Trojan.Encoder.37733

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Crypter' = '<Full path to file>'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\desktop.ini.crypter
<SYSTEM32>\tasks\updater47

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Reads files which store third party applications passwords

%APPDATA%\mozilla\firefox\profiles.ini
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\region-north-karelia.jpeg
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\ituneshelpunavailable.htm
%HOMEPATH%\desktop\iisstart.html
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\2.jpeg
%HOMEPATH%\desktop\168.jpeg
%APPDATA%\thunderbird\profiles.ini
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

%TEMP%\_mei29362\crypto.cipher._aes.pyd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00012907\10_all_music.wpl.crypter
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00012907\09_music_played_the_most.wpl.crypter
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00012907\08_video_rated_at_4_or_5_stars.wpl.crypter
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00012907\07_tv_recorded_in_the_last_week.wpl.crypter
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00012907\06_pictures_rated_4_or_5_stars.wpl.crypter
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00012907\05_pictures_taken_in_the_last_month.wpl.crypter
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00012907\04_music_played_in_the_last_month.wpl.crypter
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00012907\03_music_rated_at_4_or_5_stars.wpl.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\messages.json.crypter
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00012907\02_music_added_in_the_last_month.wpl.crypter
%LOCALAPPDATA%\microsoft\media player\localmls_3.wmdb.crypter
%LOCALAPPDATA%\microsoft\media player\currentdatabase_372.wmdb.crypter
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.crypter
%LOCALAPPDATA%\microsoft\feeds cache\vyheliuc\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\feeds cache\ps8dd3fv\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\feeds cache\ee5gs944\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\feeds cache\10eaa74g\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\feeds cache\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00012907\01_music_auto_rated_at_5_stars.wpl.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\messages.json.crypter
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00012907\11_all_pictures.wpl.crypter
%LOCALAPPDATA%\microsoft\windows mail\edb00001.log.crypter
%TEMP%\adobearm.log.crypter
%LOCALAPPDATA%\microsoft\windows sidebar\settings.ini.crypter
%LOCALAPPDATA%\microsoft\windows mail\stationery\wrinkled_paper.gif.crypter
%LOCALAPPDATA%\microsoft\windows mail\stationery\tiki.gif.crypter
%LOCALAPPDATA%\microsoft\windows mail\stationery\stucco.gif.crypter
%LOCALAPPDATA%\microsoft\windows mail\stationery\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\windows mail\stationery\connectivity.gif.crypter
%LOCALAPPDATA%\microsoft\windows mail\stationery\cave_drawings.gif.crypter
%LOCALAPPDATA%\microsoft\windows\history\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00012907\12_all_video.wpl.crypter
%LOCALAPPDATA%\microsoft\windows mail\edb.log.crypter
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\k8g8fzi3\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\3hxzo3c5\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\18w2f9z0\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\09guo5qw\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\desktop.ini.crypter
%LOCALAPPDATA%\microsoft\windows mail\backup\new\edb00001.log.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\messages.json.crypter
%TEMP%\aucheck_parser.txt.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\manifest.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\messages.json.crypter
%TEMP%\adobesfx.log.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\messages.json.crypter
%TEMP%\chrome_installer.log.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\datareporting\session-state.json.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\xulstore.json.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\user.js.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\times.json.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\sitesecurityservicestate.txt.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\sessioncheckpoints.json.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\prefs.js.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\pkcs11.txt.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\datareporting\state.json.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\handlers.json.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\extension-preferences.json.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\containers.json.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\compatibility.ini.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\broadcast-listeners.json.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\addons.json.crypter
%APPDATA%\mozilla\firefox\profiles\4biyo3ui.default\user.js.crypter
%APPDATA%\mozilla\firefox\profiles\4biyo3ui.default\times.json.crypter
%APPDATA%\mozilla\firefox\profiles.ini.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\extensions.json.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\gmp-widevinecdm\4.10.1440.18\license.txt.crypter
%APPDATA%\mozilla\firefox\profiles\e9nnxrwe.default-release\gmp-widevinecdm\4.10.1440.18\manifest.json.crypter
%APPDATA%\thunderbird\profiles.ini.crypter
%HOMEPATH%\searches\desktop.ini.crypter
%HOMEPATH%\saved games\desktop.ini.crypter
%HOMEPATH%\pictures\desktop.ini.crypter
%HOMEPATH%\music\desktop.ini.crypter
%HOMEPATH%\links\desktop.ini.crypter
%HOMEPATH%\favorites\links for united states\desktop.ini.crypter
%HOMEPATH%\favorites\links\desktop.ini.crypter
%HOMEPATH%\favorites\desktop.ini.crypter
%HOMEPATH%\downloads\desktop.ini.crypter
%HOMEPATH%\documents\desktop.ini.crypter
%HOMEPATH%\desktop\desktop.ini.crypter
%HOMEPATH%\contacts\desktop.ini.crypter
%APPDATA%\thunderbird\profiles\5sfumjqc.default\times.json.crypter
%APPDATA%\thunderbird\profiles\5sfumjqc.default\sessioncheckpoints.json.crypter
%APPDATA%\thunderbird\profiles\5sfumjqc.default\prefs.js.crypter
%APPDATA%\thunderbird\profiles\5sfumjqc.default\extensions.json.crypter
%APPDATA%\thunderbird\profiles\5sfumjqc.default\extensions.ini.crypter
%APPDATA%\thunderbird\profiles\5sfumjqc.default\compatibility.ini.crypter
%APPDATA%\thunderbird\profiles\5sfumjqc.default\addons.json.crypter
%APPDATA%\mozilla\firefox\installs.ini.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\messages.json.crypter
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.crypter
%TEMP%\dd_vcredist_x86_20220928153812_002_vcruntimeadditional_x86.log.crypter
%TEMP%\dd_vcredist_x86_20220928153812_001_vcruntimeminimum_x86.log.crypter
%TEMP%\dd_vcredist_x86_20220928153812.log.crypter
%TEMP%\dd_vcredist_x86_20220928153746.log.crypter
%TEMP%\dd_vcredist_x86_20220928153623_002_vcruntimeadditional_x86.log.crypter
%TEMP%\dd_vcredist_x86_20220928153623_001_vcruntimeminimum_x86.log.crypter
%TEMP%\dd_vcredist_x86_20220928153623.log.crypter
%TEMP%\dd_vcredist_x86_20220928153514_001_vcruntimeadditional_x86.log.crypter
%TEMP%\dd_vcredist_x86_20220928153848.log.crypter
%TEMP%\dd_vcredist_x86_20220928153514_000_vcruntimeminimum_x86.log.crypter
%TEMP%\dd_vcredist_x86_20220928153442_1_vcruntimeadditional_x86.log.crypter
%TEMP%\dd_vcredist_x86_20220928153442_0_vcruntimeminimum_x86.log.crypter
%TEMP%\dd_vcredist_x86_20220928153442.log.crypter
%TEMP%\dd_vcredist_x86_20220928153358_1_vcruntimeadditional_x86.log.crypter
%TEMP%\dd_vcredist_x86_20220928153358_0_vcruntimeminimum_x86.log.crypter
%TEMP%\dd_vcredist_x86_20220928153358.log.crypter
%TEMP%\dd_vcredistui3fd3.txt.crypter
%TEMP%\dd_vcredistmsi3fd3.txt.crypter
%TEMP%\dd_vcredist_x86_20220928153514.log.crypter
%TEMP%\jaureg.log.crypter
%TEMP%\java_install.log.crypter
%TEMP%\java_install_reg.log.crypter
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.crypter
%APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini.crypter
%APPDATA%\microsoft\windows\start menu\programs\desktop.ini.crypter
%APPDATA%\microsoft\windows\start menu\desktop.ini.crypter
%APPDATA%\microsoft\windows\sendto\desktop.ini.crypter
%APPDATA%\microsoft\windows\recent\desktop.ini.crypter
%APPDATA%\microsoft\windows\libraries\desktop.ini.crypter
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini.crypter
%APPDATA%\microsoft\internet explorer\quick launch\desktop.ini.crypter
%LOCALAPPDATA%low\sun\java\jre1.7.0_11\jre1.7.0_11.msi.crypter
%LOCALAPPDATA%low\sun\java\au\au.msi.crypter
%TEMP%\opera installer\opera_installer_20220928154402.log.crypter
%TEMP%\opera installer\opera_installer_20220928154358.log.crypter
%TEMP%\opera installer\opera_installer_20220928154356.log.crypter
%TEMP%\wmsetup.log.crypter
%TEMP%\setupexe(20220928154629a5c).log.crypter
%TEMP%\rde8a9.tmp.crypter
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_153347296-msi_vc_red.msi.txt.crypter
%TEMP%\jusched.log.crypter
%APPDATA%\microsoft\windows\start menu\programs\administrative tools\desktop.ini.crypter
%TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\manifest.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\manifest.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db.crypter
%LOCALAPPDATA%\google\chrome\application\43.0.2357.65\visualelements\splash-620x300.png.crypter
%LOCALAPPDATA%\google\chrome\application\43.0.2357.65\visualelements\smalllogo.png.crypter
%LOCALAPPDATA%\google\chrome\application\43.0.2357.65\visualelements\logo.png.crypter
%LOCALAPPDATA%\google\chrome\application\43.0.2357.65\pepperflash\manifest.json.crypter
%LOCALAPPDATA%\google\chrome\application\43.0.2357.65\installer\chrome.7z.crypter
%LOCALAPPDATA%\google\chrome\application\43.0.2357.65\extensions\external_extensions.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\000003.log.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\messages.json.crypter
%LOCALAPPDATA%\google\chrome\application\43.0.2357.65\default_apps\external_extensions.json.crypter
%LOCALAPPDATA%\google\chrome\application\43.0.2357.65\icudtl.dat.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extension state\000003.log.crypter
%HOMEPATH%\videos\desktop.ini.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\messages.json.crypter
%LOCALAPPDATA%\google\chrome\application\visualelementsmanifest.xml.crypter
%TEMP%\_mei29362\win32api.pyd
%TEMP%\_mei29362\unicodedata.pyd
%TEMP%\_mei29362\select.pyd
%TEMP%\_mei29362\pywintypes27.dll
%TEMP%\_mei29362\python27.dll
%TEMP%\_mei29362\pyexpat.pyd
%TEMP%\_mei29362\bz2.pyd
%TEMP%\_mei29362\win32file.pyd
%TEMP%\_mei29362\_ssl.pyd
%TEMP%\_mei29362\_hashlib.pyd
%TEMP%\_mei29362\main.exe.manifest
%TEMP%\_mei29362\crypto.util.strxor.pyd
%TEMP%\_mei29362\crypto.util._counter.pyd
%TEMP%\_mei29362\crypto.random.osrng.winrandom.pyd
%TEMP%\_mei29362\crypto.hash._sha256.pyd
%TEMP%\_mei29362\crypto.cipher._des3.pyd
%TEMP%\_mei29362\crypto.cipher._des.pyd
%TEMP%\_mei29362\_socket.pyd
%TEMP%\_mei29362\wx._controls_.pyd
%TEMP%\_mei29362\win32event.pyd
%TEMP%\_mei29362\wx._core_.pyd
%LOCALAPPDATA%\google\chrome\application\debug.log.crypter
%TEMP%\_mei29362\wxmsw30u_xrc_vc90.dll
%LOCALAPPDATA%\iconcache.db.crypter
%HOMEPATH%\ntuser.ini.crypter
<Current directory>\key.txt
%TEMP%\_mei29362\runtime.cfg
%TEMP%\_mei29362\lock.ico
%TEMP%\_mei29362\lock.bmp
%TEMP%\_mei29362\bitcoin.bmp
%TEMP%\_mei29362\include\pyconfig.h
%TEMP%\_mei29362\wxmsw30u_html_vc90.dll
%TEMP%\_mei29362\wx._gdi_.pyd
%TEMP%\_mei29362\wxmsw30u_core_vc90.dll
%TEMP%\_mei29362\wxmsw30u_adv_vc90.dll
%TEMP%\_mei29362\wxbase30u_xml_vc90.dll
%TEMP%\_mei29362\wxbase30u_vc90.dll
%TEMP%\_mei29362\wxbase30u_net_vc90.dll
%TEMP%\_mei29362\wx._xrc.pyd
%TEMP%\_mei29362\wx._windows_.pyd
%TEMP%\_mei29362\wx._misc_.pyd
%LOCALAPPDATA%\google\chrome\application\43.0.2357.65\secondarytile.png.crypter
%APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\manifest.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\manifest.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\messages.json.crypter
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\messages.json.crypter
%APPDATA%\encrypted_files.txt

Deletes the following files

<SYSTEM32>\tasks\updater47

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_idx.db
%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_32.db
%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_96.db
%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_256.db
%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_1024.db
%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_sr.db

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c "schtasks /create /tn updater47 /sc once /sd 01/01/1901 /tr "vssadmin Delete Shadows /All /Quiet" /st 00:00 /rl highest /ru SYSTEM /f"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "schtasks /run /i /tn updater47"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "schtasks /delete /tn updater47 /f"' (with hidden window)
'<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet' (with hidden window)

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c "schtasks /create /tn updater47 /sc once /sd 01/01/1901 /tr "vssadmin Delete Shadows /All /Quiet" /st 00:00 /rl highest /ru SYSTEM /f"
'<SYSTEM32>\schtasks.exe' /create /tn updater47 /sc once /sd 01/01/1901 /tr "vssadmin Delete Shadows /All /Quiet" /st 00:00 /rl highest /ru SYSTEM /f
'<SYSTEM32>\cmd.exe' /c "schtasks /run /i /tn updater47"
'<SYSTEM32>\schtasks.exe' /run /i /tn updater47
'<SYSTEM32>\cmd.exe' /c "schtasks /delete /tn updater47 /f"
'<SYSTEM32>\schtasks.exe' /delete /tn updater47 /f

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial