Trojan.Siggen34.19104

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'BdxAxFmBeCeY' = '"%APPDATA%\GoreSpiders\crypto_locker_pro_2d4c5w5l.exe" /gsresume'

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Reads files which store third party applications passwords

%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\iisstart.htm
%HOMEPATH%\desktop\iisstart.html
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\tree_view.html
%APPDATA%\thunderbird\profiles.ini
%APPDATA%\mozilla\firefox\profiles.ini

Modifies file system

Creates the following files

%TEMP%\gspiders.dat
%APPDATA%\gorespiders\crypto_locker_pro_2d4c5w5l.exe
%TEMP%\gs_wall.png
%TEMP%\gs_lock.ico
%HOMEPATH%\desktop\read_me_goresp.txt
%HOMEPATH%\desktop\gorespiders_readme_001.txt
%HOMEPATH%\desktop\gorespiders_readme_002.txt
%HOMEPATH%\desktop\gorespiders_readme_003.txt
%HOMEPATH%\desktop\gorespiders_readme_004.txt
%HOMEPATH%\desktop\gorespiders_readme_005.txt
%HOMEPATH%\desktop\gorespiders_readme_006.txt
%HOMEPATH%\desktop\gorespiders_readme_007.txt
%HOMEPATH%\desktop\gorespiders_readme_008.txt
%HOMEPATH%\desktop\gorespiders_readme_009.txt
%HOMEPATH%\desktop\gorespiders_readme_010.txt
%HOMEPATH%\desktop\gorespiders_readme_011.txt
%HOMEPATH%\desktop\gorespiders_readme_012.txt
%HOMEPATH%\desktop\gorespiders_readme_013.txt
%HOMEPATH%\desktop\gorespiders_readme_014.txt
%HOMEPATH%\desktop\gorespiders_readme_015.txt
%HOMEPATH%\desktop\gorespiders_readme_016.txt
%HOMEPATH%\desktop\gorespiders_readme_017.txt
%HOMEPATH%\desktop\gorespiders_readme_018.txt
%HOMEPATH%\desktop\gorespiders_readme_019.txt
%HOMEPATH%\desktop\gorespiders_readme_020.txt
%HOMEPATH%\desktop\gorespiders_readme_021.txt
%HOMEPATH%\desktop\gorespiders_readme_022.txt
%HOMEPATH%\desktop\gorespiders_readme_023.txt
%HOMEPATH%\desktop\gorespiders_readme_024.txt
%HOMEPATH%\desktop\gorespiders_readme_025.txt
%HOMEPATH%\desktop\gorespiders_readme_026.txt
%HOMEPATH%\desktop\gorespiders_readme_027.txt
%HOMEPATH%\desktop\gorespiders_readme_028.txt
%HOMEPATH%\desktop\gorespiders_readme_029.txt
%HOMEPATH%\desktop\gorespiders_readme_030.txt
%HOMEPATH%\desktop\gorespiders_readme_031.txt
%HOMEPATH%\desktop\gorespiders_readme_032.txt
%HOMEPATH%\desktop\gorespiders_readme_033.txt
%HOMEPATH%\desktop\gorespiders_readme_034.txt
%HOMEPATH%\desktop\gorespiders_readme_035.txt
%HOMEPATH%\desktop\gorespiders_readme_036.txt
%HOMEPATH%\desktop\gorespiders_readme_037.txt
%HOMEPATH%\desktop\gorespiders_readme_038.txt
%HOMEPATH%\desktop\gorespiders_readme_039.txt
%HOMEPATH%\desktop\gorespiders_readme_040.txt
%HOMEPATH%\desktop\gorespiders_readme_041.txt
%HOMEPATH%\desktop\gorespiders_readme_042.txt
%HOMEPATH%\desktop\gorespiders_readme_043.txt
%HOMEPATH%\desktop\gorespiders_readme_044.txt
%HOMEPATH%\desktop\gorespiders_readme_045.txt
%HOMEPATH%\desktop\gorespiders_readme_046.txt
%HOMEPATH%\desktop\gorespiders_readme_047.txt
%HOMEPATH%\desktop\gorespiders_readme_048.txt
%HOMEPATH%\desktop\gorespiders_readme_049.txt
%HOMEPATH%\desktop\gorespiders_readme_050.txt
%HOMEPATH%\desktop\gorespiders_readme_051.txt
%HOMEPATH%\desktop\gorespiders_readme_052.txt
%HOMEPATH%\desktop\gorespiders_readme_053.txt
%HOMEPATH%\desktop\gorespiders_readme_054.txt
%HOMEPATH%\desktop\gorespiders_readme_055.txt
%HOMEPATH%\desktop\gorespiders_readme_056.txt
%HOMEPATH%\desktop\gorespiders_readme_057.txt
%HOMEPATH%\desktop\gorespiders_readme_058.txt
%HOMEPATH%\desktop\gorespiders_readme_059.txt
%HOMEPATH%\desktop\gorespiders_readme_060.txt
%HOMEPATH%\desktop\gorespiders_readme_061.txt
%HOMEPATH%\desktop\gorespiders_readme_062.txt
%HOMEPATH%\desktop\gorespiders_readme_063.txt
%HOMEPATH%\desktop\gorespiders_readme_064.txt
%HOMEPATH%\desktop\gorespiders_readme_065.txt
%HOMEPATH%\desktop\gorespiders_readme_066.txt
%HOMEPATH%\desktop\gorespiders_readme_067.txt
%HOMEPATH%\desktop\gorespiders_readme_068.txt
%HOMEPATH%\desktop\gorespiders_readme_069.txt
%HOMEPATH%\desktop\gorespiders_readme_070.txt
%HOMEPATH%\desktop\gorespiders_readme_071.txt
%HOMEPATH%\desktop\gorespiders_readme_072.txt
%HOMEPATH%\desktop\gorespiders_readme_073.txt
%HOMEPATH%\desktop\gorespiders_readme_074.txt
%HOMEPATH%\desktop\gorespiders_readme_075.txt
%HOMEPATH%\desktop\gorespiders_readme_076.txt
%HOMEPATH%\desktop\gorespiders_readme_077.txt
%HOMEPATH%\desktop\gorespiders_readme_078.txt
%HOMEPATH%\desktop\gorespiders_readme_079.txt
%HOMEPATH%\desktop\gorespiders_readme_080.txt
%HOMEPATH%\desktop\gorespiders_readme_081.txt
%HOMEPATH%\desktop\gorespiders_readme_082.txt
%HOMEPATH%\desktop\gorespiders_readme_083.txt
%HOMEPATH%\desktop\gorespiders_readme_084.txt
%HOMEPATH%\desktop\gorespiders_readme_085.txt
%HOMEPATH%\desktop\gorespiders_readme_086.txt
%HOMEPATH%\desktop\gorespiders_readme_087.txt
%HOMEPATH%\desktop\gorespiders_readme_088.txt
%HOMEPATH%\desktop\gorespiders_readme_089.txt
%HOMEPATH%\desktop\gorespiders_readme_090.txt
%HOMEPATH%\desktop\gorespiders_readme_091.txt
%HOMEPATH%\desktop\gorespiders_readme_092.txt
%HOMEPATH%\desktop\gorespiders_readme_093.txt
%HOMEPATH%\desktop\gorespiders_readme_094.txt
%HOMEPATH%\desktop\gorespiders_readme_095.txt
%HOMEPATH%\desktop\gorespiders_readme_096.txt
%HOMEPATH%\desktop\gorespiders_readme_097.txt
%HOMEPATH%\desktop\gorespiders_readme_098.txt
%HOMEPATH%\desktop\gorespiders_readme_099.txt
%HOMEPATH%\desktop\gorespiders_readme_100.txt
%HOMEPATH%\desktop\gorespiders_readme_101.txt
%HOMEPATH%\desktop\gorespiders_readme_102.txt
%HOMEPATH%\desktop\gorespiders_readme_103.txt
%HOMEPATH%\desktop\gorespiders_readme_104.txt
%HOMEPATH%\desktop\gorespiders_readme_105.txt
%HOMEPATH%\desktop\gorespiders_readme_106.txt
%HOMEPATH%\desktop\gorespiders_readme_107.txt
%HOMEPATH%\desktop\gorespiders_readme_108.txt
%HOMEPATH%\desktop\gorespiders_readme_109.txt
%HOMEPATH%\desktop\gorespiders_readme_110.txt
%HOMEPATH%\desktop\gorespiders_readme_111.txt
%HOMEPATH%\desktop\gorespiders_readme_112.txt
%HOMEPATH%\desktop\gorespiders_readme_113.txt
%HOMEPATH%\desktop\gorespiders_readme_114.txt
%HOMEPATH%\desktop\gorespiders_readme_115.txt
%HOMEPATH%\desktop\gorespiders_readme_116.txt
%HOMEPATH%\desktop\gorespiders_readme_117.txt
%HOMEPATH%\desktop\gorespiders_readme_118.txt
%HOMEPATH%\desktop\gorespiders_readme_119.txt
%HOMEPATH%\desktop\gorespiders_readme_120.txt
%HOMEPATH%\desktop\gorespiders_readme_121.txt
%HOMEPATH%\desktop\gorespiders_readme_122.txt
%HOMEPATH%\desktop\gorespiders_readme_123.txt
%HOMEPATH%\desktop\gorespiders_readme_124.txt
%HOMEPATH%\desktop\gorespiders_readme_125.txt
%HOMEPATH%\desktop\gorespiders_readme_126.txt
%HOMEPATH%\desktop\gorespiders_readme_127.txt
%HOMEPATH%\desktop\gorespiders_readme_128.txt
%HOMEPATH%\desktop\gorespiders_readme_129.txt
%HOMEPATH%\desktop\gorespiders_readme_130.txt
%HOMEPATH%\desktop\gorespiders_readme_131.txt
%HOMEPATH%\desktop\gorespiders_readme_132.txt
%HOMEPATH%\desktop\gorespiders_readme_133.txt
%HOMEPATH%\desktop\gorespiders_readme_134.txt
%HOMEPATH%\desktop\gorespiders_readme_135.txt
%HOMEPATH%\desktop\gorespiders_readme_136.txt
%HOMEPATH%\desktop\gorespiders_readme_137.txt
%HOMEPATH%\desktop\gorespiders_readme_138.txt
%HOMEPATH%\desktop\gorespiders_readme_139.txt
%HOMEPATH%\desktop\gorespiders_readme_140.txt
%HOMEPATH%\desktop\gorespiders_readme_141.txt
%HOMEPATH%\desktop\gorespiders_readme_142.txt
%HOMEPATH%\desktop\gorespiders_readme_143.txt
%HOMEPATH%\desktop\gorespiders_readme_144.txt
%HOMEPATH%\desktop\gorespiders_readme_145.txt
%HOMEPATH%\desktop\gorespiders_readme_146.txt
%HOMEPATH%\desktop\gorespiders_readme_147.txt
%HOMEPATH%\desktop\gorespiders_readme_148.txt
%HOMEPATH%\desktop\gorespiders_readme_149.txt
%HOMEPATH%\desktop\gorespiders_readme_150.txt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\0agpuk5xe3txkb3i.gsp
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\uf1wqsz8lqhwh1y4.gsp
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\4s4b5dn70e58qsos.gsp
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\me0uzpo9iqccul8a.gsp
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\5ltlosvff7og2297.gsp
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\bq2mxchs9g6m5pbx.gsp
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\olscw32i0b6aa8x3.gsp
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\fwn2ttk5ymbgryz5.gsp
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\f1x0qmmi5inpfify.gsp
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\5xqjfk1ckzest5d2.gsp
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\i3pr439oad0obt3z.gsp
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\4ekpuw1cayow1phl.gsp
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\o8y3zirdakdrzrzf.gsp
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\q6n5bljx8px1io5j.gsp
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\jhlveyiwzpjlv31l.gsp
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\t06lonpujo1uhshr.gsp
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\c45x6zxun132oa9y.gsp
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\pf7gjch31n63zgtb.gsp
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\26oq4oxadrdhm1vq.gsp
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\58qk99ltpfg90kww.gsp
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\7yrfv6ti9cilmwof.gsp
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\edyqufcualwo9ke3.gsp
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\4l28v0kyyjcql1yh.gsp
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\hugyq57euz585f9n.gsp
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\awcsj5rmwj4czdjp.gsp
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\qtfmhfabk5bkwm3k.gsp
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\xaa5fix7h3rw0mb3.gsp
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\flenljt557j8vcsd.gsp
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\tqjutxuzkyxrvmg1.gsp
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\tw9o6kdah8dkr487.gsp
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\ooenu5juwqhwusg5.gsp
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\e5iwzi6560p1kwcy.gsp
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\frwjhkoj0q51kgno.gsp
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\rpkc9ipa5vrygdrt.gsp
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\gto62r60j6wm5stv.gsp
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\nchjfzhxnll2722t.gsp
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\z871b4m4fx1g3htt.gsp
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\8sgvzeal69zk3kqp.gsp
%ALLUSERSPROFILE%\mozilla\r6p20llxvozo58vh.gsp
%ALLUSERSPROFILE%\mozilla\4qd023w69sc30z21.gsp
%HOMEPATH%\desktop\5aqnmgrm7hi8vxjc.gsp
%HOMEPATH%\desktop\7j1ru9552bpl70sh.gsp
%HOMEPATH%\desktop\h5k6wnt4bxxxh80f.gsp
%HOMEPATH%\desktop\qsngvzwzdl2orzao.gsp
%HOMEPATH%\desktop\jysw7s5p9ramtt4r.gsp
%HOMEPATH%\desktop\2rqzyy0cxq3nzisl.gsp
%HOMEPATH%\desktop\piumsp457iufk5kc.gsp
%HOMEPATH%\desktop\ruwt7auprozf13f8.gsp
%HOMEPATH%\desktop\owjmys95oxalp7fz.gsp
%HOMEPATH%\desktop\h02jn2tvblkrmlaz.gsp
%HOMEPATH%\desktop\ro5o5kj88aj1y3ex.gsp
%HOMEPATH%\desktop\vqhb0hldtxt2yjod.gsp
%HOMEPATH%\desktop\fijvmfffqxifnosg.gsp
%HOMEPATH%\desktop\crjrhxrqhxyumqxv.gsp
%HOMEPATH%\documents\4pfnad0dki4doobb.gsp
%HOMEPATH%\documents\ji3gjfxf7m8za32m.gsp
%HOMEPATH%\documents\394sx7dlki7vnyd5.gsp
%HOMEPATH%\documents\h69m98purd86d534.gsp
%HOMEPATH%\documents\1q1jhgjylwkv99cx.gsp
%HOMEPATH%\documents\4u6aq8575gjku5ko.gsp
%HOMEPATH%\documents\b6hgejrx9bu317ug.gsp
%HOMEPATH%\documents\8gmth9k075m6zxjf.gsp
%HOMEPATH%\documents\25icf7yubmn8qog8.gsp
%HOMEPATH%\documents\3ykg9sw6gfiie6an.gsp
%HOMEPATH%\documents\lrh4nq6xa35tgua3.gsp
%HOMEPATH%\documents\jwi6zbv7ffzmh4dc.gsp
%HOMEPATH%\documents\0avaodjaztbkuuru.gsp
%HOMEPATH%\documents\2rdf8xse1481xha3.gsp
%HOMEPATH%\documents\b4nvtj5s3hgc3tzk.gsp
%HOMEPATH%\documents\xgngb2ki6c0mynac.gsp
%HOMEPATH%\documents\ykjedtq6luum9m2r.gsp
%HOMEPATH%\documents\ldk62mavth4ahgn2.gsp
%HOMEPATH%\documents\u1x47dr9zixezhri.gsp
%HOMEPATH%\documents\tp1vna6dwf82txol.gsp
%HOMEPATH%\documents\gfwjhvw8q75qr9dc.gsp
%HOMEPATH%\documents\lgivc5ftt46hwnq7.gsp
%HOMEPATH%\documents\r5vucmwm13os3od8.gsp
%HOMEPATH%\documents\uvt86rw1eqsjygym.gsp
%HOMEPATH%\documents\22e9geaz0rj5zdh9.gsp
%HOMEPATH%\documents\or4d7docm9fa891g.gsp
%HOMEPATH%\documents\k3akw5yvinu2o00w.gsp
%HOMEPATH%\documents\hjm4zba5cg1nfxmd.gsp
%HOMEPATH%\documents\891q39to3x58s8bu.gsp
%HOMEPATH%\documents\za4pt06rcyscbfhq.gsp
%HOMEPATH%\documents\acayhl0oniz63n88.gsp
%HOMEPATH%\documents\0qq9hyhi13m2d7q0.gsp
%HOMEPATH%\documents\55yaposrzhja7ur6.gsp
%HOMEPATH%\documents\24ul9nyqxtkujo6b.gsp
%HOMEPATH%\documents\15itot5e11uaitcb.gsp
%HOMEPATH%\documents\fcqn5mtq3up33y78.gsp
%HOMEPATH%\documents\s6aa3eunrcin17el.gsp
%HOMEPATH%\documents\iiahjd6o76di9m0l.gsp
%HOMEPATH%\documents\j2hrlryezxn731v2.gsp
%HOMEPATH%\documents\d7z6kv6hwr09v7r3.gsp
%HOMEPATH%\documents\dqjskdvoy2pa6n0p.gsp
%HOMEPATH%\documents\p21mbknov8aqx5qw.gsp
%HOMEPATH%\documents\jzmgjqsx82y6q0c1.gsp
%HOMEPATH%\documents\5mhxl6bjy2f17hqv.gsp
%HOMEPATH%\documents\ze9z8jzpzqt3dppq.gsp
%HOMEPATH%\documents\yh3h6yzksovhurkk.gsp
%HOMEPATH%\documents\yxr4kvq1d6zrhqk7.gsp
%HOMEPATH%\documents\e02lu8x092r466bp.gsp
%HOMEPATH%\documents\q36tib6tl0ty2ihd.gsp
%HOMEPATH%\documents\fyb2t8uqwwg70qd9.gsp
%HOMEPATH%\documents\kk0ws2ah3n6gcn27.gsp
%HOMEPATH%\documents\fmdq5eshd5wtntlh.gsp
%HOMEPATH%\documents\1yz89gjep4zgvpeb.gsp
%HOMEPATH%\documents\cpsa8wlilo8s0fdr.gsp
%HOMEPATH%\documents\hbvkeisjdzukg0q9.gsp
%HOMEPATH%\documents\1pxjpw3a7fxufoca.gsp
%HOMEPATH%\documents\xcgr4s65o33mnf2f.gsp
%HOMEPATH%\documents\rqggfdcrck065okg.gsp
%HOMEPATH%\documents\6mtsujgl1aepqh8l.gsp
%HOMEPATH%\documents\knj2gtd7q4fl9amd.gsp
%HOMEPATH%\documents\rsk2hv4pdw6x9mz8.gsp
%HOMEPATH%\documents\vp658wnqydda7n3p.gsp
%HOMEPATH%\documents\njogujdny6ftf9l9.gsp
%HOMEPATH%\documents\zjrrycxxqoiban16.gsp
%HOMEPATH%\documents\z6gp5ym94nmm6ilr.gsp
%HOMEPATH%\documents\1lr153q8eunkwl7y.gsp
%HOMEPATH%\documents\c4z45z5ic8sjlsj7.gsp
%HOMEPATH%\documents\1r7ezbjcudd0tdvs.gsp
%HOMEPATH%\documents\kegttl2qqvplg8e5.gsp
%HOMEPATH%\documents\zk8iu3ngyoo4za0c.gsp
%HOMEPATH%\documents\ohz0pvg0mpj5bjsw.gsp
%HOMEPATH%\documents\d5vgeesrbe3n7p1p.gsp
%HOMEPATH%\documents\4ojz1xillcq0fvze.gsp
%HOMEPATH%\documents\0adyh21ny21g9g7g.gsp
%HOMEPATH%\documents\wwvv3bsxkxxb6sq4.gsp
%HOMEPATH%\documents\b8qey0nsmqq25174.gsp
%HOMEPATH%\documents\9cnhmdeek047zad6.gsp
%HOMEPATH%\documents\ylqkourqfpm3x5hn.gsp
%HOMEPATH%\documents\oo7pyc08276bs69d.gsp
%HOMEPATH%\documents\8hkhmq9kqy3py1kv.gsp
%HOMEPATH%\documents\a7cbgk2neagfc3fu.gsp
%HOMEPATH%\documents\ayroqvymvvwmi471.gsp
%HOMEPATH%\documents\ayq7gtm2664xnkw1.gsp
%HOMEPATH%\documents\l5s8oca6cqhfu5yo.gsp
%HOMEPATH%\documents\l4og3pi9w641maos.gsp
%HOMEPATH%\documents\pmqa8d5an5mpu8ps.gsp
%HOMEPATH%\documents\4n8x13sojui1rqex.gsp
%HOMEPATH%\documents\a495w051s9pbrrhv.gsp
%HOMEPATH%\documents\djc7om528hynpojv.gsp
%HOMEPATH%\documents\4j4mr8p1yu77eozg.gsp
%HOMEPATH%\documents\iy1ctpt5a9u132kg.gsp
%HOMEPATH%\documents\hxvac2yu8h0yibfg.gsp
%HOMEPATH%\documents\i8hpyarotd0acxut.gsp
%HOMEPATH%\documents\67m6211i8ngqgwac.gsp
%HOMEPATH%\documents\y5wwn0luc5slqhxi.gsp
%HOMEPATH%\documents\okzfkn1v1rlm53dz.gsp
%HOMEPATH%\documents\otdq8wzge8nnxxm4.gsp
%HOMEPATH%\documents\0io5fu98bvdrg31l.gsp
%HOMEPATH%\documents\a3gafo22vzdhny74.gsp
%HOMEPATH%\documents\1tuaeclx7xvgqwu4.gsp
%HOMEPATH%\documents\fcgj980v98e2lw1z.gsp
%HOMEPATH%\documents\sdxa7hae8cbagorn.gsp
%HOMEPATH%\documents\bbg1i9741g3zxojp.gsp
%HOMEPATH%\documents\irw31a1jg15p0va5.gsp
%HOMEPATH%\documents\s1n4rih03omuwpov.gsp
%HOMEPATH%\documents\9kgkxrjhwfygcxmn.gsp
%HOMEPATH%\documents\ai853yrqdep9xkoy.gsp
%HOMEPATH%\documents\g5t2cucv742x9zd3.gsp
%HOMEPATH%\documents\l3iefqhegeux5mdq.gsp
%HOMEPATH%\documents\ocnf45knk81xekof.gsp
%HOMEPATH%\documents\sfu4nylbz1zicex6.gsp
%HOMEPATH%\documents\afl9di19mbryqpjh.gsp
%HOMEPATH%\documents\ze441c0fr3vzs4ss.gsp
%HOMEPATH%\documents\ood7gt33pya8eexi.gsp
%HOMEPATH%\documents\cokpqfqufe5jgaf8.gsp
%HOMEPATH%\documents\910dib38lujplarx.gsp
%HOMEPATH%\documents\8k156ub1fiyqgxw9.gsp
%HOMEPATH%\documents\9bxqvfoax4ettmp5.gsp
%HOMEPATH%\documents\wihjfcjwthh7e55m.gsp
%HOMEPATH%\documents\s2672w0nt3jacir3.gsp
%HOMEPATH%\documents\ffycqkff4pp9oe9s.gsp
%HOMEPATH%\documents\msneeq3rk5akztuw.gsp
%HOMEPATH%\documents\u94e9coj7oi27ilb.gsp
%HOMEPATH%\documents\hb5ghw1a5okftxci.gsp
%HOMEPATH%\documents\ner33fbn5h824w3f.gsp
%HOMEPATH%\documents\0xm0e327phyl1ujy.gsp
%HOMEPATH%\documents\l7fhnqwuzlog8k6h.gsp
%HOMEPATH%\documents\wye1vpiipoj1t6jq.gsp
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\9nn9e923m9gbelgv.gsp
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\wz7f6e9g7a88d528.gsp
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\trxgzan2ctvwr8kd.gsp
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\4lvjnwp8x3kayv6f.gsp
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\lzh9v23xyp53203r.gsp
%ALLUSERSPROFILE%\microsoft\diagnosis\z0ggx7fvndi3ncia.gsp
%ALLUSERSPROFILE%\microsoft\diagnosis\x4xmwg5gvcfv8jmd.gsp
%ALLUSERSPROFILE%\microsoft\user account pictures\1m8aexuf3bsq7ffl.gsp
%ALLUSERSPROFILE%\microsoft\user account pictures\balffy38tz97t2m1.gsp
%ALLUSERSPROFILE%\microsoft\user account pictures\puzczaebxlxi0meb.gsp
%ALLUSERSPROFILE%\microsoft\user account pictures\5di8brxb84xehbmb.gsp
%ALLUSERSPROFILE%\microsoft\user account pictures\9yq0qbn40qllo5fx.gsp
%ALLUSERSPROFILE%\microsoft\user account pictures\m1af01tkrpz39la7.gsp
%ALLUSERSPROFILE%\microsoft\user account pictures\l87z6p2nx3njq4xj.gsp
%ALLUSERSPROFILE%\microsoft\user account pictures\bx0lvyv484jj83mk.gsp
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\luim32svyyv67u0q.gsp
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\td1f1d784h14hy9t.gsp
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\owgt8bv5qm7vkbq3.gsp
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\qkq881k11ghqlrvg.gsp
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\9cfdv1ww3hy7nftn.gsp
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\shbc9e1rma8c6jhv.gsp
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\fa0o0241un9u6rcr.gsp
%ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\tr20cyhsfnfrcrq4.gsp
%ALLUSERSPROFILE%\microsoft\identitycrl\int\i9tweboj20vestva.gsp
%ALLUSERSPROFILE%\microsoft\identitycrl\production\ycl08mhz1yzb9rkm.gsp
%ALLUSERSPROFILE%\microsoft\network\downloader\yz6im6u800jq0l7a.gsp
%ALLUSERSPROFILE%\microsoft\network\downloader\2c8ecps0ixip6mzq.gsp
%ALLUSERSPROFILE%\microsoft\network\downloader\ci4u1irbnu6i5i61.gsp
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\lelz9aslad3v8sxq.gsp
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\wvxw7ehb83k78oqf.gsp
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\1jsfkn1tqo4gnoh5.gsp
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\133r0zbtvqnxr5t6.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\g1n8imbphqdi92oy.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\4c7g69ffiqmrdysl.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\3a7gbpx5e6826mry.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\yuiq38cih91grmbx.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\0v2fwe34of6pryge.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\z41onphw99s4iftj.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\s3cxayih0kxsgick.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\vdeq7lv9bet6sdki.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\n9l1w0kk337q6gbt.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\v3k684602gui6uw7.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\7kyv77s3mg5ohaxr.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\h921jgrykb4ij39n.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\56697zi3rupxzk01.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\n1aak53021rjkaoj.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\b88f44m86x717zog.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\ui8gfcr9qggqstrh.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\q3ba1dk1l15xd4d7.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\bbycdlz28ojmb8nq.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\4xmwbaybfrgy1edm.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\4qsg7o86hatei76o.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\25swgutrcc0xtrl0.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\mpd7gptxxj0f7lgn.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\pkij2zi9ksntw3qh.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\2mjtrup9jn7rrszs.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\4zzqfdnd906hvm7r.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\gu7fw885ffahfvvs.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\gaw8fmluzzss31rf.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\9j4t5d8a1jeetlb5.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\o5y2kw6ofv8oxja6.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\axmtb96gcplfh8sv.gsp
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\ugn5kl2bjgohydt0.gsp
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\lrsinblg4jex9t1j.gsp
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\dnsbrj5z4s9j777f.gsp
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\hjt37lokwn3myaqk.gsp
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\xiexvcy4wwktqcpc.gsp
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\zybcakm42hdkx7vs.gsp
%APPDATA%\thunderbird\latae9hcxpa1msy1.gsp
%APPDATA%\thunderbird\49yowd6tgu00g4my.gsp
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\sr2dh1pgrd7g0fsk.gsp
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\xzmrqmuh9x34dh2b.gsp
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\qc99c18512tk8umn.gsp
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\h68d8nl5gw9rg1i0.gsp
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\houivtfe3ngc8fup.gsp
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\90k05ouf2nac2d73.gsp
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\f6x9g5egy3e7dbmc.gsp
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\e9vhsb8qalupbjft.gsp
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\b9bhsy8obmt62wmb.gsp
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\3qc7vy0duk4t0nog.gsp
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\iabe5y8nd4tq14yl.gsp
%ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\yinp4skuzw937bee.gsp
%LOCALAPPDATA%\connecteddevicesplatform\l.user\yhk09rbf7tp15elc.gsp
%APPDATA%\mozilla\firefox\1dqx8tyjunubu1nn.gsp
%APPDATA%\mozilla\firefox\obltulbtwovieghn.gsp
%APPDATA%\opera software\opera stable\wc7xguk5rcjrt61n.gsp
%APPDATA%\opera software\opera stable\oqiz4iduyapoxmw3.gsp
%APPDATA%\opera software\opera stable\k10zxx0yt5gyb8n1.gsp
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\dkn977wsub7k9hfv.gsp
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\887v52qvix0sgjad.gsp
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\service\tlpz0g18wic63qi8.gsp
%LOCALAPPDATA%\google\chrome\application\ucfgjt1jw7e1p5ab.gsp
%LOCALAPPDATA%\google\chrome\application\4y4qbh08g8ijwlti.gsp
%LOCALAPPDATA%\packages\microsoft.windows.photos_8wekyb3d8bbwe\localstate\c1rhm3q923jeeeh1.gsp

Sets the 'hidden' attribute to the following files

%APPDATA%\gorespiders\crypto_locker_pro_2d4c5w5l.exe

Deletes following files that it created itself

%HOMEPATH%\desktop\read_me_goresp.txt

Modifies the following files

%APPDATA%\microsoft\windows\themes\transcodedwallpaper
%HOMEPATH%\desktop\google chrome.lnk
%HOMEPATH%\desktop\telegram.lnk
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db
%APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1920_1080_pos2.jpg

Miscellaneous

Searches for the following windows

ClassName: 'AutoHotkey' WindowName: '<Full path to file>'

Executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet
'<SYSTEM32>\cmd.exe' /c wmic shadowcopy delete
'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wmic shadowcopy delete' (with hidden window)

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial