Trojan.Encoder.41488

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\read_me_to_access.txt

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

deletes volume shadow copies.

Terminates or attempts to terminate

the following user processes:

firefox.exe

Modifies file system

Creates the following files

C:\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\29\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\3\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\30\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\31\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\33\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\34\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\35\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\36\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\37\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\38\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\4\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\40\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\41\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\42\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\43\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\44\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\45\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\46\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\47\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\48\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\49\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\5\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\50\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\51\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\52\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\28\read_me_to_access.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\safebrowsing\google4\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\27\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\24\read_me_to_access.txt
%LOCALAPPDATA%low\read_me_to_access.txt
%LOCALAPPDATA%low\oracle\read_me_to_access.txt
%LOCALAPPDATA%low\oracle\java\read_me_to_access.txt
%LOCALAPPDATA%low\oracle\java\au\read_me_to_access.txt
%LOCALAPPDATA%low\sun\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\0\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\10\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\11\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\12\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\13\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\14\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\15\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\16\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\17\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\18\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\19\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\2\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\20\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\21\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\22\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\23\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\25\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\26\read_me_to_access.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\startupcache\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\53\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\57\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\minidumps\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\default\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\read_me_to_access.txt
%HOMEPATH%\contacts\read_me_to_access.txt
C:\users\default\appdata\roaming\read_me_to_access.txt
%HOMEPATH%\desktop\read_me_to_access.txt
%HOMEPATH%\documents\read_me_to_access.txt
%HOMEPATH%\favorites\read_me_to_access.txt
%HOMEPATH%\favorites\links\read_me_to_access.txt
%HOMEPATH%\favorites\links for united states\read_me_to_access.txt
%HOMEPATH%\favorites\microsoft websites\read_me_to_access.txt
%HOMEPATH%\favorites\windows live\read_me_to_access.txt
%HOMEPATH%\favorites\msn websites\read_me_to_access.txt
%HOMEPATH%\links\read_me_to_access.txt
%HOMEPATH%\music\read_me_to_access.txt
%HOMEPATH%\pictures\read_me_to_access.txt
%HOMEPATH%\saved games\read_me_to_access.txt
%HOMEPATH%\searches\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\55\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\54\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\58\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\59\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\6\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\60\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\61\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\62\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\63\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\7\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\8\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\9\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\host\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\muffin\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\security\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\read_me_to_access.txt
%APPDATA%\read_me_to_access.txt
%APPDATA%\identities\read_me_to_access.txt
%APPDATA%\identities\{1bba5dcd-58f3-46ae-861d-68cf42722c36}\read_me_to_access.txt
%APPDATA%\media center programs\read_me_to_access.txt
%APPDATA%\telegram desktop\read_me_to_access.txt
%APPDATA%\thunderbird\read_me_to_access.txt
%APPDATA%\thunderbird\crash reports\read_me_to_access.txt
%APPDATA%\thunderbird\crash reports\events\read_me_to_access.txt
%APPDATA%\thunderbird\pending pings\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\dm02c46v.default\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\read_me_to_access.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\56\read_me_to_access.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\events\read_me_to_access.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\safebrowsing\read_me_to_access.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\cache2\entries\read_me_to_access.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\cache2\doomed\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\vcruntimeadditional_amd64\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\read_me_to_access.txt
C:\kms\read_me_to_access.txt
C:\perflogs\read_me_to_access.txt
%ALLUSERSPROFILE%\read_me_to_access.txt
%ALLUSERSPROFILE%\adobe\read_me_to_access.txt
%ALLUSERSPROFILE%\adobe\setup\read_me_to_access.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\read_me_to_access.txt
C:\perflogs\admin\read_me_to_access.txt
%ALLUSERSPROFILE%\microsoft help\read_me_to_access.txt
%ALLUSERSPROFILE%\oracle\read_me_to_access.txt
%ALLUSERSPROFILE%\oracle\java\read_me_to_access.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\read_me_to_access.txt
%ALLUSERSPROFILE%\oracle\java\javapath\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\read_me_to_access.txt
C:\users\public\libraries\read_me_to_access.txt
C:\users\public\music\sample music\read_me_to_access.txt
C:\users\public\pictures\sample pictures\read_me_to_access.txt
C:\users\public\recorded tv\read_me_to_access.txt
C:\users\public\recorded tv\sample media\read_me_to_access.txt
C:\users\public\videos\read_me_to_access.txt
C:\users\public\videos\sample videos\read_me_to_access.txt
%HOMEPATH%\read_me_to_access.txt
%HOMEPATH%\appdata\read_me_to_access.txt
%LOCALAPPDATA%\read_me_to_access.txt
%LOCALAPPDATA%\microsoft help\read_me_to_access.txt
%LOCALAPPDATA%\programs\read_me_to_access.txt
%LOCALAPPDATA%\programs\common\read_me_to_access.txt
%TEMP%\read_me_to_access.txt
%TEMP%\hsperfdata_user\read_me_to_access.txt
%TEMP%\low\read_me_to_access.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\read_me_to_access.txt
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_10.0.30319\read_me_to_access.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\read_me_to_access.txt
%TEMP%\opera installer\read_me_to_access.txt
%TEMP%\wpdnse\read_me_to_access.txt
%LOCALAPPDATA%\thunderbird\read_me_to_access.txt
%LOCALAPPDATA%\thunderbird\profiles\read_me_to_access.txt
%LOCALAPPDATA%\thunderbird\profiles\dm02c46v.default\read_me_to_access.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\read_me_to_access.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\cache2\read_me_to_access.txt
C:\users\public\music\read_me_to_access.txt
C:\users\public\favorites\read_me_to_access.txt
C:\users\public\pictures\read_me_to_access.txt
C:\users\public\downloads\read_me_to_access.txt
C:\users\public\documents\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\vcruntimeminimum_amd64\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\read_me_to_access.txt
%ALLUSERSPROFILE%\sun\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\read_me_to_access.txt
%ALLUSERSPROFILE%\sun\java\read_me_to_access.txt
%ALLUSERSPROFILE%\sun\java\java update\read_me_to_access.txt
C:\recovery\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\read_me_to_access.txt
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\read_me_to_access.txt
C:\users\read_me_to_access.txt
<Current directory>\read_me_to_access.txt
C:\users\default\appdata\read_me_to_access.txt
C:\users\default\appdata\local\read_me_to_access.txt
%HOMEPATH%\videos\read_me_to_access.txt
%HOMEPATH%\downloads\read_me_to_access.txt
C:\users\default\appdata\local\temp\read_me_to_access.txt
C:\users\default\appdata\roaming\media center programs\read_me_to_access.txt
C:\users\default\desktop\read_me_to_access.txt
C:\users\default\documents\read_me_to_access.txt
C:\users\default\downloads\read_me_to_access.txt
C:\users\default\favorites\read_me_to_access.txt
C:\users\default\links\read_me_to_access.txt
C:\users\default\music\read_me_to_access.txt
C:\users\default\pictures\read_me_to_access.txt
C:\users\default\saved games\read_me_to_access.txt
C:\users\default\videos\read_me_to_access.txt
C:\users\public\read_me_to_access.txt
C:\users\public\desktop\read_me_to_access.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\read_me_to_access.txt
C:\users\default\read_me_to_access.txt
D:\read_me_to_access.txt

Moves the following files

from %TEMP%\wallpaper.bmp to %TEMP%\wallpaper.bmp.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.aptlock
from %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json to %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.aptlock
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json.aptlock
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.aptlock

Modifies the following files

%ALLUSERSPROFILE%\microsoft help\ms.infopath.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.aptlock
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\state.rsm.aptlock
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.setlang.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.powerpnt.dev.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\nslist.hxl.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.powerpnt.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.ois.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.onenote.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\state.rsm.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.outlook.dev.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.mspub.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.outlook.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.mstore.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.msouc.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.msaccess.dev.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.groove.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.msaccess.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.infopatheditor.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\hx.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.graph.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\microsoft help\ms.mspub.dev.14.1033.hxn.aptlock
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.aptlock

Modifies multiple files.

Substitutes the following files

%TEMP%\~DFCBAEADCC01E89DFB.TMP
%TEMP%\~DFD010F0E759AEEEDC.TMP
%TEMP%\~DFE0ED2EB527EFF004.TMP
%TEMP%\~DFF3E38FF2EC9408C6.TMP

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /c wmic SHADOWCOPY DELETE
'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet
'<SYSTEM32>\cmd.exe' /c bcdedit / set{ default } recoveryenabled No
'<SYSTEM32>\cmd.exe' /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures
'<SYSTEM32>\bcdedit.exe' / set{ default } bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c wmic SHADOWCOPY DELETE' (with hidden window)
'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet' (with hidden window)
'<SYSTEM32>\cmd.exe' /c bcdedit / set{ default } recoveryenabled No' (with hidden window)
'<SYSTEM32>\cmd.exe' /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures' (with hidden window)

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial