Discovered by 0x4143, CNH encrypts files and appends the ".cnh" extension to filenames. For example, "1.jpg" is renamed to "1.jpg.cnh", "2.jpg" to "2.jpg.cnh", and so on. It also creates the "README.txt" file, a ransom message with contact information. The "README.txt" text file is a short ran
NewPDFSearch is dubious software categorized as a browser hijacker. It makes modifications to browser settings to promote newpdfsearch.com (a fake search engine). Browser hijackers are usually able to track browsing-related data, and it is likely that NewPDFSearch operates in this manner as well.
PDFConverterSearcher changes assigns specific browser settings to pdfconvertersearcher.com, the address of a fake search engine. Like most browser hijackers, PDFConverterSearcher changes these settings without users' permission. This app can also read browsing-related and possibly other informatio
LyDark is malicious software, which is part of the Xorist ransomware family. It is designed to encrypt data and demand payment for decryption. During the encryption process, all affected files are appended with the ".LyDark" extension. For example, a file originally named something like "1.jpg" wo
PAYMENT belongs to the Phobos ransomware family. It is designed to encrypt files, rename each encrypted file, display a ransom message, and create the "info.txt" text file (second ransom message). PAYMENT renames files by adding the victim's ID, the ICQ username of its developers, and appending t
"Advance Payment Received" is a spam email campaign. This term refers to a mass-scale operation, during which thousands of deceptive emails are sent. The messages sent through this spam campaign are presented as notifications concerning a purchase order. Note that "Advance Payment Received" email
luckhours[.]com is similar to many other websites of this type. For example, hipermovies[.]website, thgworldwideblog[.]com and novaidea[.]biz. Usually, browsers open these web pages when potentially unwanted applications (PUAs) are installed on them, or users click dubious ads or visit bogus web p
"Cisco WebEx virus" is a generic term used to describe unwanted and malicious software, distributed and disguised as content relating to Cisco Webex products. Cisco Webex is the name of a legitimate company developing web conferencing and videoconferencing software, notably Webex Meetings, Webex
yourwownews[.]com is a rogue website sharing many common traits with thgworldwideblog.com, purplemedia.biz, check-this.news, and countless of others. Visitors to this page are presented with dubious content and/or redirected to other untrustworthy or possibly malicious sites. These websites are r
The HDMovieSearch browser hijacker promotes hdmoviesearch.com, the address of a fake search engine. Like most sites of this type, it achieves this by changing browser settings without users' permission. This app can also read browsing-related information. Note that browser hijackers are often dow