Trojan.Encoder.37976

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Terminates or attempts to terminate

the following user processes:

firefox.exe
iexplore.exe

Modifies file system

Creates the following files

C:\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\60\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\61\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\63\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\62\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\host\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\7\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\8\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\muffin\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\security\how to restore your files.txt
%APPDATA%\how to restore your files.txt
%APPDATA%\microsoft\credentials\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\9\how to restore your files.txt
%APPDATA%\thunderbird\profiles\49zr3fqa.default\how to restore your files.txt
%APPDATA%\microsoft\crypto\how to restore your files.txt
%APPDATA%\identities\{d59a8b31-5854-4768-ba01-cd66beadf546}\how to restore your files.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\how to restore your files.txt
%APPDATA%\media center programs\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\how to restore your files.txt
%APPDATA%\microsoft\systemcertificates\how to restore your files.txt
%APPDATA%\microsoft\systemcertificates\my\certificates\how to restore your files.txt
%APPDATA%\microsoft\systemcertificates\my\crls\how to restore your files.txt
%APPDATA%\microsoft\how to restore your files.txt
%APPDATA%\microsoft\crypto\rsa\how to restore your files.txt
%APPDATA%\microsoft\protect\how to restore your files.txt
%APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\how to restore your files.txt
%APPDATA%\microsoft\systemcertificates\my\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\59\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\6\how to restore your files.txt
%APPDATA%\identities\how to restore your files.txt
%APPDATA%\microsoft\systemcertificates\my\ctls\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\56\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\34\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\30\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\35\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\36\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\37\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\4\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\38\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\40\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\41\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\42\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\43\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\44\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\45\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\46\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\48\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\49\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\5\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\47\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\50\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\51\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\52\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\53\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\54\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\55\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\57\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\58\how to restore your files.txt
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_10.0.30319\how to restore your files.txt
%APPDATA%\thunderbird\how to restore your files.txt
m:\how to restore your files.txt
m:\boot\bcd.log1.babyk
%HOMEPATH%\favorites\windows live\how to restore your files.txt
m:\boot\how to restore your files.txt
m:\boot\bcd.log2.babyk
m:\boot\de-de\how to restore your files.txt
m:\boot\el-gr\how to restore your files.txt
m:\boot\bootstat.dat.babyk
%HOMEPATH%\links\how to restore your files.txt
%HOMEPATH%\searches\how to restore your files.txt
m:\boot\en-us\how to restore your files.txt
m:\boot\fonts\how to restore your files.txt
m:\boot\fr-fr\how to restore your files.txt
%APPDATA%\thunderbird\crash reports\how to restore your files.txt
m:\boot\hu-hu\how to restore your files.txt
m:\boot\ja-jp\how to restore your files.txt
m:\boot\ko-kr\how to restore your files.txt
m:\boot\nb-no\how to restore your files.txt
m:\boot\nl-nl\how to restore your files.txt
m:\boot\pl-pl\how to restore your files.txt
m:\boot\pt-br\how to restore your files.txt
m:\boot\pt-pt\how to restore your files.txt
m:\boot\ru-ru\how to restore your files.txt
m:\boot\sv-se\how to restore your files.txt
m:\boot\tr-tr\how to restore your files.txt
m:\boot\zh-cn\how to restore your files.txt
%HOMEPATH%\favorites\microsoft websites\how to restore your files.txt
D:\how to restore your files.txt
%HOMEPATH%\favorites\msn websites\how to restore your files.txt
%HOMEPATH%\videos\how to restore your files.txt
%HOMEPATH%\saved games\how to restore your files.txt
%APPDATA%\thunderbird\crash reports\events\how to restore your files.txt
%APPDATA%\thunderbird\profiles\how to restore your files.txt
%APPDATA%\telegram desktop\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\events\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\default\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\31\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\33\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\temporary\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\how to restore your files.txt
%HOMEPATH%\contacts\how to restore your files.txt
%HOMEPATH%\downloads\how to restore your files.txt
%HOMEPATH%\favorites\how to restore your files.txt
%HOMEPATH%\favorites\links\how to restore your files.txt
%HOMEPATH%\documents\how to restore your files.txt
%HOMEPATH%\favorites\links for united states\how to restore your files.txt
%HOMEPATH%\music\how to restore your files.txt
%HOMEPATH%\pictures\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\how to restore your files.txt
%APPDATA%\thunderbird\pending pings\how to restore your files.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\minidumps\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\3\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\29\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\28\how to restore your files.txt
%HOMEPATH%\appdata\how to restore your files.txt
%LOCALAPPDATA%\how to restore your files.txt
%LOCALAPPDATA%\microsoft\how to restore your files.txt
%LOCALAPPDATA%\microsoft\credentials\how to restore your files.txt
%LOCALAPPDATA%\microsoft\feeds\how to restore your files.txt
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\how to restore your files.txt
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\how to restore your files.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\how to restore your files.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\how to restore your files.txt
%LOCALAPPDATA%\microsoft\feeds cache\how to restore your files.txt
%LOCALAPPDATA%\microsoft\feeds cache\1zlrvj28\how to restore your files.txt
%LOCALAPPDATA%\microsoft\feeds cache\5uzys9tz\how to restore your files.txt
%LOCALAPPDATA%\microsoft\feeds cache\id3ykpjl\how to restore your files.txt
%LOCALAPPDATA%\microsoft\feeds cache\q2xofo16\how to restore your files.txt
%LOCALAPPDATA%\microsoft\media player\how to restore your files.txt
C:\users\public\pictures\sample pictures\how to restore your files.txt
C:\users\public\recorded tv\how to restore your files.txt
C:\users\public\recorded tv\sample media\how to restore your files.txt
C:\users\public\videos\how to restore your files.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\how to restore your files.txt
%LOCALAPPDATA%\microsoft\office\groove\system\how to restore your files.txt
%LOCALAPPDATA%\microsoft\office\groove\user\how to restore your files.txt
C:\users\default\how to restore your files.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\how to restore your files.txt
%HOMEPATH%\how to restore your files.txt
C:\users\public\music\sample music\how to restore your files.txt
C:\users\public\desktop\how to restore your files.txt
C:\users\public\videos\sample videos\how to restore your files.txt
C:\users\public\documents\how to restore your files.txt
C:\users\public\how to restore your files.txt
C:\users\default\downloads\how to restore your files.txt
<Current directory>\how to restore your files.txt
C:\msocache\how to restore your files.txt
C:\perflogs\admin\how to restore your files.txt
C:\recovery\how to restore your files.txt
C:\users\how to restore your files.txt
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\how to restore your files.txt
C:\users\default\appdata\local\microsoft\how to restore your files.txt
C:\perflogs\how to restore your files.txt
C:\users\default\appdata\how to restore your files.txt
C:\users\default\appdata\local\temp\how to restore your files.txt
C:\users\default\appdata\local\how to restore your files.txt
C:\users\default\appdata\roaming\media center programs\how to restore your files.txt
%LOCALAPPDATA%\microsoft\office\how to restore your files.txt
m:\boot\zh-hk\how to restore your files.txt
C:\users\default\documents\how to restore your files.txt
C:\users\default\appdata\roaming\microsoft\how to restore your files.txt
C:\users\default\desktop\how to restore your files.txt
C:\users\default\favorites\how to restore your files.txt
C:\users\default\links\how to restore your files.txt
C:\users\default\music\how to restore your files.txt
C:\users\default\pictures\how to restore your files.txt
C:\users\default\saved games\how to restore your files.txt
C:\users\default\videos\how to restore your files.txt
C:\users\public\downloads\how to restore your files.txt
C:\users\public\favorites\how to restore your files.txt
C:\users\public\libraries\how to restore your files.txt
C:\users\public\music\how to restore your files.txt
C:\kms\how to restore your files.txt
C:\users\default\appdata\roaming\how to restore your files.txt
m:\boot\it-it\how to restore your files.txt
%LOCALAPPDATA%\microsoft\office\groove\how to restore your files.txt
%LOCALAPPDATA%\microsoft help\how to restore your files.txt
%LOCALAPPDATA%low\oracle\java\au\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\10\how to restore your files.txt
%LOCALAPPDATA%low\sun\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\0\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\11\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\12\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\13\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\14\how to restore your files.txt
C:\users\public\pictures\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\15\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\17\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\18\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\19\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\2\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\20\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\21\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\22\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\23\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\24\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\25\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\26\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\27\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\16\how to restore your files.txt
%LOCALAPPDATA%low\oracle\java\how to restore your files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\how to restore your files.txt
%LOCALAPPDATA%low\oracle\how to restore your files.txt
%TEMP%\opera installer\how to restore your files.txt
%LOCALAPPDATA%\programs\how to restore your files.txt
%LOCALAPPDATA%\programs\common\how to restore your files.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\new\how to restore your files.txt
%LOCALAPPDATA%\microsoft\windows media\how to restore your files.txt
%LOCALAPPDATA%\microsoft\windows media\12.0\how to restore your files.txt
%LOCALAPPDATA%\microsoft\windows sidebar\how to restore your files.txt
%LOCALAPPDATA%\microsoft\windows sidebar\gadgets\how to restore your files.txt
%LOCALAPPDATA%\microsoft\windows mail\stationery\how to restore your files.txt
%TEMP%\how to restore your files.txt
%TEMP%\hsperfdata_user\how to restore your files.txt
%TEMP%\low\how to restore your files.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\how to restore your files.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\how to restore your files.txt
%LOCALAPPDATA%\microsoft\windows mail\how to restore your files.txt
%LOCALAPPDATA%\thunderbird\how to restore your files.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\how to restore your files.txt
%TEMP%\wpdnse\how to restore your files.txt
%LOCALAPPDATA%\thunderbird\profiles\how to restore your files.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\safebrowsing\how to restore your files.txt
%LOCALAPPDATA%\thunderbird\profiles\49zr3fqa.default\how to restore your files.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\startupcache\how to restore your files.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\cache2\how to restore your files.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\cache2\doomed\how to restore your files.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\cache2\entries\how to restore your files.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\safebrowsing\google4\how to restore your files.txt
%LOCALAPPDATA%low\how to restore your files.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\how to restore your files.txt
%LOCALAPPDATA%low\microsoft\how to restore your files.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\how to restore your files.txt
m:\boot\zh-tw\how to restore your files.txt

Moves the following files

from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\compatibility.ini.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json.babyk
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe.babyk
from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json.babyk
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.babyk
from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.babyk
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.babyk
from %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json to %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json.babyk
from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\preferred.babyk
from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\71e6321a-7203-4cd6-882b-58bcea299d05 to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\71e6321a-7203-4cd6-882b-58bcea299d05.babyk
from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\6e12f8b6-e1ac-4788-8949-ac589fd4016c to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\6e12f8b6-e1ac-4788-8949-ac589fd4016c.babyk
from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.babyk
from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\f58155b4b1d5a524ca0261c3ee99fb50_d4602615-9d50-4880-be41-678935e93eaa to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\f58155b4b1d5a524ca0261c3ee99fb50_d4602615-9d50-4880-be41-678935e93eaa.babyk
from %TEMP%\wmsetup.log to %TEMP%\wmsetup.log.babyk
from %TEMP%\tmpaddon to %TEMP%\tmpaddon.babyk
from %TEMP%\setupexe(20220928171621f0c).log to %TEMP%\setupexe(20220928171621f0c).log.babyk
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\a6077284-6dcc-4781-9fb7-7f9d7b5132bf to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\a6077284-6dcc-4781-9fb7-7f9d7b5132bf.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764036.a6077284-6dcc-4781-9fb7-7f9d7b5132bf.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764036.a6077284-6dcc-4781-9fb7-7f9d7b5132bf.first-shutdown.jsonlz4.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\.metadata-v2.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764034.d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.main.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764034.d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.main.jsonlz4.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411763506.e60182f3-3480-48d0-bc12-b3b897042a6b.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411763506.e60182f3-3480-48d0-bc12-b3b897042a6b.new-profile.jsonlz4.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\store.json.mozlz4.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\search.json.mozlz4.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\parent.lock to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\parent.lock.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite.babyk
from %TEMP%\rgi5839.tmp-tmp to %TEMP%\rgi5839.tmp-tmp.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\d092fa80-6cc0-49cc-9da4-f67b3d6cdc55 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.babyk
from %TEMP%\ose00000.exe to %TEMP%\ose00000.exe.babyk
from %TEMP%\opera_crashreporter.log to %TEMP%\opera_crashreporter.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928170250.log to %TEMP%\dd_vcredist_amd64_20220928170250.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928170114.log to %TEMP%\dd_vcredist_amd64_20220928170114.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928165956_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928165956_001_vcruntimeminimum_x64.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928165956_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928165956_002_vcruntimeadditional_x64.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928165956.log to %TEMP%\dd_vcredist_amd64_20220928165956.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928165746_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928165746_001_vcruntimeadditional_x64.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928165746_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928165746_000_vcruntimeminimum_x64.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928165746.log to %TEMP%\dd_vcredist_amd64_20220928165746.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928165628_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928165628_1_vcruntimeadditional_x64.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928165628_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928165628_0_vcruntimeminimum_x64.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928165628.log to %TEMP%\dd_vcredist_amd64_20220928165628.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928170250_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928170250_001_vcruntimeminimum_x64.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928165349_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928165349_1_vcruntimeadditional_x64.log.babyk
from %TEMP%\dd_vcredistmsi7a3c.txt to %TEMP%\dd_vcredistmsi7a3c.txt.babyk
from %TEMP%\dd_vcredist_amd64_20220928165349.log to %TEMP%\dd_vcredist_amd64_20220928165349.log.babyk
from %TEMP%\dd_vcredistui7a3c.txt to %TEMP%\dd_vcredistui7a3c.txt.babyk
from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.babyk
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.babyk
from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.babyk
from %TEMP%\chrome_installer.log to %TEMP%\chrome_installer.log.babyk
from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.babyk
from %TEMP%\adobearm.log to %TEMP%\adobearm.log.babyk
from %TEMP%\armui.ini to %TEMP%\armui.ini.babyk
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928165349_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928165349_0_vcruntimeminimum_x64.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928170250_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928170250_002_vcruntimeadditional_x64.log.babyk
from %TEMP%\dd_vcredist_amd64_20220928170328.log to %TEMP%\dd_vcredist_amd64_20220928170328.log.babyk
from %TEMP%\dd_vcredist_x86_20220928165536.log to %TEMP%\dd_vcredist_x86_20220928165536.log.babyk
from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt.babyk
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt.babyk
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt.babyk
from %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt.babyk
from %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt.babyk
from %TEMP%\jusched.log to %TEMP%\jusched.log.babyk
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.babyk
from %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt to %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt.babyk
from %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt to %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt.babyk
from %TEMP%\dd_vcredist_x86_20220928170410.log to %TEMP%\dd_vcredist_x86_20220928170410.log.babyk
from %TEMP%\dd_vcredist_x86_20220928170335_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928170335_002_vcruntimeadditional_x86.log.babyk
from %TEMP%\dd_vcredist_x86_20220928170335_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928170335_001_vcruntimeminimum_x86.log.babyk
from %TEMP%\dd_vcredist_x86_20220928170335.log to %TEMP%\dd_vcredist_x86_20220928170335.log.babyk
from %TEMP%\dd_vcredist_x86_20220928170221.log to %TEMP%\dd_vcredist_x86_20220928170221.log.babyk
from %TEMP%\dd_vcredist_x86_20220928170143_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928170143_002_vcruntimeadditional_x86.log.babyk
from %TEMP%\dd_vcredist_x86_20220928170143_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928170143_001_vcruntimeminimum_x86.log.babyk
from %TEMP%\dd_vcredist_x86_20220928170143.log to %TEMP%\dd_vcredist_x86_20220928170143.log.babyk
from %TEMP%\dd_vcredist_x86_20220928165916_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928165916_001_vcruntimeadditional_x86.log.babyk
from %TEMP%\dd_vcredist_x86_20220928165916_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928165916_000_vcruntimeminimum_x86.log.babyk
from %TEMP%\dd_vcredist_x86_20220928165916.log to %TEMP%\dd_vcredist_x86_20220928165916.log.babyk
from %TEMP%\dd_vcredist_x86_20220928165710_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928165710_1_vcruntimeadditional_x86.log.babyk
from %TEMP%\dd_vcredist_x86_20220928165710_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928165710_0_vcruntimeminimum_x86.log.babyk
from %TEMP%\dd_vcredist_x86_20220928165710.log to %TEMP%\dd_vcredist_x86_20220928165710.log.babyk
from %TEMP%\dd_vcredist_x86_20220928165536_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928165536_1_vcruntimeadditional_x86.log.babyk
from %TEMP%\dd_vcredist_x86_20220928165536_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928165536_0_vcruntimeminimum_x86.log.babyk
from %TEMP%\rgi5839.tmp to %TEMP%\rgi5839.tmp.babyk
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\e60182f3-3480-48d0-bc12-b3b897042a6b to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\e60182f3-3480-48d0-bc12-b3b897042a6b.babyk

Modifies the following files

C:\kms\kms_vl_all_aio.cmd.babyk
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\msnbc news~.feed-ms.babyk
C:\users\public\pictures\sample pictures\jellyfish.jpg.babyk
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\microsoft at work~.feed-ms.babyk
%LOCALAPPDATA%\microsoft\feeds cache\1zlrvj28\fwlink[1].babyk
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\web slice gallery~.feed-ms.babyk
%LOCALAPPDATA%\microsoft\feeds cache\index.dat.babyk
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\usa~dgov updates~c news and features~.feed-ms.babyk
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\microsoft at home~.feed-ms.babyk
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\popular government questions from usa~dgov~.feed-ms.babyk
C:\users\public\pictures\sample pictures\desert.jpg.babyk
C:\users\public\pictures\sample pictures\hydrangeas.jpg.babyk
C:\users\public\videos\sample videos\wildlife.wmv.babyk
C:\users\public\pictures\sample pictures\chrysanthemum.jpg.babyk
C:\users\public\music\sample music\maid with the flaxen hair.mp3.babyk
C:\users\public\music\sample music\sleep away.mp3.babyk
C:\users\public\desktop\steam.lnk.babyk
C:\users\public\desktop\opera.lnk.babyk
C:\users\public\desktop\mozilla thunderbird.lnk.babyk
C:\users\public\desktop\firefox.lnk.babyk
C:\users\public\music\sample music\kalimba.mp3.babyk
C:\users\default\ntuser.dat.log1.babyk
C:\users\public\desktop\acrobat reader dc.lnk.babyk
C:\users\public\libraries\recordedtv.library-ms.babyk
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\winre.wim.babyk
C:\users\default\ntuser.dat.log2.babyk
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\boot.sdi.babyk
C:\kms\kms_vl_all_aio_debug.log.babyk
C:\users\public\pictures\sample pictures\lighthouse.jpg.babyk
C:\users\public\pictures\sample pictures\koala.jpg.babyk

Modifies multiple files.

Moves itself

from <Full path to file> to <Full path to file>.babyk

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial