Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SysSecurityUpdate' = '<Full path to file>'
Creates the following files on removable media
- <Drive name for removable media>:\huong_dan_giai_ma.txt
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\contoso.cer
Modifies file system
Creates the following files
- nul
- C:\huong_dan_giai_ma.txt
- C:\msocache\huong_dan_giai_ma.txt
- C:\msocache\all users\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\owow64ww.cab.fkby16z
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.msi.fkby16z
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publr.cab.fkby16z
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml.fkby16z
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excellr.cab.fkby16z
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.xml.fkby16z
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlklr.cab.fkby16z
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.msi.fkby16z
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.msi.fkby16z
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.msi.fkby16z
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordlr.cab.fkby16z
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml.fkby16z
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml.fkby16z
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml.fkby16z
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml.fkby16z
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.msi.fkby16z
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\pptlr.cab.fkby16z
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.msi.fkby16z
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.msi.fkby16z
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.fkby16z
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.msi.fkby16z
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.xml.fkby16z
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.cab.fkby16z
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml.fkby16z
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.msi.fkby16z
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.fkby16z
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\inflr.cab.fkby16z
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.cab.fkby16z
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.cab.fkby16z
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.xml.fkby16z
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.xml.fkby16z
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.msi.fkby16z
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.msi.fkby16z
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovelr.cab.fkby16z
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.xml.fkby16z
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.msi.fkby16z
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.xml.fkby16z
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.msi.fkby16z
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.cab.fkby16z
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.xml.fkby16z
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.xml.fkby16z
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.cab.fkby16z
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.xml.fkby16z
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.msi.fkby16z
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.xml.fkby16z
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.msi.fkby16z
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.fkby16z
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onotelr.cab.fkby16z
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.msi.fkby16z
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\offsetlr.cab.fkby16z
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.xml.fkby16z
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.msi.fkby16z
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.cab.fkby16z
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\branding.xml.fkby16z
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\shellui.mst.fkby16z
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemuiset.xml.fkby16z
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\pss10r.chm.fkby16z
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemuiset.msi.fkby16z
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64mui.xml.fkby16z
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64muiset.xml.fkby16z
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64muiset.msi.fkby16z
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64mui.msi.fkby16z
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\owow64lr.cab.fkby16z
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemui.msi.fkby16z
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemui.xml.fkby16z
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\setup.chm.fkby16z
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\branding.xml.fkby16z
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.msi.fkby16z
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officelr.cab.fkby16z
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.msi.fkby16z
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.xml.fkby16z
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.xml.fkby16z
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\acclr.cab.fkby16z
- C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\huong_dan_giai_ma.txt
- C:\perflogs\huong_dan_giai_ma.txt
- C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\setup.xml.fkby16z
- C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.xml.fkby16z
- C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.msi.fkby16z
- C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.cab.fkby16z
- %ALLUSERSPROFILE%\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\adobe\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\adobe\setup\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.fkby16z
- %ALLUSERSPROFILE%\microsoft\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\appv\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.fkby16z
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.fkby16z
- %ALLUSERSPROFILE%\microsoft\appv\setup\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.fkby16z
- %ALLUSERSPROFILE%\microsoft\crypto\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\crypto\dss\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\crypto\keys\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\crypto\pcpksp\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\drm\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\drm\server\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\customtraceprofiles\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedscenarios\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.allow.json.fkby16z
- %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.tracing.json.fkby16z
- %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.app.json.fkby16z
- %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.privacy.json.fkby16z
- %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\telemetry.asm-windowsdefault.json.fkby16z
- %ALLUSERSPROFILE%\microsoft\diagnosis\etllogs\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\etllogs\autologger\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\etllogs\scenarioshutdownlogger\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\etllogs\shutdownlogger\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\eventtranscript\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\feedbackhub\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\localtracestore\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\eventstore.db.fkby16z
- %ALLUSERSPROFILE%\microsoft\diagnosis\sideload\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\siufloc\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\softlanding\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\softlandingstage\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\eventstore.db.fkby16z
- %ALLUSERSPROFILE%\microsoft\diagnosis\temp\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\temp\diagtracktraceslot_alternativetrace\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\temp\diagtracktraceslot_aot\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\temp\diagtracktraceslot_diag\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\temp\diagtracktraceslot_minitrace\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1501020060.msp.fkby16z
- %ALLUSERSPROFILE%\microsoft\diagnosis\timetraveldebuggingstorage\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.fkby16z
- %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\channels\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\eventstore.db.fkby16z
- %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\identitycrl\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\identitycrl\int\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\identitycrl\production\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\mf\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\mapdata\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\netframework\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\netframework\breadcrumbstore\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\network\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\network\connections\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_45_22.etl.fkby16z
- %ALLUSERSPROFILE%\microsoft\identitycrl\int\wlidsvcconfig.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\mf\pending.grl.fkby16z
- %ALLUSERSPROFILE%\microsoft\network\downloader\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_6_21.etl.fkby16z
- %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_5_7.etl.fkby16z
- %ALLUSERSPROFILE%\microsoft\office\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\identitycrl\production\wlidsvcconfig.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\network\downloader\edb.chk.fkby16z
- %ALLUSERSPROFILE%\microsoft\mf\active.grl.fkby16z
- %ALLUSERSPROFILE%\microsoft\office\heartbeat\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\network\downloader\edbres00001.jrs.fkby16z
- %ALLUSERSPROFILE%\microsoft\network\downloader\edbtmp.log.fkby16z
- %ALLUSERSPROFILE%\microsoft\network\downloader\edb.log.fkby16z
- %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.fkby16z
- %ALLUSERSPROFILE%\microsoft\provisioning\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.jfm.fkby16z
- %ALLUSERSPROFILE%\microsoft\search\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\search\data\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\search\data\applications\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.fkby16z
- %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.db.fkby16z
- %ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.fkby16z
- %ALLUSERSPROFILE%\microsoft\network\downloader\edbres00002.jrs.fkby16z
- %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.fkby16z
- %ALLUSERSPROFILE%\microsoft\search\data\temp\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.fkby16z
- %ALLUSERSPROFILE%\microsoft\settings\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\office\mysite.ico.fkby16z
- %ALLUSERSPROFILE%\microsoft\settings\accounts\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\smsrouter\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\spectrum\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\smsinterceptstore.db.fkby16z
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\smsinterceptstore.jfm.fkby16z
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb.log.fkby16z
- %ALLUSERSPROFILE%\microsoft\speech_onecore\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\storage health\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbtmp.log.fkby16z
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb.chk.fkby16z
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbres00001.jrs.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbres00002.jrs.fkby16z
- %ALLUSERSPROFILE%\microsoft\storage health\storagehealthmodel.dat.fkby16z
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb00002.log.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftinternetexplorer2013.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\scripts\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013win32.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\desktopsettings2013.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\templates\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016backupwin32.xml.fkby16z
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2013win64.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftinternetexplorer2013backup.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftnotepad.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate2013a.xsd.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2010.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\easeofaccesssettings2013.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\user account pictures\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013win64.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2013win32.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate2013.xsd.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016backupwin64.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016win32.xml.fkby16z
- %ALLUSERSPROFILE%\microsoft\vault\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp.fkby16z
- %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate.xsd.fkby16z
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\wdf\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch.fkby16z
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch.fkby16z
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch.fkby16z
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol.fkby16z
- %ALLUSERSPROFILE%\microsoft\wpd\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\winmsipc\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\winmsipc\server\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft\wwansvc\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft help\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft help\ms.excel.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.databasecompare.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.graph.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\mozilla\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft help\ms.spreadsheetcompare.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.winword.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.msaccess.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\mozilla\uninstall_ping_308046b0af4a39cb_2e7ebf48-2503-4ffa-a4d1-c79a82df0a6b.json.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.lync_basic.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.skypefb_online.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.setlang.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.lync.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.msouc.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\nslist.hxl.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.skypefb_basic.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\mozilla\profile_count_308046b0af4a39cb.json.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.powerpnt.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.mspub.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.lync_online.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.skypefb.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\mozilla\updates\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\microsoft help\ms.skypefb_onlineg.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.onenote.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\microsoft help\ms.outlook.16.1033.hxn.fkby16z
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\oracle\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\oracle\java\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\update-config.json.fkby16z
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\oracle\java\javapath\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\update-config.json.fkby16z
- %ALLUSERSPROFILE%\package cache\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm.fkby16z
- %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\state.rsm.fkby16z
- %ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.fkby16z
- %ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\state.rsm.fkby16z
- %ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.fkby16z
- %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm.fkby16z
- %ALLUSERSPROFILE%\packages\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.549981c3f5f10_8wekyb3d8bbwe\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.549981c3f5f10_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.getstarted_8wekyb3d8bbwe\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.getstarted_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.microsoft3dviewer_8wekyb3d8bbwe\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.microsoft3dviewer_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.fkby16z
- %ALLUSERSPROFILE%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.mixedreality.portal_8wekyb3d8bbwe\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.mixedreality.portal_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.office.onenote_8wekyb3d8bbwe\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.office.onenote_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.skypeapp_kzf8qxf38zg5c\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\packages\microsoft.skypeapp_kzf8qxf38zg5c\s-1-5-21-4226853953-3309226944-3078887307-1000\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\softwaredistribution\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\usoshared\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\usoshared\logs\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\usoshared\logs\user\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\regid.1991-06.com.microsoft\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\ssh\huong_dan_giai_ma.txt
- %ALLUSERSPROFILE%\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft microsoft office professional plus 2016.swidtag.fkby16z
- %ALLUSERSPROFILE%\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_windows-10-pro.swidtag.fkby16z
- C:\recovery\huong_dan_giai_ma.txt
- C:\users\huong_dan_giai_ma.txt
- C:\users\default\huong_dan_giai_ma.txt
- C:\users\default\desktop\huong_dan_giai_ma.txt
- C:\users\default\documents\huong_dan_giai_ma.txt
- C:\users\default\downloads\huong_dan_giai_ma.txt
- C:\users\default\favorites\huong_dan_giai_ma.txt
- C:\users\default\links\huong_dan_giai_ma.txt
- C:\users\default\music\huong_dan_giai_ma.txt
- C:\users\default\pictures\huong_dan_giai_ma.txt
- C:\users\default\ntuser.dat.log1.fkby16z
- C:\users\default\ntuser.dat.log2.fkby16z
- C:\users\default\saved games\huong_dan_giai_ma.txt
- C:\users\default\videos\huong_dan_giai_ma.txt
- C:\users\public\huong_dan_giai_ma.txt
- C:\users\public\accountpictures\huong_dan_giai_ma.txt
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000002.regtrans-ms.fkby16z
- C:\users\public\desktop\huong_dan_giai_ma.txt
- C:\users\public\desktop\acrobat reader dc.lnk.fkby16z
- C:\users\public\documents\huong_dan_giai_ma.txt
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tm.blf.fkby16z
- C:\users\public\downloads\huong_dan_giai_ma.txt
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000001.regtrans-ms.fkby16z
- C:\users\public\music\huong_dan_giai_ma.txt
- C:\users\public\pictures\huong_dan_giai_ma.txt
- C:\users\public\videos\huong_dan_giai_ma.txt
- %HOMEPATH%\huong_dan_giai_ma.txt
- C:\users\desktop.ini.fkby16z
- %HOMEPATH%\.oracle_jre_usage\huong_dan_giai_ma.txt
- C:\users\public\desktop\desktop.ini.fkby16z
- %HOMEPATH%\3d objects\huong_dan_giai_ma.txt
- C:\users\public\documents\desktop.ini.fkby16z
- C:\users\public\desktop\firefox.lnk.fkby16z
- %HOMEPATH%\contacts\huong_dan_giai_ma.txt
- C:\users\public\accountpictures\desktop.ini.fkby16z
- C:\users\public\downloads\desktop.ini.fkby16z
- %HOMEPATH%\desktop\huong_dan_giai_ma.txt
- C:\users\public\desktop\microsoft edge.lnk.fkby16z
- %HOMEPATH%\contacts\desktop.ini.fkby16z
- C:\users\public\desktop\mozilla thunderbird.lnk.fkby16z
- C:\users\public\desktop\opera.lnk.fkby16z
- C:\users\public\music\desktop.ini.fkby16z
- %HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp.fkby16z
- C:\users\public\desktop\steam.lnk.fkby16z
- %HOMEPATH%\documents\huong_dan_giai_ma.txt
- C:\users\public\pictures\desktop.ini.fkby16z
- %HOMEPATH%\downloads\huong_dan_giai_ma.txt
- C:\users\public\videos\desktop.ini.fkby16z
- %HOMEPATH%\favorites\huong_dan_giai_ma.txt
- %HOMEPATH%\3d objects\desktop.ini.fkby16z
- C:\users\public\desktop.ini.fkby16z
- %HOMEPATH%\desktop\google chrome.lnk.fkby16z
- %HOMEPATH%\documents\desktop.ini.fkby16z
- %HOMEPATH%\desktop\desktop.ini.fkby16z
- %HOMEPATH%\downloads\desktop.ini.fkby16z
- %HOMEPATH%\favorites\bing.url.fkby16z
- %HOMEPATH%\favorites\links\huong_dan_giai_ma.txt
- %HOMEPATH%\links\huong_dan_giai_ma.txt
- %HOMEPATH%\desktop\telegram.lnk.fkby16z
- %HOMEPATH%\favorites\desktop.ini.fkby16z
- %HOMEPATH%\favorites\links\desktop.ini.fkby16z
- %HOMEPATH%\music\huong_dan_giai_ma.txt
- %HOMEPATH%\links\desktop.ini.fkby16z
- %HOMEPATH%\links\downloads.lnk.fkby16z
- %HOMEPATH%\links\desktop.lnk.fkby16z
- %HOMEPATH%\music\desktop.ini.fkby16z
- %HOMEPATH%\pictures\huong_dan_giai_ma.txt
- %HOMEPATH%\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tm.blf.fkby16z
- %HOMEPATH%\pictures\camera roll\huong_dan_giai_ma.txt
- %HOMEPATH%\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000002.regtrans-ms.fkby16z
- %HOMEPATH%\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000001.regtrans-ms.fkby16z
- %HOMEPATH%\saved games\huong_dan_giai_ma.txt
- %HOMEPATH%\searches\huong_dan_giai_ma.txt
- %HOMEPATH%\videos\huong_dan_giai_ma.txt
- %HOMEPATH%\pictures\desktop.ini.fkby16z
- %HOMEPATH%\saved games\desktop.ini.fkby16z
- %HOMEPATH%\searches\desktop.ini.fkby16z
- C:\kms\huong_dan_giai_ma.txt
- %HOMEPATH%\pictures\camera roll\desktop.ini.fkby16z
- %HOMEPATH%\searches\everywhere.search-ms.fkby16z
- %HOMEPATH%\searches\winrt--{s-1-5-21-4226853953-3309226944-3078887307-1000}-.searchconnector-ms.fkby16z
- %HOMEPATH%\searches\indexed locations.search-ms.fkby16z
- %HOMEPATH%\videos\desktop.ini.fkby16z
- %HOMEPATH%\ntuser.ini.fkby16z
- <Current directory>\huong_dan_giai_ma.txt
- D:\huong_dan_giai_ma.txt
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '<DNS_SERVER>':53
Miscellaneous
Executes the following
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SysSecurityUpdate /t REG_SZ /d <Full path to file> /f
- '<SYSTEM32>\notepad.exe' C:\HUONG_DAN_GIAI_MA.txt
