Trojan.Encoder.29025

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'unlock' = '"c:\Decoding help.hta"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'searchfiles' = '%WINDIR%\searchfiles.exe'
[<HKLM>\Software\Classes\.[ID]QZw53KyFT5HRJYgA[ID]\shell\open\command] '' = '%WINDIR%\SysWow64\mshta.exe "c:\Decoding help.hta"'

Infects the following executable files

%CommonProgramFiles(x86)%\microsoft shared\office10\1033\msointl.dll.[id]qzw53kyft5hrjyga[id]
%CommonProgramFiles(x86)%\microsoft shared\vsto\vstoee.dll.[id]qzw53kyft5hrjyga[id]
%CommonProgramFiles(x86)%\microsoft shared\vsta\8.0\microsoft.visualstudio.tools.applications.designtime.tlb.[id]qzw53kyft5hrjyga[id]

Creates the following files on removable media

<Drive name for removable media>:\decoding help.hta
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\archer.avi

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

deletes volume shadow copies.

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\taskhost.exe
%WINDIR%\syswow64\vssadmin.exe

the following user processes:

iexplore.exe
firefox.exe

Modifies file system

Creates the following files

%WINDIR%\searchfiles.exe
%ProgramFiles%\clamtray\decoding help.hta
%ProgramFiles%\clamscan\decoding help.hta
%ProgramFiles%\cssexc\decoding help.hta
%ProgramFiles%\ash\decoding help.hta
%ProgramFiles%\ashavast\decoding help.hta
%ProgramFiles%\ashdisp\decoding help.hta
%ProgramFiles%\ashdug\decoding help.hta
%ProgramFiles%\ashmaisv\decoding help.hta
%ProgramFiles%\ashpopwz\decoding help.hta
%ProgramFiles%\ashavsrv\decoding help.hta
%ProgramFiles%\ashchest\decoding help.hta
%ProgramFiles%\ashenhcd\decoding help.hta
%ProgramFiles%\ashlogv\decoding help.hta
%ProgramFiles%\ashquick\decoding help.hta
%ProgramFiles%\ashsimp2\decoding help.hta
%ProgramFiles%\clamwin\decoding help.hta
%ProgramFiles%\claw95cf\decoding help.hta
%ProgramFiles%\avconfig\decoding help.hta
%ProgramFiles%\cleaner\decoding help.hta
%ProgramFiles%\avciman\decoding help.hta
%ProgramFiles%\avadmin\decoding help.hta
%ProgramFiles%\almon\decoding help.hta
%ProgramFiles%\alsvc\decoding help.hta
%ProgramFiles%\amsn\decoding help.hta
%ProgramFiles%\amon\decoding help.hta
%ProgramFiles%\b2\decoding help.hta
%ProgramFiles%\ashwebsv\decoding help.hta
%ProgramFiles%\courier\decoding help.hta
%ProgramFiles%\copyx64\decoding help.hta
%ProgramFiles%\cmgrdian\decoding help.hta
%ProgramFiles%\cmain\decoding help.hta
%ProgramFiles%\clrcche\decoding help.hta
%ProgramFiles%\clisvc\decoding help.hta
%ProgramFiles%\cleaner3\decoding help.hta
%ProgramFiles%\ashserv\decoding help.hta
%ProgramFiles%\claw95\decoding help.hta
%ProgramFiles%\ashskpcc\decoding help.hta
%ProgramFiles%\cavemsrv\decoding help.hta
%ProgramFiles%\cavasm\decoding help.hta
%ProgramFiles%\cavaud\decoding help.hta
%ProgramFiles%\cafix\decoding help.hta
%ProgramFiles%\cavapp\decoding help.hta
%ProgramFiles%\btini\decoding help.hta
%ProgramFiles%\blackice\decoding help.hta
%ProgramFiles%\bdwizreg\decoding help.hta
%ProgramFiles(x86)%\windows nt\tabletextservice\decoding help.hta
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\decoding help.hta
%CommonProgramFiles%\microsoft shared\smart tag\decoding help.hta
%ProgramFiles(x86)%\opera\decoding help.hta
%ProgramFiles(x86)%\mozilla thunderbird\decoding help.hta
%ProgramFiles%\a2wizard\decoding help.hta
%ProgramFiles%\a2cmd\decoding help.hta
%ProgramFiles%\avgw\decoding help.hta
%ProgramFiles%\cavmr\decoding help.hta
%ProgramFiles%\bdnews\decoding help.hta
%ProgramFiles%\defwatch\decoding help.hta
%ProgramFiles%\bdss\decoding help.hta
%ProgramFiles%\dbtool\decoding help.hta
%ProgramFiles%\cuteftp\decoding help.hta
%ProgramFiles%\ashsimpl\decoding help.hta
%ProgramFiles%\ashupd\decoding help.hta
%ProgramFiles%\avgwizfw\decoding help.hta
%ProgramFiles%\ashskpck\decoding help.hta
%ProgramFiles%\autodown\decoding help.hta
%ProgramFiles%\aswupdsv\decoding help.hta
%ProgramFiles%\avcenter\decoding help.hta
%ProgramFiles%\avcmd\decoding help.hta
%ProgramFiles%\bdmcon\decoding help.hta
%ProgramFiles%\avscan\decoding help.hta
%ProgramFiles%\avpm\decoding help.hta
%ProgramFiles%\blackd\decoding help.hta
%ProgramFiles%\bdswitch\decoding help.hta
%ProgramFiles%\dekaron\decoding help.hta
%ProgramFiles%\avgdiag\decoding help.hta
%ProgramFiles%\avgfwsrv\decoding help.hta
%ProgramFiles%\avgnpdln\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1028\decoding help.hta
%ProgramFiles%\a2scan\decoding help.hta
%ProgramFiles%\a2start\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\3082\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1049\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1046\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1031\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsta\pipeline.v10.0\contracts\decoding help.hta
%ProgramFiles(x86)%\microsoft office\office14\1033\decoding help.hta
%ProgramFiles(x86)%\qip 2012\langs\decoding help.hta
%ProgramFiles(x86)%\windows portable devices\decoding help.hta
%ProgramFiles(x86)%\google\chrome\application\decoding help.hta
%ProgramFiles%\cemrep\decoding help.hta
%ProgramFiles%\a2guard\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1042\decoding help.hta
%HOMEPATH%\links\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\2052\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1040\decoding help.hta
%HOMEPATH%\saved games\decoding help.hta
%APPDATA%\telegram desktop\decoding help.hta
%APPDATA%\mozilla\firefox\decoding help.hta
%APPDATA%\mail.ru\agent\decoding help.hta
%PROGRAMDATA%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\icons\decoding help.hta
C:\far2\addons\setup\decoding help.hta
%PROGRAMDATA%\microsoft\windows nt\msfax\common coverpages\en-us\decoding help.hta
%PROGRAMDATA%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\decoding help.hta
%PROGRAMDATA%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\decoding help.hta
%CommonProgramFiles(x86)%\system\msadc\en-us\decoding help.hta
%ProgramFiles(x86)%\qip 2012\plugins\win7helper\decoding help.hta
%ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\decoding help.hta
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\decoding help.hta
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\decoding help.hta
%HOMEPATH%\searches\decoding help.hta
C:\far2\encyclopedia\tap\decoding help.hta
%HOMEPATH%\favorites\links\decoding help.hta
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\decoding help.hta
C:\far2\documentation\rus\decoding help.hta
%ProgramFiles%\bdsurvey\decoding help.hta
%ProgramFiles%\bdsubmit\decoding help.hta
%ProgramFiles%\bdoesrv\decoding help.hta
%ProgramFiles%\bdagent\decoding help.hta
%ProgramFiles%\cavmud\decoding help.hta
%ProgramFiles%\cavoar\decoding help.hta
%ProgramFiles%\avsynmgr\decoding help.hta
%ProgramFiles%\avpcc\decoding help.hta
%ProgramFiles%\avnotify\decoding help.hta
%ProgramFiles%\avkwctl\decoding help.hta
%ProgramFiles%\avinitnt\decoding help.hta
%ProgramFiles%\avgvv\decoding help.hta
%ProgramFiles%\avgupsvc\decoding help.hta
%ProgramFiles%\avgrssvc\decoding help.hta
%ProgramFiles%\aim6\decoding help.hta
%ProgramFiles%\cpd\decoding help.hta
%ProgramFiles%\aimpro\decoding help.hta
%ProgramFiles%\csendto\decoding help.hta
%HOMEPATH%\music\decoding help.hta
%ProgramFiles%\admunch\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1041\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1036\decoding help.hta
C:\users\public\downloads\decoding help.hta
%ProgramFiles%\anti-trojan\decoding help.hta
C:\users\public\libraries\decoding help.hta
%HOMEPATH%\contacts\decoding help.hta
%ProgramFiles%\a2hijackfree\decoding help.hta
%ProgramFiles%\avgcc\decoding help.hta
%ProgramFiles%\a2service\decoding help.hta
%ProgramFiles%\aavshield\decoding help.hta
%ProgramFiles(x86)%\qip 2012\core\decoding help.hta
%ProgramFiles(x86)%\microsoft office\office14\decoding help.hta
%ProgramFiles%\a2upd\decoding help.hta
%ProgramFiles%\360tray\decoding help.hta
%ProgramFiles%\ackwin32\decoding help.hta
%ProgramFiles%\ageofconan\decoding help.hta
C:\users\all users\oracle\java\installcache_x64\decoding help.hta
%ProgramFiles%\avkserv\decoding help.hta
%PROGRAMDATA%\microsoft\msdn\7.0\1040\decoding help.hta
C:\users\public\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\1.7\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\1.0\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\decoding help.hta
%CommonProgramFiles(x86)%\adobe\arm\1.0\decoding help.hta
%ProgramFiles(x86)%\internet explorer\decoding help.hta
%PROGRAMDATA%\microsoft\office\decoding help.hta
%PROGRAMDATA%\microsoft\user account pictures\decoding help.hta
%PROGRAMDATA%\microsoft\identitycrl\decoding help.hta
%PROGRAMDATA%\microsoft\mf\decoding help.hta
%PROGRAMDATA%\microsoft toolkit\decoding help.hta
%PROGRAMDATA%\microsoft\ilscache\decoding help.hta
%ProgramFiles%\antivirus\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\office14\1033\decoding help.hta
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsta\appinfodocument\decoding help.hta
%PROGRAMDATA%\microsoft\crypto\keys\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsta\8.0\decoding help.hta
%CommonProgramFiles(x86)%\adobe\helpcfg\en_us\decoding help.hta
%CommonProgramFiles(x86)%\system\msadc\decoding help.hta
%CommonProgramFiles(x86)%\system\en-us\decoding help.hta
%PROGRAMDATA%\microsoft\user account pictures\default pictures\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsto\10.0\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\office10\1033\decoding help.hta
C:\far2\addons\decoding help.hta
%CommonProgramFiles(x86)%\system\ado\decoding help.hta
%HOMEPATH%\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\portal\1033\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsta\pipeline.v10.0\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vc\amd64\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vba\vba6\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\textconv\wksconv\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\msinfo\en-us\decoding help.hta
%ProgramFiles%\decoding help.hta
%CommonProgramFiles%\services\decoding help.hta
%CommonProgramFiles(x86)%\java\java update\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\msinfo\decoding help.hta
C:\users\decoding help.hta
%CommonProgramFiles(x86)%\px storage engine\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\msdn\decoding help.hta
%CommonProgramFiles(x86)%\steam\decoding help.hta
%CommonProgramFiles(x86)%\services\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\decoding help.hta
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
%ProgramFiles(x86)%\decoding help.hta
<Current directory>\decoding help.hta
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
C:\decoding help.hta
C:\totalcmd\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\dao\decoding help.hta
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\information retrieval\decoding help.hta
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\stationery\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\office10\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsto\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\msenv\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\office14\decoding help.hta
C:\far2\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vs7debug\decoding help.hta
C:\users\default\decoding help.hta
%PROGRAMDATA%\decoding help.hta
%CommonProgramFiles(x86)%\system\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vgx\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\portal\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vc\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vs7debug\1033\decoding help.hta
%PROGRAMDATA%\mozilla\logs\decoding help.hta
%PROGRAMDATA%\microsoft\windows nt\msscan\decoding help.hta
%PROGRAMDATA%\microsoft\rac\publisheddata\decoding help.hta
%ProgramFiles%\ccapp\decoding help.hta
%ProgramFiles%\cavumas\decoding help.hta
%ProgramFiles%\cavse\decoding help.hta
%ProgramFiles%\cavscons\decoding help.hta
%ProgramFiles%\btinint\decoding help.hta
%ProgramFiles%\avconsol\decoding help.hta
%ProgramFiles%\chrome\decoding help.hta
%ProgramFiles%\ccproxy\decoding help.hta
%ProgramFiles%\ccevtmgr\decoding help.hta
%ProgramFiles%\ccleaner\decoding help.hta
%ProgramFiles%\cavvl\decoding help.hta
%ProgramFiles%\cavq\decoding help.hta
%ProgramFiles%\cavsn\decoding help.hta
%ProgramFiles%\cavsub\decoding help.hta
%ProgramFiles%\avgupden\decoding help.hta
%ProgramFiles%\avgnpsvc\decoding help.hta
%ProgramFiles%\avgscan\decoding help.hta
%ProgramFiles%\ccsetmgr\decoding help.hta
%ProgramFiles%\blindman\decoding help.hta
C:\users\all users\microsoft\rac\statedata\racwmidatabookmarks.dat.[id]qzw53kyft5hrjyga[id]
%PROGRAMDATA%\microsoft\msdn\7.0\2052\decoding help.hta
%PROGRAMDATA%\microsoft\msdn\7.0\1050\decoding help.hta
%PROGRAMDATA%\microsoft\msdn\7.0\1049\decoding help.hta
%PROGRAMDATA%\microsoft\msdn\7.0\1046\decoding help.hta
%PROGRAMDATA%\microsoft\msdn\7.0\1042\decoding help.hta
%PROGRAMDATA%\microsoft\msdn\7.0\1041\decoding help.hta
C:\users\all users\oracle\java\javapath\decoding help.hta
%HOMEPATH%\favorites\microsoft websites\decoding help.hta
%PROGRAMDATA%\microsoft\assistance\client\1.0\en-us\decoding help.hta
C:\users\public\videos\sample videos\decoding help.hta
C:\far2\addons\colors\default_highlighting\decoding help.hta
%ProgramFiles(x86)%\microsoft office\office10\decoding help.hta
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsta\pipeline.v10.0\hostsideadapters\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1033\decoding help.hta
%ProgramFiles%\avginet\decoding help.hta
%ProgramFiles%\avgemc\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsta\pipeline.v10.0\addinsideadapters\decoding help.hta
C:\users\public\pictures\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsta\pipeline.v10.0\addinviews\decoding help.hta
C:\users\public\videos\decoding help.hta
%HOMEPATH%\downloads\decoding help.hta
%HOMEPATH%\favorites\decoding help.hta
%HOMEPATH%\documents\decoding help.hta
C:\users\public\music\decoding help.hta
%HOMEPATH%\desktop\decoding help.hta
C:\users\public\documents\decoding help.hta
%ProgramFiles(x86)%\internet explorer\en-us\decoding help.hta
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\en-us\decoding help.hta
%PROGRAMDATA%\microsoft\rac\statedata\decoding help.hta
%PROGRAMDATA%\microsoft\network\downloader\decoding help.hta
%HOMEPATH%\pictures\decoding help.hta
%CommonProgramFiles(x86)%\system\ado\en-us\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\web server extensions\14\bin\decoding help.hta
C:\far2\encyclopedia\decoding help.hta
%ProgramFiles%\airdefense\decoding help.hta
%HOMEPATH%\videos\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsta\appinfodocument\microsoft.visualstudio.tools.office.appinfodocument\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsto\10.0\1033\decoding help.hta
C:\users\public\desktop\decoding help.hta
%ProgramFiles(x86)%\mirc\decoding help.hta
%ProgramFiles(x86)%\mozilla firefox\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\decoding help.hta
%ProgramFiles(x86)%\qip 2012\decoding help.hta
C:\users\all users\microsoft\rac\statedata\racwmieventdata.dat.[id]qzw53kyft5hrjyga[id]
%ProgramFiles(x86)%\windows media player\decoding help.hta
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\decoding help.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\decoding help.hta
C:\far2\addons\colors\custom_highlighting\decoding help.hta
C:\far2\documentation\eng\decoding help.hta
C:\far2\addons\colors\decoding help.hta
C:\far2\addons\macros\decoding help.hta
%ProgramFiles%\agb5\decoding help.hta
<LS_APPDATA>\decoding help.hta

Moves the following files

from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\desktop.ini.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\mozilla thunderbird\accessiblemarshal.dll to %ProgramFiles(x86)%\mozilla thunderbird\accessiblemarshal.dll.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\a2wizard.exe.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\a2cmd.exe.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles%\avgw\avgw.exe to %ProgramFiles%\avgw\avgw.exe.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles%\avgcc\avgcc.exe to %ProgramFiles%\avgcc\avgcc.exe.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles%\avkserv\avkserv.exe to %ProgramFiles%\avkserv\avkserv.exe.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-bold.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-bold.otf.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd.otf.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-oblique.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-oblique.otf.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-boldoblique.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-boldoblique.otf.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-bold.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-bold.otf.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\adobepistd.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\adobepistd.otf.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles%\desktop.ini to %ProgramFiles%\desktop.ini.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles%\antivirus\antivirus.exe to %ProgramFiles%\antivirus\antivirus.exe.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\enutxt.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\enutxt.pdf.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.xml.[id]qzw53kyft5hrjyga[id]
from %ProgramFiles(x86)%\microsoft office\office10\msostyle.dll to %ProgramFiles(x86)%\microsoft office\office10\msostyle.dll.[id]qzw53kyft5hrjyga[id]

Substitutes the following executable files

<Full path to file>

Substitutes the following files

%CommonProgramFiles(x86)%\Services\verisign.bmp
%CommonProgramFiles%\Services\verisign.bmp

Moves itself

from <Full path to file> to <Full path to file>.[id]qzw53kyft5hrjyga[id]

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial