Trojan.Encoder.40824

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BabyLockerKZ' = '"<Full path to file>"'

Creates the following files on removable media

<Drive name for removable media>:\how_to_back_files.html
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\64bit_notes.htm
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\about.htm

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'<SYSTEM32>\taskkill.exe' -f -im sqlbrowser.exe
'<SYSTEM32>\net.exe' stop SQLBrowser
'<SYSTEM32>\net.exe' stop SQLAgent$MSFW
'<SYSTEM32>\net.exe' stop SQLAgent$ISARS
'<SYSTEM32>\net.exe' stop MSSQL$MSFW
'<SYSTEM32>\net.exe' stop MSSQL$ISARS
'<SYSTEM32>\net.exe' stop MSSQLServerADHelper100
'<SYSTEM32>\taskkill.exe' -f -impostgres.exe
'<SYSTEM32>\taskkill.exe' -f -im pg_ctl.exe
'<SYSTEM32>\taskkill.exe' -f -im msftesql.exe
'<SYSTEM32>\taskkill.exe' -f -im ReportingServicesService.exe
'<SYSTEM32>\taskkill.exe' -f -im fdhost.exe
'<SYSTEM32>\taskkill.exe' -f -im SQLAGENT.EXE
'<SYSTEM32>\taskkill.exe' -f -im Ssms.exe
'<SYSTEM32>\taskkill.exe' -f -im fdlauncher.exe
'<SYSTEM32>\taskkill.exe' -f -im sqlceip.exe
'<SYSTEM32>\taskkill.exe' -f -im MsDtsSrvr.exe
'<SYSTEM32>\taskkill.exe' -f -im msmdsrv.exe
'<SYSTEM32>\taskkill.exe' -f -im sqlserv.exe
'<SYSTEM32>\taskkill.exe' -f -im sql writer.exe
'<SYSTEM32>\net.exe' stop REportServer$ISARS
'<SYSTEM32>\net.exe' stop SQLWriter

Injects code into

the following system processes:

<SYSTEM32>\wbadmin.exe
<SYSTEM32>\vssadmin.exe

Modifies file system

Creates the following files

C:\how_to_back_files.html
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\how_to_back_files.html
%ALLUSERSPROFILE%\oracle\how_to_back_files.html
%ALLUSERSPROFILE%\oracle\java\how_to_back_files.html
%ALLUSERSPROFILE%\oracle\java\installcache_x64\how_to_back_files.html
%ALLUSERSPROFILE%\oracle\java\javapath\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\how_to_back_files.html
%ALLUSERSPROFILE%\mozilla\updates\how_to_back_files.html
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\how_to_back_files.html
%ALLUSERSPROFILE%\mozilla\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft help\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\wwansvc\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0765adcf\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_528c94ccf5464e2e06249b41105333fcda5052_cab_02612a57\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\localcopy\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4017a4527469f9d5b499a101a973ca853f881d9_cab_02612a66\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\support\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\wpd\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\how_to_back_files.html
%HOMEPATH%\favorites\links\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\how_to_back_files.html
C:\users\default\downloads\how_to_back_files.html
C:\users\default\favorites\how_to_back_files.html
C:\users\default\links\how_to_back_files.html
C:\users\default\music\how_to_back_files.html
C:\users\default\pictures\how_to_back_files.html
C:\users\default\saved games\how_to_back_files.html
C:\users\default\videos\how_to_back_files.html
C:\users\public\how_to_back_files.html
C:\users\public\desktop\how_to_back_files.html
C:\users\public\documents\how_to_back_files.html
C:\users\public\downloads\how_to_back_files.html
C:\users\public\favorites\how_to_back_files.html
C:\users\default\desktop\how_to_back_files.html
C:\users\default\documents\how_to_back_files.html
C:\users\public\libraries\how_to_back_files.html
C:\users\public\pictures\how_to_back_files.html
C:\users\public\pictures\sample pictures\how_to_back_files.html
C:\users\public\recorded tv\how_to_back_files.html
C:\users\public\recorded tv\sample media\how_to_back_files.html
C:\users\public\videos\how_to_back_files.html
C:\users\public\videos\sample videos\how_to_back_files.html
%HOMEPATH%\how_to_back_files.html
%HOMEPATH%\contacts\how_to_back_files.html
%HOMEPATH%\desktop\how_to_back_files.html
%HOMEPATH%\documents\how_to_back_files.html
%HOMEPATH%\downloads\how_to_back_files.html
%HOMEPATH%\favorites\how_to_back_files.html
C:\users\public\music\how_to_back_files.html
C:\users\public\music\sample music\how_to_back_files.html
C:\users\default\how_to_back_files.html
%ALLUSERSPROFILE%\sun\java\java update\how_to_back_files.html
%ALLUSERSPROFILE%\sun\java\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\vcruntimeadditional_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\vcruntimeminimum_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\how_to_back_files.html
%ALLUSERSPROFILE%\sun\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportarchive\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\8.0\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\client\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\dss\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\keys\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\device\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\devicesync\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\drm\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\drm\server\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\ehome\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\ehome\logs\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\identitycrl\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\media player\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\mf\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\setup\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\how_to_back_files.html
C:\msocache\how_to_back_files.html
a:\how_to_back_files.html
D:\how_to_back_files.html
C:\msocache\all users\how_to_back_files.html
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\how_to_back_files.html
C:\kms\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\how_to_back_files.html
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\how_to_back_files.html
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\how_to_back_files.html
<Current directory>\how_to_back_files.html
C:\users\how_to_back_files.html
%ALLUSERSPROFILE%\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\s\how_to_back_files.html
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\network\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\templates\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\network\connections\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\drm\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\drm\cache\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\gameexplorer\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\power efficiency diagnostics\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\ringtones\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\manifest\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\sessions\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\upload\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tablet pc\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\caches\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\ait\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\outbound\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\statedata\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\temp\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\network\downloader\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\config\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\temp\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\user account pictures\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\vault\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\how_to_back_files.html
%HOMEPATH%\favorites\links for united states\how_to_back_files.html

Modifies the following files

C:\kms\kms_vl_all_aio.cmd
C:\kms\kms_vl_all_aio_debug.log
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\cveuropeo.doc

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Restarts the analyzed sample

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
'<SYSTEM32>\cmd.exe' /c net stop REportServer$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS
'<SYSTEM32>\net1.exe' stop SQLBrowser
'<SYSTEM32>\cmd.exe' /c net stop SQLBrowser
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
'<SYSTEM32>\net1.exe' stop SQLAgent$MSFW
'<SYSTEM32>\net1.exe' stop REportServer$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
'<SYSTEM32>\net1.exe' stop SQLAgent$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
'<SYSTEM32>\net1.exe' stop MSSQL$MSFW
'<SYSTEM32>\cmd.exe' /c net stop MSSQL$MSFW
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
'<SYSTEM32>\net1.exe' stop MSSQL$ISARS
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\cmd.exe' /c net stop MSSQL$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
'<SYSTEM32>\cmd.exe' /c net stop SQLAgent$ISARS
'<SYSTEM32>\cmd.exe' /c net stop SQLWriter
'<SYSTEM32>\wbem\wmic.exe' SHADOWCOPY /nointeractive
'<SYSTEM32>\net1.exe' stop SQLWriter
'<SYSTEM32>\bcdedit.exe' /set {default} recoverynabled No
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTABACKUP -deleteOldest
'<SYSTEM32>\wbadmin.exe' delete backup -keepVersion:0 -quiet
'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
'<SYSTEM32>\cmd.exe' /c wmic.exe SHADOWCOPY /nointeractive
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
'<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} recoverynabled No
'<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c wbadmin delete backup -keepVersion:0 -quiet
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c net stop SQLAgent$MSFW
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
'<SYSTEM32>\cmd.exe' /c net stop MSSQLServerADHelper100
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
'<SYSTEM32>\net1.exe' stop MSSQLServerADHelper100
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\cmd.exe' /c taskkill -f -impostgres.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlceip.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im MsDtsSrvr.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im Ssms.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im msmdsrv.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlserv.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sql writer.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im fdlauncher.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlbrowser.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
'<SYSTEM32>\cmd.exe' /c rem Kill "SQL"
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
'<SYSTEM32>\cmd.exe' /c pause
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im msftesql.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im ReportingServicesService.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im pg_ctl.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im fdhost.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im SQLAGENT.EXE
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLWriter' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial