Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'unlock' = '"c:\Decoding help.hta"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'searchfiles' = '%WINDIR%\searchfiles.exe'
- [<HKLM>\Software\Classes\.[ID]QZw53KyFT5HRJYgA[ID]\shell\open\command] '' = '%WINDIR%\SysWow64\mshta.exe "c:\Decoding help.hta"'
Infects the following executable files
- %CommonProgramFiles(x86)%\microsoft shared\office10\1033\msointl.dll.[id]qzw53kyft5hrjyga[id]
- %CommonProgramFiles(x86)%\microsoft shared\vsto\vstoee.dll.[id]qzw53kyft5hrjyga[id]
- %CommonProgramFiles(x86)%\microsoft shared\vsta\8.0\microsoft.visualstudio.tools.applications.designtime.tlb.[id]qzw53kyft5hrjyga[id]
Creates the following files on removable media
- <Drive name for removable media>:\decoding help.hta
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\archer.avi
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
deletes volume shadow copies.
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\taskhost.exe
- %WINDIR%\syswow64\vssadmin.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %WINDIR%\searchfiles.exe
- %ProgramFiles%\clamtray\decoding help.hta
- %ProgramFiles%\clamscan\decoding help.hta
- %ProgramFiles%\cssexc\decoding help.hta
- %ProgramFiles%\ash\decoding help.hta
- %ProgramFiles%\ashavast\decoding help.hta
- %ProgramFiles%\ashdisp\decoding help.hta
- %ProgramFiles%\ashdug\decoding help.hta
- %ProgramFiles%\ashmaisv\decoding help.hta
- %ProgramFiles%\ashpopwz\decoding help.hta
- %ProgramFiles%\ashavsrv\decoding help.hta
- %ProgramFiles%\ashchest\decoding help.hta
- %ProgramFiles%\ashenhcd\decoding help.hta
- %ProgramFiles%\ashlogv\decoding help.hta
- %ProgramFiles%\ashquick\decoding help.hta
- %ProgramFiles%\ashsimp2\decoding help.hta
- %ProgramFiles%\clamwin\decoding help.hta
- %ProgramFiles%\claw95cf\decoding help.hta
- %ProgramFiles%\avconfig\decoding help.hta
- %ProgramFiles%\cleaner\decoding help.hta
- %ProgramFiles%\avciman\decoding help.hta
- %ProgramFiles%\avadmin\decoding help.hta
- %ProgramFiles%\almon\decoding help.hta
- %ProgramFiles%\alsvc\decoding help.hta
- %ProgramFiles%\amsn\decoding help.hta
- %ProgramFiles%\amon\decoding help.hta
- %ProgramFiles%\b2\decoding help.hta
- %ProgramFiles%\ashwebsv\decoding help.hta
- %ProgramFiles%\courier\decoding help.hta
- %ProgramFiles%\copyx64\decoding help.hta
- %ProgramFiles%\cmgrdian\decoding help.hta
- %ProgramFiles%\cmain\decoding help.hta
- %ProgramFiles%\clrcche\decoding help.hta
- %ProgramFiles%\clisvc\decoding help.hta
- %ProgramFiles%\cleaner3\decoding help.hta
- %ProgramFiles%\ashserv\decoding help.hta
- %ProgramFiles%\claw95\decoding help.hta
- %ProgramFiles%\ashskpcc\decoding help.hta
- %ProgramFiles%\cavemsrv\decoding help.hta
- %ProgramFiles%\cavasm\decoding help.hta
- %ProgramFiles%\cavaud\decoding help.hta
- %ProgramFiles%\cafix\decoding help.hta
- %ProgramFiles%\cavapp\decoding help.hta
- %ProgramFiles%\btini\decoding help.hta
- %ProgramFiles%\blackice\decoding help.hta
- %ProgramFiles%\bdwizreg\decoding help.hta
- %ProgramFiles(x86)%\windows nt\tabletextservice\decoding help.hta
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\decoding help.hta
- %CommonProgramFiles%\microsoft shared\smart tag\decoding help.hta
- %ProgramFiles(x86)%\opera\decoding help.hta
- %ProgramFiles(x86)%\mozilla thunderbird\decoding help.hta
- %ProgramFiles%\a2wizard\decoding help.hta
- %ProgramFiles%\a2cmd\decoding help.hta
- %ProgramFiles%\avgw\decoding help.hta
- %ProgramFiles%\cavmr\decoding help.hta
- %ProgramFiles%\bdnews\decoding help.hta
- %ProgramFiles%\defwatch\decoding help.hta
- %ProgramFiles%\bdss\decoding help.hta
- %ProgramFiles%\dbtool\decoding help.hta
- %ProgramFiles%\cuteftp\decoding help.hta
- %ProgramFiles%\ashsimpl\decoding help.hta
- %ProgramFiles%\ashupd\decoding help.hta
- %ProgramFiles%\avgwizfw\decoding help.hta
- %ProgramFiles%\ashskpck\decoding help.hta
- %ProgramFiles%\autodown\decoding help.hta
- %ProgramFiles%\aswupdsv\decoding help.hta
- %ProgramFiles%\avcenter\decoding help.hta
- %ProgramFiles%\avcmd\decoding help.hta
- %ProgramFiles%\bdmcon\decoding help.hta
- %ProgramFiles%\avscan\decoding help.hta
- %ProgramFiles%\avpm\decoding help.hta
- %ProgramFiles%\blackd\decoding help.hta
- %ProgramFiles%\bdswitch\decoding help.hta
- %ProgramFiles%\dekaron\decoding help.hta
- %ProgramFiles%\avgdiag\decoding help.hta
- %ProgramFiles%\avgfwsrv\decoding help.hta
- %ProgramFiles%\avgnpdln\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\help\1028\decoding help.hta
- %ProgramFiles%\a2scan\decoding help.hta
- %ProgramFiles%\a2start\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\help\3082\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\help\1049\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\help\1046\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\help\1031\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vsta\pipeline.v10.0\contracts\decoding help.hta
- %ProgramFiles(x86)%\microsoft office\office14\1033\decoding help.hta
- %ProgramFiles(x86)%\qip 2012\langs\decoding help.hta
- %ProgramFiles(x86)%\windows portable devices\decoding help.hta
- %ProgramFiles(x86)%\google\chrome\application\decoding help.hta
- %ProgramFiles%\cemrep\decoding help.hta
- %ProgramFiles%\a2guard\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\help\1042\decoding help.hta
- %HOMEPATH%\links\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\help\2052\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\help\1040\decoding help.hta
- %HOMEPATH%\saved games\decoding help.hta
- %APPDATA%\telegram desktop\decoding help.hta
- %APPDATA%\mozilla\firefox\decoding help.hta
- %APPDATA%\mail.ru\agent\decoding help.hta
- %PROGRAMDATA%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\decoding help.hta
- %ProgramFiles(x86)%\k-lite codec pack\icons\decoding help.hta
- C:\far2\addons\setup\decoding help.hta
- %PROGRAMDATA%\microsoft\windows nt\msfax\common coverpages\en-us\decoding help.hta
- %PROGRAMDATA%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\decoding help.hta
- %PROGRAMDATA%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\decoding help.hta
- %CommonProgramFiles(x86)%\system\msadc\en-us\decoding help.hta
- %ProgramFiles(x86)%\qip 2012\plugins\win7helper\decoding help.hta
- %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\decoding help.hta
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\decoding help.hta
- %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\decoding help.hta
- %HOMEPATH%\searches\decoding help.hta
- C:\far2\encyclopedia\tap\decoding help.hta
- %HOMEPATH%\favorites\links\decoding help.hta
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\decoding help.hta
- C:\far2\documentation\rus\decoding help.hta
- %ProgramFiles%\bdsurvey\decoding help.hta
- %ProgramFiles%\bdsubmit\decoding help.hta
- %ProgramFiles%\bdoesrv\decoding help.hta
- %ProgramFiles%\bdagent\decoding help.hta
- %ProgramFiles%\cavmud\decoding help.hta
- %ProgramFiles%\cavoar\decoding help.hta
- %ProgramFiles%\avsynmgr\decoding help.hta
- %ProgramFiles%\avpcc\decoding help.hta
- %ProgramFiles%\avnotify\decoding help.hta
- %ProgramFiles%\avkwctl\decoding help.hta
- %ProgramFiles%\avinitnt\decoding help.hta
- %ProgramFiles%\avgvv\decoding help.hta
- %ProgramFiles%\avgupsvc\decoding help.hta
- %ProgramFiles%\avgrssvc\decoding help.hta
- %ProgramFiles%\aim6\decoding help.hta
- %ProgramFiles%\cpd\decoding help.hta
- %ProgramFiles%\aimpro\decoding help.hta
- %ProgramFiles%\csendto\decoding help.hta
- %HOMEPATH%\music\decoding help.hta
- %ProgramFiles%\admunch\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\help\1041\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\help\1036\decoding help.hta
- C:\users\public\downloads\decoding help.hta
- %ProgramFiles%\anti-trojan\decoding help.hta
- C:\users\public\libraries\decoding help.hta
- %HOMEPATH%\contacts\decoding help.hta
- %ProgramFiles%\a2hijackfree\decoding help.hta
- %ProgramFiles%\avgcc\decoding help.hta
- %ProgramFiles%\a2service\decoding help.hta
- %ProgramFiles%\aavshield\decoding help.hta
- %ProgramFiles(x86)%\qip 2012\core\decoding help.hta
- %ProgramFiles(x86)%\microsoft office\office14\decoding help.hta
- %ProgramFiles%\a2upd\decoding help.hta
- %ProgramFiles%\360tray\decoding help.hta
- %ProgramFiles%\ackwin32\decoding help.hta
- %ProgramFiles%\ageofconan\decoding help.hta
- C:\users\all users\oracle\java\installcache_x64\decoding help.hta
- %ProgramFiles%\avkserv\decoding help.hta
- %PROGRAMDATA%\microsoft\msdn\7.0\1040\decoding help.hta
- C:\users\public\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\ink\1.7\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\ink\1.0\decoding help.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\decoding help.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\decoding help.hta
- %CommonProgramFiles(x86)%\adobe\arm\1.0\decoding help.hta
- %ProgramFiles(x86)%\internet explorer\decoding help.hta
- %PROGRAMDATA%\microsoft\office\decoding help.hta
- %PROGRAMDATA%\microsoft\user account pictures\decoding help.hta
- %PROGRAMDATA%\microsoft\identitycrl\decoding help.hta
- %PROGRAMDATA%\microsoft\mf\decoding help.hta
- %PROGRAMDATA%\microsoft toolkit\decoding help.hta
- %PROGRAMDATA%\microsoft\ilscache\decoding help.hta
- %ProgramFiles%\antivirus\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\office14\1033\decoding help.hta
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vsta\appinfodocument\decoding help.hta
- %PROGRAMDATA%\microsoft\crypto\keys\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vsta\8.0\decoding help.hta
- %CommonProgramFiles(x86)%\adobe\helpcfg\en_us\decoding help.hta
- %CommonProgramFiles(x86)%\system\msadc\decoding help.hta
- %CommonProgramFiles(x86)%\system\en-us\decoding help.hta
- %PROGRAMDATA%\microsoft\user account pictures\default pictures\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vsto\10.0\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\office10\1033\decoding help.hta
- C:\far2\addons\decoding help.hta
- %CommonProgramFiles(x86)%\system\ado\decoding help.hta
- %HOMEPATH%\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\portal\1033\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vsta\pipeline.v10.0\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vc\amd64\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vba\vba6\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\textconv\wksconv\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\msinfo\en-us\decoding help.hta
- %ProgramFiles%\decoding help.hta
- %CommonProgramFiles%\services\decoding help.hta
- %CommonProgramFiles(x86)%\java\java update\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\msinfo\decoding help.hta
- C:\users\decoding help.hta
- %CommonProgramFiles(x86)%\px storage engine\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\ink\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\help\decoding help.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\decoding help.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\msdn\decoding help.hta
- %CommonProgramFiles(x86)%\steam\decoding help.hta
- %CommonProgramFiles(x86)%\services\decoding help.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\decoding help.hta
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
- %ProgramFiles(x86)%\decoding help.hta
- <Current directory>\decoding help.hta
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
- C:\decoding help.hta
- C:\totalcmd\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\dao\decoding help.hta
- %PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\information retrieval\decoding help.hta
- %PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\stationery\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\office10\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vsto\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\msenv\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\office14\decoding help.hta
- C:\far2\decoding help.hta
- %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\decoding help.hta
- C:\users\default\decoding help.hta
- %PROGRAMDATA%\decoding help.hta
- %CommonProgramFiles(x86)%\system\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vgx\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\portal\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vc\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\1033\decoding help.hta
- %PROGRAMDATA%\mozilla\logs\decoding help.hta
- %PROGRAMDATA%\microsoft\windows nt\msscan\decoding help.hta
- %PROGRAMDATA%\microsoft\rac\publisheddata\decoding help.hta
- %ProgramFiles%\ccapp\decoding help.hta
- %ProgramFiles%\cavumas\decoding help.hta
- %ProgramFiles%\cavse\decoding help.hta
- %ProgramFiles%\cavscons\decoding help.hta
- %ProgramFiles%\btinint\decoding help.hta
- %ProgramFiles%\avconsol\decoding help.hta
- %ProgramFiles%\chrome\decoding help.hta
- %ProgramFiles%\ccproxy\decoding help.hta
- %ProgramFiles%\ccevtmgr\decoding help.hta
- %ProgramFiles%\ccleaner\decoding help.hta
- %ProgramFiles%\cavvl\decoding help.hta
- %ProgramFiles%\cavq\decoding help.hta
- %ProgramFiles%\cavsn\decoding help.hta
- %ProgramFiles%\cavsub\decoding help.hta
- %ProgramFiles%\avgupden\decoding help.hta
- %ProgramFiles%\avgnpsvc\decoding help.hta
- %ProgramFiles%\avgscan\decoding help.hta
- %ProgramFiles%\ccsetmgr\decoding help.hta
- %ProgramFiles%\blindman\decoding help.hta
- C:\users\all users\microsoft\rac\statedata\racwmidatabookmarks.dat.[id]qzw53kyft5hrjyga[id]
- %PROGRAMDATA%\microsoft\msdn\7.0\2052\decoding help.hta
- %PROGRAMDATA%\microsoft\msdn\7.0\1050\decoding help.hta
- %PROGRAMDATA%\microsoft\msdn\7.0\1049\decoding help.hta
- %PROGRAMDATA%\microsoft\msdn\7.0\1046\decoding help.hta
- %PROGRAMDATA%\microsoft\msdn\7.0\1042\decoding help.hta
- %PROGRAMDATA%\microsoft\msdn\7.0\1041\decoding help.hta
- C:\users\all users\oracle\java\javapath\decoding help.hta
- %HOMEPATH%\favorites\microsoft websites\decoding help.hta
- %PROGRAMDATA%\microsoft\assistance\client\1.0\en-us\decoding help.hta
- C:\users\public\videos\sample videos\decoding help.hta
- C:\far2\addons\colors\default_highlighting\decoding help.hta
- %ProgramFiles(x86)%\microsoft office\office10\decoding help.hta
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vsta\pipeline.v10.0\hostsideadapters\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\help\1033\decoding help.hta
- %ProgramFiles%\avginet\decoding help.hta
- %ProgramFiles%\avgemc\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vsta\pipeline.v10.0\addinsideadapters\decoding help.hta
- C:\users\public\pictures\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vsta\pipeline.v10.0\addinviews\decoding help.hta
- C:\users\public\videos\decoding help.hta
- %HOMEPATH%\downloads\decoding help.hta
- %HOMEPATH%\favorites\decoding help.hta
- %HOMEPATH%\documents\decoding help.hta
- C:\users\public\music\decoding help.hta
- %HOMEPATH%\desktop\decoding help.hta
- C:\users\public\documents\decoding help.hta
- %ProgramFiles(x86)%\internet explorer\en-us\decoding help.hta
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\ink\en-us\decoding help.hta
- %PROGRAMDATA%\microsoft\rac\statedata\decoding help.hta
- %PROGRAMDATA%\microsoft\network\downloader\decoding help.hta
- %HOMEPATH%\pictures\decoding help.hta
- %CommonProgramFiles(x86)%\system\ado\en-us\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\web server extensions\14\bin\decoding help.hta
- C:\far2\encyclopedia\decoding help.hta
- %ProgramFiles%\airdefense\decoding help.hta
- %HOMEPATH%\videos\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vsta\appinfodocument\microsoft.visualstudio.tools.office.appinfodocument\decoding help.hta
- %CommonProgramFiles(x86)%\microsoft shared\vsto\10.0\1033\decoding help.hta
- C:\users\public\desktop\decoding help.hta
- %ProgramFiles(x86)%\mirc\decoding help.hta
- %ProgramFiles(x86)%\mozilla firefox\decoding help.hta
- %ProgramFiles(x86)%\k-lite codec pack\decoding help.hta
- %ProgramFiles(x86)%\qip 2012\decoding help.hta
- C:\users\all users\microsoft\rac\statedata\racwmieventdata.dat.[id]qzw53kyft5hrjyga[id]
- %ProgramFiles(x86)%\windows media player\decoding help.hta
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\decoding help.hta
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\decoding help.hta
- C:\far2\addons\colors\custom_highlighting\decoding help.hta
- C:\far2\documentation\eng\decoding help.hta
- C:\far2\addons\colors\decoding help.hta
- C:\far2\addons\macros\decoding help.hta
- %ProgramFiles%\agb5\decoding help.hta
- <LS_APPDATA>\decoding help.hta
Moves the following files
- from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\desktop.ini.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\mozilla thunderbird\accessiblemarshal.dll to %ProgramFiles(x86)%\mozilla thunderbird\accessiblemarshal.dll.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\a2wizard.exe.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\a2cmd.exe.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles%\avgw\avgw.exe to %ProgramFiles%\avgw\avgw.exe.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles%\avgcc\avgcc.exe to %ProgramFiles%\avgcc\avgcc.exe.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles%\avkserv\avkserv.exe to %ProgramFiles%\avkserv\avkserv.exe.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-bold.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-bold.otf.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd.otf.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-oblique.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-oblique.otf.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-boldoblique.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-boldoblique.otf.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-bold.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-bold.otf.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\adobepistd.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\adobepistd.otf.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles%\desktop.ini to %ProgramFiles%\desktop.ini.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles%\antivirus\antivirus.exe to %ProgramFiles%\antivirus\antivirus.exe.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\enutxt.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\enutxt.pdf.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.xml.[id]qzw53kyft5hrjyga[id]
- from %ProgramFiles(x86)%\microsoft office\office10\msostyle.dll to %ProgramFiles(x86)%\microsoft office\office10\msostyle.dll.[id]qzw53kyft5hrjyga[id]
Substitutes the following executable files
- <Full path to file>
Substitutes the following files
- %CommonProgramFiles(x86)%\Services\verisign.bmp
- %CommonProgramFiles%\Services\verisign.bmp
Moves itself
- from <Full path to file> to <Full path to file>.[id]qzw53kyft5hrjyga[id]
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all