9b-a34f-33db9e13ed66.first-shutdown.jsonlz4.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\db\data.safe.bin.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\session-state.json.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\state.json.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extension-preferences.json.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions.json.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\favicons.sqlite-shm.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\handlers.json.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\formhistory.sqlite.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\places.sqlite-shm.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\607ca866-e4d6-4cd9-8292-f41050b95703.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\bf64c134-4580-4cec-a821-b1c0a18188bf.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\df151785-6317-4a9b-a34f-33db9e13ed66.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\f25f5a62-89ef-4fa6-bcd1-17fb20e245e0.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search.json.mozlz4.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessioncheckpoints.json.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\previous.jsonlz4.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.baklz4.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.jsonlz4.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\upgrade.jsonlz4-20210823123856.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shield-preference-experiments.json.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\.metadata-v2.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\.metadata-v2.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage.sqlite.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\times.json.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\webappsstore.sqlite.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\webappsstore.sqlite-shm.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\xulstore.json.sucka
%APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\times.json.sucka
%APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.sucka
%APPDATA%\mozilla\firefox\profiles.ini.sucka
%APPDATA%\opera software\opera stable\91bb.tmp.sucka
%APPDATA%\opera software\opera stable\bookmarks.sucka
%APPDATA%\opera software\opera stable\current session.sucka
%APPDATA%\opera software\opera stable\default_partner_content.json.sucka
%APPDATA%\opera software\opera stable\extension state\000003.log.sucka
%APPDATA%\opera software\opera stable\extension state\current.sucka
%APPDATA%\opera software\opera stable\extension state\log.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\favicons.sqlite.sucka
%APPDATA%\opera software\opera stable\extension state\manifest-000001.sucka
%APPDATA%\opera software\opera stable\favicons.sucka
%APPDATA%\opera software\opera stable\history.sucka
%APPDATA%\opera software\opera stable\history-journal.sucka
%APPDATA%\opera software\opera stable\local state.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\places.sqlite.sucka
%APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage.sucka
%APPDATA%\opera software\opera stable\opera_autoupdate.log.sucka
%APPDATA%\opera software\opera stable\login data.sucka
%APPDATA%\opera software\opera stable\network persistent state.sucka
%APPDATA%\opera software\opera stable\ssdfp1252.6.1555693585.sucka
%APPDATA%\opera software\opera stable\ssdfp1252.0.1802400714.sucka
%APPDATA%\opera software\opera stable\preferences.sucka
%APPDATA%\opera software\opera stable\update_prefs.json.sucka
%APPDATA%\opera software\opera stable\transportsecurity.sucka
%APPDATA%\opera software\opera stable\web data.sucka
%APPDATA%\opera software\opera stable\visited links.sucka
%APPDATA%\telegram desktop\updater.exe.sucka
%APPDATA%\thunderbird\crash reports\installtime20210406220621.sucka
%APPDATA%\thunderbird\installs.ini.sucka
%APPDATA%\thunderbird\profiles\b376zl1q.default\times.json.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\abook.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addons.json.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addonstartup.json.lz4.sucka
%APPDATA%\telegram desktop\unins000.exe.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\compatibility.ini.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\blist.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cookies.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1df428.new-profile.jsonlz4.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb050509c4.main.jsonlz4.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\session-state.json.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.first-shutdown.jsonlz4.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\state.json.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\directorytree.json.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\enigmail.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extension-preferences.json.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions.json.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\formhistory.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\global-messages-db.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\history.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\openpgp.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\permissions.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.sucka
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\search.json.mozlz4.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sessioncheckpoints.json.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\times.json.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\favicons.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\webappsstore.sqlite.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\xulstore.json.sucka
%HOMEPATH%\favorites\bing.url.sucka
%APPDATA%\thunderbird\profiles.ini.sucka
%HOMEPATH%\favorites\links\desktop.ini.sucka
%HOMEPATH%\favorites\desktop.ini.sucka
%HOMEPATH%\links\desktop.ini.sucka
%HOMEPATH%\links\desktop.lnk.sucka
%HOMEPATH%\links\downloads.lnk.sucka
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite.sucka
%APPDATA%\telegram desktop\telegram.exe.sucka
<Current directory>\decryptor.exe
<Current directory>\delete_encryptor.bat
<Current directory>\cleanup_after_restart.bat
%LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
\device\harddiskvolume1\boot\bcd.log
\device\harddiskvolume1\boot\bcd

Substitutes the following files

%APPDATA%\Microsoft\Windows\Themes\CachedFiles\CachedImage_1152_864_POS2.jpg
%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'as#####ad-1v6.pages.dev':443

TCP

Other

'as#####ad-1v6.pages.dev':443

UDP

DNS ASK as#####ad-1v6.pages.dev

Miscellaneous

Creates and executes the following

'<Current directory>\decryptor.exe'

Attempts to shut down the Windows operating system.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial