Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '*mscfg' = '%APPDATA%\Roaming\bntwtek.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'mscfg' = '%APPDATA%\Roaming\bntwtek.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Roaming\bntwtek.exe'
Executes the following:
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /Quiet
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
the following user processes:
- ecmd.exe
Modifies file system :
Creates the following files:
- C:\Users\Default\Downloads\HELP_RESTORE_FILES.txt
- C:\Users\Default\Favorites\HELP_RESTORE_FILES.txt
- C:\Users\Default\Videos\HELP_RESTORE_FILES.txt
- C:\Users\Default\Documents\HELP_RESTORE_FILES.txt
- C:\Users\Default\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\EmieSiteList\HELP_RESTORE_FILES.txt
- C:\Users\Default\Links\HELP_RESTORE_FILES.txt
- C:\Users\Default\Saved Games\HELP_RESTORE_FILES.txt
- C:\Users\Default\Pictures\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\HELP_RESTORE_FILES.txt
- C:\Users\Default\Desktop\HELP_RESTORE_FILES.txt
- C:\Users\Default\Music\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\EmieUserList\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\Services\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\U0051VM4\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\W6LZ144V\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Windows\AppCache\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Windows\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Windows\AppCache\BDOU7LW5\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\R0Q1HA3Q\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\0HYLUDRK\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\Content\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\MetaData\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\L1K0JSJU\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\PT9L5QVF\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\20UHQLDA\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\Internet Explorer\DOMStore\8ED9LAB2\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HELP_RESTORE_FILES.txt
- C:\ProgramData\Package Cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\HELP_RESTORE_FILES.txt
- C:\ProgramData\Package Cache\HELP_RESTORE_FILES.txt
- C:\ProgramData\Package Cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\HELP_RESTORE_FILES.txt
- C:\ProgramData\Package Cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\HELP_RESTORE_FILES.txt
- C:\ProgramData\Sun\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Local\HELP_RESTORE_FILES.txt
- C:\ProgramData\Sun\Java\Java Update\HELP_RESTORE_FILES.txt
- C:\ProgramData\Sun\Java\HELP_RESTORE_FILES.txt
- C:\ProgramData\Package Cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSScan\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\HELP_RESTORE_FILES.txt
- C:\ProgramData\Oracle\HELP_RESTORE_FILES.txt
- C:\ProgramData\Package Cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\WwanSvc\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Local\Microsoft\Windows\History\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Local\Microsoft\Windows\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Local\Microsoft\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Local\Temp\HELP_RESTORE_FILES.txt
- C:\Users\Default\AppData\Roaming\Media Center Programs\HELP_RESTORE_FILES.txt
- C:\Users\Public\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\$RECYCLE.BIN\S-1-5-21-2832440558-3064306045-1455513625-1000\HELP_RESTORE_FILES.txt
- C:\Users\Public\Recorded TV\HELP_RESTORE_FILES.txt
- C:\Users\Public\Videos\Sample Videos\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\books\SpeakOutWorkbook.pdf
- \Device\HarddiskVolume3\books\Программирование на языке Visual C++ - 2009.pdf
- \Device\HarddiskVolume3\$RECYCLE.BIN\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\books\SpeakOut.pdf
- C:\Users\Public\Recorded TV\Sample Media\HELP_RESTORE_FILES.txt
- C:\Users\Public\Pictures\HELP_RESTORE_FILES.txt
- C:\Users\Public\Videos\HELP_RESTORE_FILES.txt
- %HOMEPATH%\HELP_RESTORE_FILES.txt
- C:\Users\Public\Music\HELP_RESTORE_FILES.txt
- C:\Users\Public\Music\Sample Music\HELP_RESTORE_FILES.txt
- C:\Users\Public\Pictures\Sample Pictures\HELP_RESTORE_FILES.txt
- C:\Users\Public\Downloads\HELP_RESTORE_FILES.txt
- C:\Users\Public\Libraries\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\books\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\music\Би2\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\music\Тату\Liudi invalidy\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\music\Агент Смит\2007 Город Не Спит\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\music\Агент Смит\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Desktop\HELP_RESTORE_FILES.bmp
- %HOMEPATH%\Desktop\CryptoLocker.lnk
- \Device\HarddiskVolume3\music\Тату\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\music\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\music\Агент Смит\2007 Город Не Спит\index.txt
- \Device\HarddiskVolume3\music\Armin van Buuren\Armin van Buuren - 10 years\CD1\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\music\Armin van Buuren\Armin van Buuren - 10 years\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\music\Armin van Buuren\Armin van Buuren - 10 years\Bonus\Armin van Buuren - 10 Years.m3u
- \Device\HarddiskVolume3\music\Armin van Buuren\Armin van Buuren - 10 years\Bonus\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\music\DJ Nil Виниловые пляски - Жара\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\music\Агент Смит\2007 Город Не Спит\cover.jpg
- \Device\HarddiskVolume3\music\Armin van Buuren\HELP_RESTORE_FILES.txt
- \Device\HarddiskVolume3\music\DJ Nil Виниловые пляски - Жара\zara.jpg
- %HOMEPATH%\voip\HELP_RESTORE_FILES.txt
- %APPDATA%\Roaming\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Contacts\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\HELP_RESTORE_FILES.txt
- %APPDATA%\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Music\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Pictures\HELP_RESTORE_FILES.txt
- %APPDATA%\Roaming\Microsoft\Windows\Cookies\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Desktop\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Sun\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Sun\Java\Deployment\security\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Sun\Java\Deployment\tmp\si\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Microsoft\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Sun\Java\AU\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Sun\Java\jre1.8.0_11\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Sun\Java\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Sun\Java\Deployment\tmp\HELP_RESTORE_FILES.txt
- <LS_APPDATA>Low\Sun\Java\Deployment\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Videos\HELP_RESTORE_FILES.txt
- %APPDATA%\Roaming\Microsoft\Windows\Recent\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Saved Games\HELP_RESTORE_FILES.txt
- %APPDATA%\Roaming\Microsoft\Windows\Network Shortcuts\HELP_RESTORE_FILES.txt
- %APPDATA%\Roaming\Microsoft\Windows\Printer Shortcuts\HELP_RESTORE_FILES.txt
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\HELP_RESTORE_FILES.txt
- %APPDATA%\Roaming\Microsoft\Windows\Templates\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Searches\HELP_RESTORE_FILES.txt
- %APPDATA%\Roaming\Microsoft\Windows\SendTo\HELP_RESTORE_FILES.txt
- <LS_APPDATA>\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Favorites\Links\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Favorites\Microsoft Websites\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Documents\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Downloads\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Favorites\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Links\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Favorites\MSN Websites\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Favorites\Windows Live\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\MF\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\IlsCache\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Media Player\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Network\Downloader\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Network\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\NetFramework\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Network\Connections\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\IdentityCRL\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\DeviceSync\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Task\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\eHome\logs\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\eHome\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\DRM\Server\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\DRM\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\RAC\Outbound\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Temp\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\RAC\Temp\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\RAC\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\RAC\PublishedData\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\RAC\StateData\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Config\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\HELP_RESTORE_FILES.txt
- C:\Recovery\HELP_RESTORE_FILES.txt
- <Auxiliary element>
- C:\PerfLogs\HELP_RESTORE_FILES.txt
- C:\Recovery\1f81b231-1de2-11e4-b170-f6484b474a13\HELP_RESTORE_FILES.txt
- C:\ProgramData\HELP_RESTORE_FILES.txt
- C:\Users\Public\Desktop\HELP_RESTORE_FILES.txt
- C:\totalcmd\LANGUAGE\HELP_RESTORE_FILES.txt
- C:\totalcmd\HELP_RESTORE_FILES.txt
- C:\PerfLogs\Admin\HELP_RESTORE_FILES.txt
- %HOMEPATH%\Documents\RECOVERY_KEY.TXT
- %APPDATA%\Roaming\log.html
- %APPDATA%\Roaming\bntwtek.exe
- %APPDATA%\Roaming\key.dat
- <Current directory>\HELP_RESTORE_FILES.txt
- C:\Users\HELP_RESTORE_FILES.txt
- C:\$Recycle.Bin\S-1-5-21-2832440558-3064306045-1455513625-1000\HELP_RESTORE_FILES.txt
- C:\$Recycle.Bin\HELP_RESTORE_FILES.txt
- C:\Users\Public\Documents\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\RSA\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Device\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Assistance\Client\1.0\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Assistance\Client\HELP_RESTORE_FILES.txt
- C:\Users\Public\Favorites\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\DSS\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\Keys\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Assistance\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\LocalCopy\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Quarantine\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{530E0921-A5E7-41DC-809D-0892C07A16A6}\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_7.6.7600.256_fa9f59c145989d6f0b41711f5b2db0e982417_cab_06aa7c03\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_vc6redistsetup_e_81f683eaf25a5eb65b84b6ead9f13c45a48e7d43_cab_097aefca\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Templates\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportArchive\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_30b340eb8e02812f59aa5726f432f9eb8f4453d_cab_04570da6\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_f798d2f057d38094f597ee5b2ac850417ab4a15d_cab_06ed1b9a\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_vcredist.exe_d9a1e9f8957f63aeacd7527a3c66aa52491cfb82_cab_097b4098\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_30b340eb8e02812f59aa5726f432f9eb8f4453d_05d6c428\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Support\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Ringtones\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\DRM\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\GameExplorer\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Sqm\Upload\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Sqm\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Sqm\Sessions\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\DRM\Cache\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\User Account Pictures\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Vault\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Search\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\en-US\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\AIT\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Caches\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QIP 2012\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Total Commander\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\HELP_RESTORE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Far Manager 3\HELP_RESTORE_FILES.txt
Moves the following files:
- from \Device\HarddiskVolume3\music\DJ Nil Виниловые пляски - Жара\zara.jpg to \Device\HarddiskVolume3\music\DJ Nil Виниловые пляски - Жара\zara.jpg.ecc
- from \Device\HarddiskVolume3\music\Агент Смит\2007 Город Не Спит\cover.jpg to \Device\HarddiskVolume3\music\Агент Смит\2007 Город Не Спит\cover.jpg.ecc
- from \Device\HarddiskVolume3\music\Агент Смит\2007 Город Не Спит\index.txt to \Device\HarddiskVolume3\music\Агент Смит\2007 Город Не Спит\index.txt.ecc
- from \Device\HarddiskVolume3\music\Armin van Buuren\Armin van Buuren - 10 years\Bonus\Armin van Buuren - 10 Years.m3u to \Device\HarddiskVolume3\music\Armin van Buuren\Armin van Buuren - 10 years\Bonus\Armin van Buuren - 10 Years.m3u.ecc
- from \Device\HarddiskVolume3\books\SpeakOut.pdf to \Device\HarddiskVolume3\books\SpeakOut.pdf.ecc
- from \Device\HarddiskVolume3\books\SpeakOutWorkbook.pdf to \Device\HarddiskVolume3\books\SpeakOutWorkbook.pdf.ecc
- from \Device\HarddiskVolume3\books\Программирование на языке Visual C++ - 2009.pdf to \Device\HarddiskVolume3\books\Программирование на языке Visual C++ - 2009.pdf.ecc
Deletes itself.
Network activity:
UDP:
- DNS ASK 7t#######7vlep5o.42k2bu15.com
- DNS ASK 7t#########lep5o.tor2web.blutmagie.de
- DNS ASK 7t#######7vlep5o.42k2b14.net
- DNS ASK ip##fo.io
- DNS ASK dn#.##ftncsi.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
