Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SoftWare\Microsoft\Windows\CurrentVersion\Run] 'Windows SmartScreen' = '"%PROGRAMDATA%\MicroSoftWare\SmartScreen\SmartScreen.exe"'
- [<HKCU>\SoftWare\Microsoft\Windows\CurrentVersion\Run] 'Windows SmartScreen Updater' = '"<Full path to file>"'
Creates the following files on removable media
- <Drive name for removable media>:\wbva.niv.cryptoshield
- <Drive name for removable media>:\fcyvg.niv.cryptoshield
- <Drive name for removable media>:\qnfuobeqre_120.ozc.cryptoshield
- <Drive name for removable media>:\pbssrr.ozc.cryptoshield
- <Drive name for removable media>:\qnfuobeqre_96.ozc.cryptoshield
- <Drive name for removable media>:\qnfuobeqre_144.ozc.cryptoshield
- <Drive name for removable media>:\pbagbfb_1.pre.cryptoshield
- <Drive name for removable media>:\pbagbfbebbg_1.pre.cryptoshield
- <Drive name for removable media>:\czq.pre.cryptoshield
- <Drive name for removable media>:\fqxfnzcyrceviqrirybcre.pre.cryptoshield
- <Drive name for removable media>:\pbagbfb.pre.cryptoshield
- <Drive name for removable media>:\grfgrr.pre.cryptoshield
- <Drive name for removable media>:\fqxfnzcyrhaceviqrirybcre.pre.cryptoshield
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\pmd.cer
Modifies file system
Creates the following files
- %PROGRAMDATA%\microsoftware\smartscreen\smartscreen.exe
- C:\users\default\recent\# restoring files #.txt
- C:\users\default\recent\# restoring files #.html
- C:\users\default\printhood\# restoring files #.txt
- C:\users\default\printhood\# restoring files #.html
- C:\users\default\nethood\# restoring files #.txt
- C:\users\default\nethood\# restoring files #.html
- C:\users\default\local settings\# restoring files #.txt
- C:\users\default\local settings\# restoring files #.html
- C:\users\default\links\# restoring files #.txt
- C:\users\default\links\# restoring files #.html
- C:\users\default\favorites\# restoring files #.txt
- C:\users\default\favorites\# restoring files #.html
- C:\users\default\downloads\# restoring files #.txt
- C:\users\default\downloads\# restoring files #.html
- C:\users\default\documents\my videos\# restoring files #.txt
- C:\users\default\documents\my videos\# restoring files #.html
- C:\users\default\documents\my pictures\# restoring files #.txt
- C:\users\default\documents\my pictures\# restoring files #.html
- C:\users\default\documents\my music\# restoring files #.txt
- C:\users\default\saved games\# restoring files #.html
- C:\users\default\saved games\# restoring files #.txt
- C:\users\default\sendto\# restoring files #.html
- C:\users\default\sendto\# restoring files #.txt
- C:\users\public\music\sample music\sbyqre.wct.cryptoshield
- C:\users\public\music\sample music\nyohzneg_{5sn05q35-n682-4ns6-96s7-0773r42q4q16}_fznyy.wct.cryptoshield
- C:\users\public\music\sample music\nyohzneg_{5sn05q35-n682-4ns6-96s7-0773r42q4q16}_ynetr.wct.cryptoshield
- C:\users\public\music\sample music\nyohznegfznyy.wct.cryptoshield
- C:\users\public\libraries\# restoring files #.txt
- C:\users\public\libraries\# restoring files #.html
- C:\users\public\downloads\# restoring files #.txt
- C:\users\public\downloads\# restoring files #.html
- C:\users\public\documents\my videos\# restoring files #.txt
- C:\users\public\documents\my pictures\# restoring files #.txt
- C:\users\public\documents\my videos\# restoring files #.html
- C:\users\public\documents\my pictures\# restoring files #.html
- C:\users\public\documents\my music\# restoring files #.txt
- C:\users\public\documents\my music\# restoring files #.html
- C:\users\public\# restoring files #.txt
- C:\users\public\# restoring files #.html
- C:\users\default\templates\# restoring files #.txt
- C:\users\default\templates\# restoring files #.html
- C:\users\default\start menu\# restoring files #.txt
- C:\users\default\start menu\# restoring files #.html
- C:\users\public\music\sample music\xnyvzon.zc3.cryptoshield
- C:\users\default\documents\my music\# restoring files #.html
- C:\users\default\documents\# restoring files #.txt
- C:\users\default\documents\# restoring files #.html
- C:\users\all users\oracle\java\javapath\# restoring files #.html
- C:\users\all users\oracle\java\installcache_x64\# restoring files #.txt
- C:\users\all users\oracle\java\installcache_x64\# restoring files #.html
- C:\users\all users\oracle\java\# restoring files #.txt
- C:\users\all users\oracle\java\# restoring files #.html
- C:\users\all users\oracle\# restoring files #.txt
- C:\users\all users\oracle\# restoring files #.html
- C:\users\all users\mozilla\logs\# restoring files #.txt
- C:\users\all users\mozilla\logs\# restoring files #.html
- C:\users\all users\mozilla\# restoring files #.txt
- C:\users\all users\mozilla\# restoring files #.html
- C:\users\all users\microsoftware\# restoring files #.txt
- C:\users\all users\microsoftware\# restoring files #.html
- C:\users\all users\microsoft toolkit\# restoring files #.txt
- C:\users\all users\microsoft toolkit\# restoring files #.html
- C:\users\all users\microsoft help\# restoring files #.txt
- C:\users\all users\microsoft help\# restoring files #.html
- C:\users\all users\microsoft\# restoring files #.txt
- C:\users\all users\microsoft\# restoring files #.html
- C:\users\all users\oracle\java\javapath\# restoring files #.txt
- C:\users\all users\package cache\# restoring files #.html
- C:\users\all users\package cache\# restoring files #.txt
- C:\users\all users\start menu\# restoring files #.html
- C:\users\default\desktop\# restoring files #.html
- C:\users\default\cookies\# restoring files #.txt
- C:\users\default\cookies\# restoring files #.html
- C:\users\default\application data\# restoring files #.txt
- C:\users\default\application data\# restoring files #.html
- C:\users\default\appdata\# restoring files #.txt
- C:\users\default\appdata\# restoring files #.html
- C:\users\default\# restoring files #.txt
- C:\users\default\# restoring files #.html
- C:\users\all users\templates\# restoring files #.txt
- C:\users\default\aghfre.qng.cryptoshield
- C:\users\all users\templates\# restoring files #.html
- C:\users\all users\sun\java\java update\# restoring files #.txt
- C:\users\all users\sun\java\java update\# restoring files #.html
- C:\users\all users\sun\java\java update\wnhertyvfg.kzy.cryptoshield
- C:\users\all users\sun\java\# restoring files #.txt
- C:\users\all users\sun\java\# restoring files #.html
- C:\users\all users\sun\# restoring files #.txt
- C:\users\all users\sun\# restoring files #.html
- C:\users\all users\start menu\# restoring files #.txt
- C:\users\default\desktop\# restoring files #.txt
- C:\users\public\music\sample music\znvq jvgu gur synkra unve.zc3.cryptoshield
- C:\users\public\music\sample music\fyrrc njnl.zc3.cryptoshield
- C:\users\public\music\sample music\# restoring files #.html
- %HOMEPATH%\local settings\# restoring files #.html
- %HOMEPATH%\links\# restoring files #.txt
- %HOMEPATH%\links\# restoring files #.html
- %HOMEPATH%\favorites\windows live\# restoring files #.txt
- %HOMEPATH%\favorites\windows live\# restoring files #.html
- %HOMEPATH%\favorites\msn websites\# restoring files #.txt
- %HOMEPATH%\favorites\msn websites\# restoring files #.html
- %HOMEPATH%\favorites\microsoft websites\# restoring files #.txt
- %HOMEPATH%\favorites\microsoft websites\# restoring files #.html
- %HOMEPATH%\favorites\links for united states\# restoring files #.html
- %HOMEPATH%\nethood\# restoring files #.html
- %HOMEPATH%\favorites\links\# restoring files #.txt
- %HOMEPATH%\favorites\links\# restoring files #.html
- %HOMEPATH%\favorites\# restoring files #.txt
- %HOMEPATH%\favorites\# restoring files #.html
- %HOMEPATH%\downloads\# restoring files #.txt
- %HOMEPATH%\downloads\# restoring files #.html
- %HOMEPATH%\documents\my videos\# restoring files #.txt
- %HOMEPATH%\documents\my videos\# restoring files #.html
- %HOMEPATH%\favorites\links for united states\# restoring files #.txt
- D:\$recycle.bin\# restoring files #.txt
- %HOMEPATH%\nethood\# restoring files #.txt
- D:\$recycle.bin\# restoring files #.html
- D:\# restoring files #.txt
- D:\# restoring files #.html
- %WINDIR%\# restoring files #.txt
- %WINDIR%\# restoring files #.html
- %HOMEPATH%\voip\# restoring files #.txt
- %HOMEPATH%\voip\# restoring files #.html
- %HOMEPATH%\templates\# restoring files #.txt
- %HOMEPATH%\templates\# restoring files #.html
- %HOMEPATH%\documents\my pictures\# restoring files #.txt
- %HOMEPATH%\local settings\# restoring files #.txt
- %HOMEPATH%\sendto\# restoring files #.txt
- %HOMEPATH%\sendto\# restoring files #.html
- %HOMEPATH%\searches\# restoring files #.txt
- %HOMEPATH%\searches\# restoring files #.html
- %HOMEPATH%\saved games\# restoring files #.txt
- %HOMEPATH%\saved games\# restoring files #.html
- %HOMEPATH%\recent\# restoring files #.txt
- %HOMEPATH%\recent\# restoring files #.html
- %HOMEPATH%\printhood\# restoring files #.txt
- %HOMEPATH%\start menu\# restoring files #.html
- %HOMEPATH%\printhood\# restoring files #.html
- %HOMEPATH%\documents\my pictures\# restoring files #.html
- %HOMEPATH%\documents\my music\# restoring files #.txt
- %HOMEPATH%\documents\my music\# restoring files #.html
- C:\users\public\pictures\sample pictures\# restoring files #.html
- %HOMEPATH%\# restoring files #.html
- C:\users\public\videos\sample videos\# restoring files #.txt
- C:\users\public\videos\sample videos\# restoring files #.html
- C:\users\public\videos\sample videos\jvyqyvsr.jzi.cryptoshield
- C:\users\public\recorded tv\sample media\# restoring files #.txt
- C:\users\public\recorded tv\sample media\# restoring files #.html
- C:\users\public\recorded tv\# restoring files #.txt
- C:\users\public\recorded tv\# restoring files #.html
- C:\users\all users\favorites\# restoring files #.txt
- %HOMEPATH%\appdata\# restoring files #.html
- C:\users\public\pictures\sample pictures\ghyvcf.wct.cryptoshield
- C:\users\public\pictures\sample pictures\crathvaf.wct.cryptoshield
- C:\users\public\pictures\sample pictures\yvtugubhfr.wct.cryptoshield
- C:\users\public\pictures\sample pictures\xbnyn.wct.cryptoshield
- C:\users\public\pictures\sample pictures\wryylsvfu.wct.cryptoshield
- C:\users\public\pictures\sample pictures\ulqenatrnf.wct.cryptoshield
- C:\users\public\pictures\sample pictures\qrfreg.wct.cryptoshield
- C:\users\public\pictures\sample pictures\puelfnagurzhz.wct.cryptoshield
- C:\users\public\music\sample music\# restoring files #.txt
- C:\users\public\pictures\sample pictures\# restoring files #.txt
- %HOMEPATH%\desktop\pbssrr.ozc.cryptoshield
- %HOMEPATH%\appdata\# restoring files #.txt
- %HOMEPATH%\contacts\hfre.pbagnpg.cryptoshield
- %HOMEPATH%\application data\# restoring files #.html
- %HOMEPATH%\documents\# restoring files #.txt
- %HOMEPATH%\documents\# restoring files #.html
- %HOMEPATH%\desktop\# restoring files #.txt
- %HOMEPATH%\desktop\# restoring files #.html
- %HOMEPATH%\desktop\czq.pre.cryptoshield
- %HOMEPATH%\desktop\sv51.qbp.cryptoshield
- %HOMEPATH%\desktop\qvnyznc.ozc.cryptoshield
- %HOMEPATH%\desktop\qvny.ozc.cryptoshield
- %HOMEPATH%\application data\# restoring files #.txt
- %HOMEPATH%\desktop\qryrgr.niv.cryptoshield
- %HOMEPATH%\# restoring files #.txt
- %HOMEPATH%\desktop\nepure.niv.cryptoshield
- %HOMEPATH%\desktop\nccyvpnagsbez_ra.qbp.cryptoshield
- %HOMEPATH%\desktop\nquq_naq_borfvgl.qbpk.cryptoshield
- %HOMEPATH%\desktop\508fbsgjnernaqbf.qbp.cryptoshield
- %HOMEPATH%\cookies\# restoring files #.txt
- %HOMEPATH%\cookies\# restoring files #.html
- %HOMEPATH%\contacts\# restoring files #.txt
- %HOMEPATH%\contacts\# restoring files #.html
- %HOMEPATH%\desktop\pbeerpg.niv.cryptoshield
- %HOMEPATH%\start menu\# restoring files #.txt
- C:\users\all users\favorites\# restoring files #.html
- C:\users\all users\adobe\arm\s\10428\# restoring files #.html
- C:\far2\plugins\autowrap\# restoring files #.txt
- C:\far2\plugins\autowrap\# restoring files #.html
- C:\far2\plugins\autowrap\nhgbjenc.znc.cryptoshield
- C:\far2\plugins\arclite\# restoring files #.txt
- C:\far2\plugins\arclite\# restoring files #.html
- C:\far2\plugins\arclite\nepyvgr.znc.cryptoshield
- C:\far2\plugins\align\# restoring files #.txt
- C:\far2\plugins\align\# restoring files #.html
- C:\far2\plugins\align\nyvta.znc.cryptoshield
- C:\far2\plugins\# restoring files #.txt
- C:\far2\plugins\# restoring files #.html
- C:\far2\fexcept\# restoring files #.txt
- C:\far2\fexcept\# restoring files #.html
- C:\far2\encyclopedia\tap\# restoring files #.txt
- C:\far2\encyclopedia\tap\# restoring files #.html
- C:\far2\encyclopedia\tap\pbqr.ova.cryptoshield
- C:\far2\encyclopedia\# restoring files #.txt
- C:\far2\encyclopedia\# restoring files #.html
- C:\far2\documentation\rus\# restoring files #.txt
- C:\far2\plugins\brackets\oenpxrgf.znc.cryptoshield
- C:\far2\plugins\brackets\# restoring files #.html
- C:\far2\plugins\brackets\# restoring files #.txt
- C:\far2\plugins\compare\pbzcner.znc.cryptoshield
- C:\far2\plugins\ftp\sgcpzqf_ehf.gkg.cryptoshield
- C:\far2\plugins\ftp\sgcpzqf.gkg.cryptoshield
- C:\far2\plugins\ftp\snesgc.znc.cryptoshield
- C:\far2\plugins\filecase\# restoring files #.txt
- C:\far2\plugins\filecase\# restoring files #.html
- C:\far2\plugins\filecase\svyrpnfr.znc.cryptoshield
- C:\far2\plugins\farcmds\# restoring files #.txt
- C:\far2\plugins\farcmds\# restoring files #.html
- C:\far2\plugins\farcmds\snepzqf.znc.cryptoshield
- C:\far2\plugins\emenu\# restoring files #.html
- C:\far2\plugins\emenu\# restoring files #.txt
- C:\far2\plugins\emenu\rzrah.znc.cryptoshield
- C:\far2\plugins\editcase\# restoring files #.txt
- C:\far2\plugins\editcase\# restoring files #.html
- C:\far2\plugins\editcase\rqvgpnfr.znc.cryptoshield
- C:\far2\plugins\drawline\# restoring files #.txt
- C:\far2\plugins\drawline\# restoring files #.html
- C:\far2\plugins\drawline\qenjyvar.znc.cryptoshield
- C:\far2\plugins\compare\# restoring files #.txt
- C:\far2\plugins\compare\# restoring files #.html
- C:\far2\plugins\ftp\abgrf.gkg.cryptoshield
- C:\far2\documentation\rus\# restoring files #.html
- C:\far2\documentation\rus\grpuvasb.gkg.cryptoshield
- C:\far2\documentation\rus\cyhtvaf_erivrj.gkg.cryptoshield
- C:\far2\addons\colors\default_highlighting\# restoring files #.txt
- C:\far2\addons\colors\default_highlighting\# restoring files #.html
- C:\far2\addons\colors\custom_highlighting\# restoring files #.txt
- C:\far2\addons\colors\custom_highlighting\# restoring files #.html
- C:\far2\addons\colors\# restoring files #.txt
- C:\far2\addons\colors\# restoring files #.html
- C:\far2\addons\# restoring files #.txt
- C:\far2\addons\# restoring files #.html
- C:\far2\addons\ernqzr.gkg.cryptoshield
- C:\far2\# restoring files #.txt
- C:\far2\# restoring files #.html
- C:\far2\sne.znc.cryptoshield
- C:\documents and settings\# restoring files #.txt
- C:\documents and settings\# restoring files #.html
- C:\$recycle.bin\# restoring files #.txt
- C:\$recycle.bin\# restoring files #.html
- C:\# restoring files #.txt
- C:\# restoring files #.html
- %APPDATA%\officetab\favorites\excelfavorite.acl
- C:\far2\addons\macros\# restoring files #.html
- C:\far2\addons\macros\# restoring files #.txt
- C:\far2\addons\setup\# restoring files #.html
- C:\far2\addons\setup\# restoring files #.txt
- C:\far2\documentation\rus\sne_snd.gkg.cryptoshield
- C:\far2\documentation\rus\oht_ercbeg.gkg.cryptoshield
- C:\far2\documentation\rus\nep_fhccbeg.gkg.cryptoshield
- C:\far2\documentation\eng\# restoring files #.txt
- C:\far2\documentation\eng\# restoring files #.html
- C:\far2\documentation\eng\grpuvasb.gkg.cryptoshield
- C:\far2\documentation\eng\cyhtvaf_erivrj.gkg.cryptoshield
- C:\far2\documentation\eng\cyhtvaf_vafgnyy.gkg.cryptoshield
- C:\far2\documentation\eng\sne_snd.gkg.cryptoshield
- C:\far2\documentation\eng\nep_fhccbeg.gkg.cryptoshield
- C:\far2\documentation\eng\oht_ercbeg.gkg.cryptoshield
- C:\far2\documentation\# restoring files #.txt
- C:\far2\documentation\# restoring files #.html
- C:\far2\addons\xlat\russian\# restoring files #.txt
- C:\far2\addons\xlat\russian\# restoring files #.html
- C:\far2\addons\xlat\# restoring files #.txt
- C:\far2\addons\xlat\# restoring files #.html
- C:\far2\addons\shell\# restoring files #.txt
- C:\far2\addons\shell\# restoring files #.html
- C:\far2\addons\shell\sneurer.vas.cryptoshield
- C:\far2\documentation\rus\cyhtvaf_vafgnyy.gkg.cryptoshield
- C:\far2\plugins\ftp\abgrf_ehf.gkg.cryptoshield
- C:\far2\plugins\ftp\# restoring files #.html
- C:\far2\plugins\ftp\# restoring files #.txt
- C:\totalcmd\language\jpzq_ebz.vap.cryptoshield
- C:\totalcmd\language\jpzq_xbe.vap.cryptoshield
- C:\totalcmd\language\jpzq_vgn.vap.cryptoshield
- C:\totalcmd\language\jpzq_uha.vap.cryptoshield
- C:\totalcmd\language\jpzq_sen.vap.cryptoshield
- C:\totalcmd\language\jpzq_rfc.vap.cryptoshield
- C:\totalcmd\language\jpzq_qhg.vap.cryptoshield
- C:\totalcmd\language\jpzq_qrh.vap.cryptoshield
- C:\totalcmd\language\jpzq_qna.vap.cryptoshield
- C:\totalcmd\language\jpzq_pua.vap.cryptoshield
- C:\totalcmd\language\jpzq_fia.vap.cryptoshield
- C:\totalcmd\# restoring files #.txt
- C:\totalcmd\# restoring files #.html
- C:\totalcmd\jpzvpbaf.vap.cryptoshield
- C:\totalcmd\gbgnypzq.vap.cryptoshield
- C:\totalcmd\fvmr!.gkg.cryptoshield
- C:\totalcmd\ertvfgre.egs.cryptoshield
- C:\totalcmd\xrlobneq.gkg.cryptoshield
- C:\totalcmd\uvfgbel.gkg.cryptoshield
- C:\totalcmd\language\jpzq_pm.vap.cryptoshield
- C:\users\all users\documents\# restoring files #.html
- C:\totalcmd\language\# restoring files #.html
- C:\users\all users\desktop\# restoring files #.txt
- C:\users\all users\desktop\# restoring files #.html
- C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\# restoring files #.txt
- C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\# restoring files #.html
- C:\users\all users\adobe\setup\# restoring files #.txt
- C:\users\all users\adobe\setup\# restoring files #.html
- C:\users\all users\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\# restoring files #.txt
- C:\users\all users\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\# restoring files #.html
- C:\users\all users\adobe\arm\s\10428\# restoring files #.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\# restoring files #.txt
- C:\totalcmd\language\jpzq_ehf.vap.cryptoshield
- C:\users\all users\adobe\arm\s\# restoring files #.html
- C:\users\all users\adobe\arm\reader_15.008.20082\# restoring files #.txt
- C:\users\all users\adobe\arm\reader_15.008.20082\# restoring files #.html
- C:\users\all users\adobe\arm\reader_15.007.20033\# restoring files #.txt
- C:\users\all users\adobe\arm\reader_15.007.20033\# restoring files #.html
- C:\users\all users\adobe\arm\# restoring files #.txt
- C:\users\all users\adobe\arm\# restoring files #.html
- C:\users\all users\adobe\# restoring files #.txt
- C:\users\all users\adobe\# restoring files #.html
- C:\users\all users\adobe\arm\s\# restoring files #.txt
- C:\totalcmd\language\# restoring files #.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\# restoring files #.html
- C:\recovery\# restoring files #.txt
- C:\recovery\# restoring files #.html
- C:\far2\plugins\macroview\# restoring files #.txt
- C:\far2\pluginsdk\# restoring files #.html
- C:\far2\plugins\tmppanel\# restoring files #.txt
- C:\far2\plugins\tmppanel\# restoring files #.html
- C:\far2\plugins\proclist\# restoring files #.txt
- C:\far2\plugins\proclist\# restoring files #.html
- C:\far2\plugins\proclist\cebpyvfg.znc.cryptoshield
- C:\far2\plugins\network\# restoring files #.txt
- C:\far2\plugins\network\# restoring files #.html
- C:\users\all users\documents\# restoring files #.txt
- C:\far2\pluginsdk\headers.c\snepbybe.ucc.cryptoshield
- C:\far2\plugins\macroview\# restoring files #.html
- C:\far2\plugins\macroview\znpebivrj.znc.cryptoshield
- C:\far2\plugins\hlfviewer\# restoring files #.txt
- C:\far2\plugins\hlfviewer\# restoring files #.html
- C:\far2\plugins\hlfviewer\uysivrjre.znc.cryptoshield
- C:\far2\plugins\ftp\lib\# restoring files #.txt
- C:\far2\plugins\ftp\lib\# restoring files #.html
- C:\far2\plugins\ftp\lib\sgccebterff.znc.cryptoshield
- C:\far2\plugins\ftp\lib\sgcqveyvfg.znc.cryptoshield
- C:\far2\plugins\network\argjbex.znc.cryptoshield
- C:\msocache\# restoring files #.txt
- C:\far2\pluginsdk\headers.c\snexrlf.ucc.cryptoshield
- C:\far2\pluginsdk\headers.c\# restoring files #.txt
- C:\far2\pluginsdk\headers.c\cyhtva.ucc.cryptoshield
- %PROGRAMDATA%\# restoring files #.txt
- %PROGRAMDATA%\# restoring files #.html
- %ProgramFiles(x86)%\# restoring files #.txt
- %ProgramFiles(x86)%\# restoring files #.html
- %ProgramFiles%\# restoring files #.txt
- %ProgramFiles%\# restoring files #.html
- C:\perflogs\admin\# restoring files #.txt
- C:\perflogs\admin\# restoring files #.html
- C:\far2\pluginsdk\headers.c\# restoring files #.html
- C:\perflogs\# restoring files #.txt
- C:\far2\pluginsdk\# restoring files #.txt
- C:\msocache\# restoring files #.html
- <Current directory>\# restoring files #.txt
- <Current directory>\# restoring files #.html
- C:\far2\pluginsdk\headers.pas\# restoring files #.txt
- C:\far2\pluginsdk\headers.pas\# restoring files #.html
- C:\far2\pluginsdk\headers.pas\cyhtvaj.cnf.cryptoshield
- C:\far2\pluginsdk\headers.pas\snexrlfj.cnf.cryptoshield
- C:\far2\pluginsdk\headers.pas\snepbybej.cnf.cryptoshield
- C:\perflogs\# restoring files #.html
- %APPDATA%\1faaxb2.tmp
Network activity
TCP
HTTP POST requests
- http://45.##.81.110/test_site_scripts/moduls/connects/mailsupload.php
UDP
- DNS ASK bl##.#idemind.gr
