Search
Keyword: bat
agdl ai aiff aii air ais ait aiv al alg allet ams aocla aoi apj apk arc arch00 arm art arw arz asc asf asm asp aspx asset asx avhdx avi awg backup backupdb bank bar bat bay bc6 bc7 bck bco bdb bgt big
following list: asp bak c cpp doc htm html jpg mp3 mpeg mpg pas pdf rtf txt wab xls {random extension 2} is chosen from the following list: bat exe pif scr W32.Klez.H@mm(Symantec), W32/Klez.h@MM(McAfee),
asset asw asx asy aty avatar awdb awp awt aww azz backup bad bak bar bat bay bbs bc6 bc7 bdb bdp bdr bean bib big bik bkf bkp blend blkrt blob bm2 bmp bmx bmz bna bnd boc bok brk brn brt bsa bss btd bti
System Modifications This Trojan modifies the following file(s): It encrypts files and appends the extension .RARE1 Other Details This Trojan encrypts files with the following extensions: bat bay bc6 bc7
automaticdestinations-ms avd avdata avhdx avi avs awg azf azs azw azw1 azw3 azw4 b2a bac back backup backupdb bad bak bank bar bat bay bc6 bc7 bck bcp bdb bdp bdr bfa bgt bi8 bib bic big bik bin bkf bkp bkup blend blob blp
encrypting files with the following extensions: application bat cmd com cpl dll exe gadget hta msc msi msp pif scf scr sys It avoids encrypting files with the following file names: p0r4dime.1! thumbs.db It
extensions: 123 602 3dm 3ds 3g2 3gp 7z accdb aes ai ARC asc asf asm asp avi backup bak bat bmp brd bz2 c cgm class cmd cpp crt cs csr csv dat db dbf dch der dif dip djvu doc docb docm docx dot dotm dotx dwg ec
WinSCP VPN: OpenVPN Messaging Applications: Telegram Email Applications: Thunderbird Foxmail Outlook The BAT Password Manager: KeePass Others: Discord Steam Stickynotes Simple Sticky Notes Wallets: Ronin
Applications: Thunderbird Foxmail Outlook The BAT Password Manager: KeePass Others: Discord Steam Stickynotes Simple Sticky Notes Wallets: Ronin MetaMask Vigvam OKEx Wallet Keplr Avana Wallet Ethereum Electrum
account-report approved-password document email-details email-password important-details new-password password readme updated-password (with any of the following extension names) BAT CMD EXE PIF SCR ZIP It may
afternoon bat beach blank catch chain consideration cream crew detail gold interview kid mark match mission pain pleasure score screw sex shop shower suit tone window agent band block bone calendar cap coat
It drops the following file(s) as ransom note: rPAJXSFqhw-RECOVER-README.txt It avoids encrypting files with the following file extensions: 386 adv ani bat bin cmd com cpl cur deskthemepack diagcab
FeOtgcjByd It drops the following file(s) as ransom note: FeOtgcjByd-RECOVER-README.txt It avoids encrypting files with the following file extensions: 386 adv ani bat bin cmd com cpl cur deskthemepack diagcab
ntuser.ini ntldr boot.ini File extensions: msi mpa ps1 lnk icl hlp diagcfg cab icns nls drv key cur ldf ics com 386 ico mod scr cmd deskthemepack exe themepack cpl spl msu hta ani dll msc diagcab rom bat
mod ps1 msi rom key cpl rtp bat spl hta File name: autorun.inf boot.ini bootfont.bin bootsect.bak desktop.ini iconcache.db ntldr ntuser.dat ntuser.dat.log ntuser.ini thumbs.db It avoids encrypting files
the following strings in their file name: File Extensions: theme shs ico hlp msu rtp msstyles diagcab lock rom ics cur prf icns bat cmd nls deskthemepack com ldf icl mpa ps1 key diagcfg idx ocx drv ani
with the following strings in their file name: File extensions: 386 adv ani bat bin cab cmd com cpl cur deskthemepack diagcab diagcfg diagpkg dll drv exe hlp hta icl icns ico ics idx key ldf lnk lock mod
bat bin cab cmd com cpl cur deskthemepack diagcab diagcfg diagpkg dll drv exe hlp hta icl icns ico ics idx key ldf lnk lock mod mpa msc msi msp msstyles msu nls nomedia ocx prf ps1 rom rtp scr shs spl
network resources. Ransomware Routine This Ransomware avoids encrypting files with the following strings in their file name: File extensions: 386 adv ani bat bin cab cmd com cpl cur deskthemepack diagcab
ico bat cab adv diagcfg idx cpl dll ps1 mod msp themepack bin ics msi diagcab ani nls com ldf deskthemep prf spl hta mpa sys icl icns cmd drv diagpkg File name: ntuser.ini autorun.inf bootsect.bak ntldr