Trojan.Encoder.41736

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\word\startup\readme.txt

Creates the following files on removable media

<Drive name for removable media>:\readme.txt

Malicious functions

Reads files which store third party applications passwords

%APPDATA%\thunderbird\profiles.ini
%HOMEPATH%\desktop\trivial-merge.htm
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\3.jpeg
%HOMEPATH%\desktop\2.jpeg
%HOMEPATH%\desktop\1189.jpeg
%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\trivial-merge.html
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc

Modifies file system

Creates the following files

C:\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\54\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\55\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\56\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\57\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\58\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\59\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\6\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\60\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\61\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\62\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\50\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\63\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\8\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\9\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\host\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\muffin\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\security\readme.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\readme.txt
%APPDATA%\readme.txt
%APPDATA%\identities\readme.txt
%APPDATA%\identities\{1bba5dcd-58f3-46ae-861d-68cf42722c36}\readme.txt
%APPDATA%\media center programs\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\52\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\53\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\51\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\5\readme.txt
%APPDATA%\microsoft\addins\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\3\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\30\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\31\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\33\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\34\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\35\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\36\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\37\readme.txt
%APPDATA%\microsoft\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\28\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\7\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\38\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\41\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\42\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\43\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\44\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\45\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\46\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\47\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\48\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\49\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\4\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\40\readme.txt
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_10.0.30319\readme.txt
%APPDATA%\microsoft\credentials\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\minidumps\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\default\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\readme.txt
%HOMEPATH%\contacts\readme.txt
%HOMEPATH%\desktop\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\27\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\readme.txt
%HOMEPATH%\favorites\links\readme.txt
%HOMEPATH%\favorites\links for united states\readme.txt
%HOMEPATH%\favorites\microsoft websites\readme.txt
%HOMEPATH%\favorites\msn websites\readme.txt
%HOMEPATH%\links\readme.txt
%HOMEPATH%\music\readme.txt
%HOMEPATH%\pictures\readme.txt
%HOMEPATH%\saved games\readme.txt
%HOMEPATH%\searches\readme.txt
%HOMEPATH%\videos\readme.txt
%HOMEPATH%\downloads\readme.txt
%HOMEPATH%\documents\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\29\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\events\readme.txt
%APPDATA%\microsoft\uproof\readme.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\readme.txt
%APPDATA%\microsoft\office\readme.txt
%APPDATA%\microsoft\office\recent\readme.txt
%APPDATA%\microsoft\proof\readme.txt
%APPDATA%\microsoft\protect\readme.txt
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\readme.txt
%APPDATA%\microsoft\systemcertificates\readme.txt
%APPDATA%\microsoft\systemcertificates\my\readme.txt
%APPDATA%\microsoft\systemcertificates\my\certificates\readme.txt
%APPDATA%\microsoft\systemcertificates\my\crls\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\readme.txt
%APPDATA%\microsoft\crypto\readme.txt
%APPDATA%\microsoft\crypto\rsa\readme.txt
%APPDATA%\microsoft\word\readme.txt
%APPDATA%\telegram desktop\readme.txt
%APPDATA%\thunderbird\readme.txt
%APPDATA%\thunderbird\crash reports\readme.txt
%APPDATA%\thunderbird\crash reports\events\readme.txt
%APPDATA%\thunderbird\pending pings\readme.txt
%APPDATA%\thunderbird\profiles\readme.txt
%APPDATA%\thunderbird\profiles\dm02c46v.default\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\readme.txt
%APPDATA%\microsoft\templates\readme.txt
%APPDATA%\microsoft\systemcertificates\my\ctls\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\26\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\25\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\24\readme.txt
C:\users\public\music\readme.txt
C:\users\public\music\sample music\readme.txt
C:\users\public\pictures\readme.txt
C:\users\public\pictures\sample pictures\readme.txt
C:\users\public\recorded tv\readme.txt
C:\users\public\recorded tv\sample media\readme.txt
C:\users\public\videos\readme.txt
C:\users\public\videos\sample videos\readme.txt
%HOMEPATH%\readme.txt
C:\users\public\downloads\readme.txt
C:\users\default\appdata\roaming\readme.txt
C:\users\public\libraries\readme.txt
%HOMEPATH%\appdata\readme.txt
%LOCALAPPDATA%\microsoft\feeds\readme.txt
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\readme.txt
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\readme.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\readme.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\readme.txt
%LOCALAPPDATA%\microsoft\feeds cache\readme.txt
%LOCALAPPDATA%\microsoft\feeds cache\09emkjp8\readme.txt
%LOCALAPPDATA%\microsoft\feeds cache\17h8i54k\readme.txt
%LOCALAPPDATA%\microsoft\feeds cache\9lygctr1\readme.txt
%LOCALAPPDATA%\readme.txt
%LOCALAPPDATA%\microsoft\readme.txt
%LOCALAPPDATA%\microsoft\credentials\readme.txt
<Current directory>\readme.txt
%LOCALAPPDATA%\microsoft\feeds cache\aowdc71i\readme.txt
C:\users\public\readme.txt
C:\msocache\readme.txt
C:\perflogs\readme.txt
C:\perflogs\admin\readme.txt
C:\recovery\readme.txt
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\readme.txt
C:\users\readme.txt
C:\users\default\readme.txt
C:\users\default\appdata\readme.txt
C:\users\default\appdata\local\readme.txt
C:\users\default\appdata\local\microsoft\readme.txt
C:\users\public\desktop\readme.txt
C:\users\public\documents\readme.txt
C:\users\default\appdata\local\temp\readme.txt
C:\users\default\appdata\roaming\microsoft\readme.txt
C:\users\default\desktop\readme.txt
C:\users\default\documents\readme.txt
C:\users\default\downloads\readme.txt
C:\users\default\favorites\readme.txt
C:\users\default\links\readme.txt
C:\users\default\music\readme.txt
C:\users\default\pictures\readme.txt
C:\users\default\saved games\readme.txt
C:\users\default\videos\readme.txt
C:\kms\readme.txt
C:\users\default\appdata\roaming\media center programs\readme.txt
%HOMEPATH%\favorites\readme.txt
%LOCALAPPDATA%\microsoft\media player\readme.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b8ef\readme.txt
%LOCALAPPDATA%low\oracle\java\au\readme.txt
%LOCALAPPDATA%low\sun\readme.txt
%LOCALAPPDATA%low\sun\java\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\0\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\10\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\11\readme.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\readme.txt
%LOCALAPPDATA%low\oracle\java\readme.txt
%LOCALAPPDATA%low\oracle\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\15\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\16\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\17\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\18\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\19\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\2\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\20\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\21\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\22\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\23\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\12\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\14\readme.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\13\readme.txt
C:\users\public\favorites\readme.txt
%LOCALAPPDATA%\microsoft\office\readme.txt
%LOCALAPPDATA%\microsoft\office\groove\readme.txt
%LOCALAPPDATA%\microsoft\office\groove\system\readme.txt
%LOCALAPPDATA%\microsoft\office\groove\user\readme.txt
%LOCALAPPDATA%\microsoft help\readme.txt
%LOCALAPPDATA%\programs\readme.txt
%LOCALAPPDATA%\programs\common\readme.txt
%TEMP%\readme.txt
%TEMP%\hsperfdata_user\readme.txt
%TEMP%\low\readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\startupcache\readme.txt
%LOCALAPPDATA%low\microsoft\readme.txt
%LOCALAPPDATA%low\readme.txt
%TEMP%\wpdnse\readme.txt
%LOCALAPPDATA%\thunderbird\readme.txt
%LOCALAPPDATA%\thunderbird\profiles\readme.txt
%LOCALAPPDATA%\thunderbird\profiles\dm02c46v.default\readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\cache2\readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\cache2\doomed\readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\cache2\entries\readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\safebrowsing\readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\safebrowsing\google4\readme.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\readme.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\readme.txt
D:\readme.txt

Moves the following files

from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814 to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json.nba
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json.nba
from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\mso1033.acl.nba
from %APPDATA%\microsoft\office\recent\templates.lnk to %APPDATA%\microsoft\office\recent\templates.lnk.nba
from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.nba
from %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c to %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c.nba
from %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred.nba
from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\normal.dotm.nba
from %APPDATA%\Microsoft\Templates\~$Normal.dotm to %APPDATA%\microsoft\templates\~$normal.dotm.nba
from %APPDATA%\microsoft\uproof\custom.dic to %APPDATA%\microsoft\uproof\custom.dic.nba
from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.nba
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.nba
from %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json to %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json.nba
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.nba

Modifies the following files

C:\users\default\ntuser.dat.log
C:\users\public\pictures\sample pictures\penguins.jpg
C:\users\public\pictures\sample pictures\koala.jpg
C:\users\public\pictures\sample pictures\jellyfish.jpg
C:\users\public\pictures\sample pictures\hydrangeas.jpg
C:\users\public\pictures\sample pictures\desktop.ini
C:\users\public\pictures\sample pictures\desert.jpg
C:\users\public\pictures\sample pictures\chrysanthemum.jpg
C:\users\public\pictures\desktop.ini
C:\users\public\music\sample music\kalimba.mp3
C:\users\public\music\sample music\sleep away.mp3
C:\users\public\music\sample music\maid with the flaxen hair.mp3
C:\users\public\music\sample music\desktop.ini
C:\users\public\libraries\recordedtv.library-ms
C:\users\public\music\desktop.ini
C:\users\public\libraries\desktop.ini
C:\users\public\downloads\desktop.ini
C:\users\public\documents\desktop.ini
C:\users\public\desktop.ini
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms
C:\users\public\desktop\desktop.ini
C:\users\desktop.ini
C:\users\default\ntuser.dat.log1
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\boot.sdi
C:\users\default\ntuser.dat
C:\users\public\pictures\sample pictures\lighthouse.jpg
C:\users\public\recorded tv\desktop.ini

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial