Trojan.Encoder.28773

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsDefenderUpdater.exe' = '%ALLUSERSPROFILE%\WindowsDefenderUpdater.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsUpdateCheck' = '<Full path to file>'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsUpdateCheck' = '%ALLUSERSPROFILE%\WindowsDefenderUpdater.exe'

Creates or modifies the following files

%HOMEPATH%\start menu\programs\startup\.c4d1664ef40ce18f8d41

Creates the following files on removable media

<Drive name for removable media>:\.c4d1664ef40ce18f8d41
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\toolbar.bmp

Malicious functions

Injects code into

the following user processes:

windowsdefenderupdater.exe

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\windowsdefenderupdater.exe
C:\documents and settings\default user\start menu\how to back your files.txt
C:\documents and settings\default user\start menu\programs\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\start menu\programs\how to back your files.txt
C:\documents and settings\default user\start menu\programs\maintenance\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\start menu\programs\maintenance\how to back your files.txt
C:\documents and settings\default user\start menu\programs\accessories\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\start menu\programs\accessories\how to back your files.txt
C:\documents and settings\default user\start menu\programs\accessories\system tools\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\templates\how to back your files.txt
C:\documents and settings\default user\start menu\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\start menu\programs\accessories\system tools\how to back your files.txt
C:\documents and settings\default user\sendto\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\sendto\compressed (zipped) folder.zfsendtotarget
C:\documents and settings\default user\sendto\desktop (create shortcut).desklink
C:\documents and settings\default user\sendto\mail recipient.mapimail
C:\documents and settings\default user\sendto\how to back your files.txt
C:\documents and settings\default user\saved games\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\saved games\how to back your files.txt
C:\documents and settings\default user\recent\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\start menu\programs\accessories\accessibility\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\start menu\programs\accessories\accessibility\how to back your files.txt
C:\documents and settings\default user\templates\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\videos\how to back your files.txt
C:\documents and settings\default user\videos\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\startupcache.4.little
%TEMP%\tmp56f5.tmp.exe
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache2\.c4d1664ef40ce18f8d41
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.c4d1664ef40ce18f8d41
%ALLUSERSPROFILE%\ids.txt
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\_cache_clean_
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache2\doomed\.c4d1664ef40ce18f8d41
C:\far2\.c4d1664ef40ce18f8d41
C:\documents and settings\all users\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\ntuser.dat.log
C:\documents and settings\default user\ntuser.dat.log1
C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf
C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms
C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms
C:\documents and settings\default user\how to back your files.txt
C:\$recycle.bin\how to back your files.txt
C:\documents and settings\default user\recent\how to back your files.txt
C:\documents and settings\default user\printhood\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\printhood\how to back your files.txt
C:\documents and settings\default user\pictures\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\cookies\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\cookies\how to back your files.txt
C:\documents and settings\default user\application data\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\application data\how to back your files.txt
C:\documents and settings\default user\application data\microsoft\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\application data\microsoft\how to back your files.txt
C:\documents and settings\default user\application data\microsoft\internet explorer\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\application data\microsoft\internet explorer\how to back your files.txt
C:\documents and settings\default user\application data\microsoft\internet explorer\quick launch\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\application data\microsoft\internet explorer\quick launch\how to back your files.txt
C:\documents and settings\default user\application data\media center programs\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\application data\media center programs\how to back your files.txt
C:\documents and settings\default user\appdata\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\appdata\how to back your files.txt
C:\documents and settings\user\ntuser.pol
C:\documents and settings\user\local settings\thunderbird\profiles\wjj9aet2.default\cache2\how to back your files.txt
C:\documents and settings\user\local settings\thunderbird\profiles\wjj9aet2.default\cache2\entries\.c4d1664ef40ce18f8d41
C:\documents and settings\user\local settings\thunderbird\profiles\wjj9aet2.default\cache2\entries\how to back your files.txt
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how to back your files.txt
C:\far2\addons\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\desktop\how to back your files.txt
C:\documents and settings\default user\downloads\how to back your files.txt
C:\documents and settings\default user\desktop\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\downloads\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\pictures\how to back your files.txt
C:\documents and settings\default user\nethood\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\nethood\how to back your files.txt
C:\documents and settings\default user\my documents\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\my documents\how to back your files.txt
C:\documents and settings\default user\my documents\my music\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\my documents\my music\how to back your files.txt
C:\documents and settings\default user\local settings\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\local settings\how to back your files.txt
C:\documents and settings\default user\local settings\<INETFILES>\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\local settings\<INETFILES>\how to back your files.txt
C:\documents and settings\default user\local settings\temp\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\local settings\temp\how to back your files.txt
C:\documents and settings\default user\local settings\microsoft\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\local settings\microsoft\how to back your files.txt
C:\documents and settings\default user\local settings\history\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\local settings\history\how to back your files.txt
C:\documents and settings\default user\links\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\links\how to back your files.txt
C:\documents and settings\default user\favorites\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\favorites\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache\0\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\profiles\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\telegram desktop\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\telegram desktop\how to back your files.txt
%HOMEPATH%\start menu\programs\maintenance\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\maintenance\how to back your files.txt
%HOMEPATH%\start menu\programs\mail.ru\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\mail.ru\how to back your files.txt
%HOMEPATH%\start menu\programs\icq\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\icq\how to back your files.txt
%HOMEPATH%\start menu\programs\total commander\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\total commander\how to back your files.txt
%HOMEPATH%\start menu\programs\administrative tools\.c4d1664ef40ce18f8d41
D:\$recycle.bin\.c4d1664ef40ce18f8d41
D:\system volume information\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\accessories\how to back your files.txt
%HOMEPATH%\start menu\programs\accessories\system tools\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\accessories\system tools\how to back your files.txt
%HOMEPATH%\start menu\programs\accessories\accessibility\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\accessories\accessibility\how to back your files.txt
%HOMEPATH%\sendto\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\administrative tools\how to back your files.txt
%HOMEPATH%\start menu\programs\accessories\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\winrar\how to back your files.txt
%HOMEPATH%\start menu\programs\winrar\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\how to back your files.txt
<Current directory>\ids.txt
z:\.c4d1664ef40ce18f8d41
D:\.c4d1664ef40ce18f8d41
C:\.c4d1664ef40ce18f8d41
C:\$recycle.bin\.c4d1664ef40ce18f8d41
C:\how to back your files.txt
C:\users\.c4d1664ef40ce18f8d41
C:\users\how to back your files.txt
%HOMEPATH%\.c4d1664ef40ce18f8d41
%ALLUSERSPROFILE%\local\.c4d1664ef40ce18f8d41
z:\system volume information\.c4d1664ef40ce18f8d41
%HOMEPATH%\voip\.c4d1664ef40ce18f8d41
%HOMEPATH%\voip\how to back your files.txt
%HOMEPATH%\videos\.c4d1664ef40ce18f8d41
%HOMEPATH%\videos\how to back your files.txt
%HOMEPATH%\templates\.c4d1664ef40ce18f8d41
%HOMEPATH%\templates\how to back your files.txt
%HOMEPATH%\start menu\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\how to back your files.txt
%HOMEPATH%\start menu\programs\.c4d1664ef40ce18f8d41
%HOMEPATH%\how to back your files.txt
%HOMEPATH%\sendto\compressed (zipped) folder.zfsendtotarget
%HOMEPATH%\sendto\desktop (create shortcut).desklink
%HOMEPATH%\sendto\mail recipient.mapimail
%HOMEPATH%\sendto\how to back your files.txt
%HOMEPATH%\printhood\.c4d1664ef40ce18f8d41
%HOMEPATH%\printhood\how to back your files.txt
%HOMEPATH%\pictures\.c4d1664ef40ce18f8d41
%HOMEPATH%\pictures\how to back your files.txt
%HOMEPATH%\nethood\.c4d1664ef40ce18f8d41
%HOMEPATH%\nethood\how to back your files.txt
%HOMEPATH%\my documents\.c4d1664ef40ce18f8d41
%HOMEPATH%\my documents\how to back your files.txt
%HOMEPATH%\my documents\my music\.c4d1664ef40ce18f8d41
%HOMEPATH%\my documents\my music\how to back your files.txt
%HOMEPATH%\local settings\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\gdipfontcachev1.dat
%HOMEPATH%\local settings\iconcache.db
%HOMEPATH%\local settings\how to back your files.txt
%HOMEPATH%\local settings\virtualstore\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\virtualstore\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\updates\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\updates\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\updates\8216c80c92c4e828\.c4d1664ef40ce18f8d41
%HOMEPATH%\recent\automaticdestinations\how to back your files.txt
%HOMEPATH%\recent\automaticdestinations\74d7f43c1561fc1e.automaticdestinations-ms
%HOMEPATH%\recent\automaticdestinations\7e4dca80246863e3.automaticdestinations-ms
%HOMEPATH%\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms
%HOMEPATH%\searches\.c4d1664ef40ce18f8d41
%HOMEPATH%\searches\how to back your files.txt
%HOMEPATH%\saved games\.c4d1664ef40ce18f8d41
%HOMEPATH%\saved games\how to back your files.txt
%HOMEPATH%\recent\.c4d1664ef40ce18f8d41
%HOMEPATH%\recent\how to back your files.txt
%HOMEPATH%\recent\customdestinations\.c4d1664ef40ce18f8d41
%HOMEPATH%\recent\customdestinations\10a2479c877ca098.customdestinations-ms
%HOMEPATH%\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms
%HOMEPATH%\recent\customdestinations\28c8b86deab549a1.customdestinations-ms
%HOMEPATH%\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
%HOMEPATH%\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms
%HOMEPATH%\recent\customdestinations\5d696d521de238c3.customdestinations-ms
%HOMEPATH%\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms
%HOMEPATH%\recent\customdestinations\7e4dca80246863e3.customdestinations-ms
%HOMEPATH%\recent\customdestinations\9027fe24326910d2.customdestinations-ms
%HOMEPATH%\recent\customdestinations\969252ce11249fdd.customdestinations-ms
%HOMEPATH%\recent\customdestinations\bf8efb871eda5262.customdestinations-ms
%HOMEPATH%\recent\customdestinations\c312e260e424ae76.customdestinations-ms
%HOMEPATH%\recent\customdestinations\how to back your files.txt
%HOMEPATH%\recent\automaticdestinations\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\updates\8216c80c92c4e828\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache\_cache_001_

Sets the 'hidden' attribute to the following files

%ALLUSERSPROFILE%\local\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\recent\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\saved games\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\sendto\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\start menu\programs\accessories\accessibility\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\start menu\programs\accessories\system tools\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\start menu\programs\accessories\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\start menu\programs\maintenance\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\start menu\programs\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\printhood\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\start menu\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\videos\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\.c4d1664ef40ce18f8d41
C:\documents and settings\all users\.c4d1664ef40ce18f8d41
C:\far2\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache2\doomed\.c4d1664ef40ce18f8d41
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.c4d1664ef40ce18f8d41
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache2\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\templates\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\pictures\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\nethood\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\my documents\.c4d1664ef40ce18f8d41
C:\far2\addons\.c4d1664ef40ce18f8d41
C:\documents and settings\user\local settings\thunderbird\profiles\wjj9aet2.default\cache2\entries\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\appdata\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\application data\media center programs\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\application data\microsoft\internet explorer\quick launch\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\application data\microsoft\internet explorer\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\application data\microsoft\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\application data\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\cookies\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\desktop\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\downloads\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\favorites\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\links\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\local settings\history\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\local settings\microsoft\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\local settings\temp\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\local settings\<INETFILES>\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\local settings\.c4d1664ef40ce18f8d41
C:\documents and settings\default user\my documents\my music\.c4d1664ef40ce18f8d41
<Drive name for removable media>:\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\mail.ru\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\maintenance\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\startup\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\telegram desktop\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\total commander\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\winrar\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\icq\.c4d1664ef40ce18f8d41
%HOMEPATH%\templates\.c4d1664ef40ce18f8d41
%HOMEPATH%\voip\.c4d1664ef40ce18f8d41
z:\system volume information\.c4d1664ef40ce18f8d41
%HOMEPATH%\.c4d1664ef40ce18f8d41
C:\users\.c4d1664ef40ce18f8d41
C:\$recycle.bin\.c4d1664ef40ce18f8d41
C:\.c4d1664ef40ce18f8d41
D:\.c4d1664ef40ce18f8d41
z:\.c4d1664ef40ce18f8d41
%HOMEPATH%\videos\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\administrative tools\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\accessories\.c4d1664ef40ce18f8d41
D:\$recycle.bin\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\updates\8216c80c92c4e828\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\updates\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\virtualstore\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\.c4d1664ef40ce18f8d41
%HOMEPATH%\my documents\my music\.c4d1664ef40ce18f8d41
%HOMEPATH%\my documents\.c4d1664ef40ce18f8d41
%HOMEPATH%\nethood\.c4d1664ef40ce18f8d41
%HOMEPATH%\pictures\.c4d1664ef40ce18f8d41
%HOMEPATH%\printhood\.c4d1664ef40ce18f8d41
%HOMEPATH%\recent\automaticdestinations\.c4d1664ef40ce18f8d41
%HOMEPATH%\recent\customdestinations\.c4d1664ef40ce18f8d41
%HOMEPATH%\recent\.c4d1664ef40ce18f8d41
%HOMEPATH%\saved games\.c4d1664ef40ce18f8d41
%HOMEPATH%\searches\.c4d1664ef40ce18f8d41
%HOMEPATH%\sendto\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\accessories\accessibility\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\accessories\system tools\.c4d1664ef40ce18f8d41
D:\system volume information\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache\0\.c4d1664ef40ce18f8d41

Moves the following files

from %HOMEPATH%\sendto\compressed (zipped) folder.zfsendtotarget to %HOMEPATH%\sendto\compressed (zipped) folder.zfsendtotarget.globeimposter-alpha865qqz
from C:\documents and settings\default user\sendto\desktop (create shortcut).desklink to C:\documents and settings\default user\sendto\desktop (create shortcut).desklink.globeimposter-alpha865qqz
from C:\documents and settings\default user\sendto\compressed (zipped) folder.zfsendtotarget to C:\documents and settings\default user\sendto\compressed (zipped) folder.zfsendtotarget.globeimposter-alpha865qqz
from C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms to C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.globeimposter-alpha865qqz
from C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms to C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.globeimposter-alpha865qqz
from C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf to C:\documents and settings\default user\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.globeimposter-alpha865qqz
from C:\documents and settings\default user\ntuser.dat.log1 to C:\documents and settings\default user\ntuser.dat.log1.globeimposter-alpha865qqz
from C:\documents and settings\default user\ntuser.dat.log to C:\documents and settings\default user\ntuser.dat.log.globeimposter-alpha865qqz
from %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\startupcache.4.little to %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\startupcache.4.little.globeimposter-alpha865qqz
from %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\_cache_clean_ to %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\_cache_clean_.globeimposter-alpha865qqz
from %HOMEPATH%\local settings\iconcache.db to %HOMEPATH%\local settings\iconcache.db.globeimposter-alpha865qqz
from %HOMEPATH%\local settings\gdipfontcachev1.dat to %HOMEPATH%\local settings\gdipfontcachev1.dat.globeimposter-alpha865qqz
from %HOMEPATH%\recent\automaticdestinations\7e4dca80246863e3.automaticdestinations-ms to %HOMEPATH%\recent\automaticdestinations\7e4dca80246863e3.automaticdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\automaticdestinations\74d7f43c1561fc1e.automaticdestinations-ms to %HOMEPATH%\recent\automaticdestinations\74d7f43c1561fc1e.automaticdestinations-ms.globeimposter-alpha865qqz
from C:\documents and settings\default user\sendto\mail recipient.mapimail to C:\documents and settings\default user\sendto\mail recipient.mapimail.globeimposter-alpha865qqz
from %HOMEPATH%\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %HOMEPATH%\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\bf8efb871eda5262.customdestinations-ms to %HOMEPATH%\recent\customdestinations\bf8efb871eda5262.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\969252ce11249fdd.customdestinations-ms to %HOMEPATH%\recent\customdestinations\969252ce11249fdd.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\9027fe24326910d2.customdestinations-ms to %HOMEPATH%\recent\customdestinations\9027fe24326910d2.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\7e4dca80246863e3.customdestinations-ms to %HOMEPATH%\recent\customdestinations\7e4dca80246863e3.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms to %HOMEPATH%\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\5d696d521de238c3.customdestinations-ms to %HOMEPATH%\recent\customdestinations\5d696d521de238c3.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms to %HOMEPATH%\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms to %HOMEPATH%\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\28c8b86deab549a1.customdestinations-ms to %HOMEPATH%\recent\customdestinations\28c8b86deab549a1.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms to %HOMEPATH%\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\10a2479c877ca098.customdestinations-ms to %HOMEPATH%\recent\customdestinations\10a2479c877ca098.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\sendto\mail recipient.mapimail to %HOMEPATH%\sendto\mail recipient.mapimail.globeimposter-alpha865qqz
from %HOMEPATH%\sendto\desktop (create shortcut).desklink to %HOMEPATH%\sendto\desktop (create shortcut).desklink.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\c312e260e424ae76.customdestinations-ms to %HOMEPATH%\recent\customdestinations\c312e260e424ae76.customdestinations-ms.globeimposter-alpha865qqz
from C:\documents and settings\user\ntuser.pol to C:\documents and settings\user\ntuser.pol.globeimposter-alpha865qqz

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%ALLUSERSPROFILE%\windowsdefenderupdater.exe'
'%TEMP%\tmp56f5.tmp.exe'

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c @echo off sc config browser sc config browser start=enabled vssadmin delete shadows /all /quiet sc stop vss sc config vss start=disabled sc stop MongoDB sc config MongoDB start=disabl...

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial