Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\73ldLSFhLk\Shell\Open\Command] '' = 'mshta.exe vbscript:CreateObject("SAPI.SpVoice").speak("Hello!I am FIFCOM,Please subscribe to my bilibili channel,thank you.")(Windo...
- [<HKLM>\Software\Classes\OSM1QpKfNe\Shell\Open\Command] '' = 'notepad.exe %TEMP%\FIFCOM\JiuyinZhenjing.txt'
- [<HKLM>\Software\Classes\SOxqsHMPwM\Shell\Open\Command] '' = 'iexplore.exe https://space.bilibili.com/22112700'
- [<HKLM>\Software\Classes\5166HlaKgb\Shell\Open\Command] '' = 'mshta.exe vbscript:Execute("msgbox "" Your computer has been hacked by FIFCOM""&vbNewLine&vbNewLine&ChrW(10139)&"" Subscribe to my ...
- [<HKLM>\Software\Classes\Xkn7jvZKnm\Shell\Open\Command] '' = '%TEMP%\FIFCOM\ScreenDissolve.exe'
- [<HKLM>\Software\Classes\Ln2yWXl8Js\Shell\Open\Command] '' = '%TEMP%\FIFCOM\Pop.exe'
- [<HKLM>\Software\Classes\3XgzkcGrnN\Shell\Open\Command] '' = '%TEMP%\FIFCOM\FileEncoder.exe'
- [<HKLM>\Software\Classes\ZfYRXHpTuy\Shell\Open\Command] '' = 'mshta.exe vbscript:Execute("msgbox "" Alipay Red Envelope!""&vbNewLine&"" Please Search:""&vbNewLine&"" [6 1 9 8 3 2 5 5 1]"",0,""F...
- [<HKLM>\Software\Classes\EsKjtFXTWm\Shell\Open\Command] '' = '%TEMP%\FIFCOM\BlueScreen.exe'
- [<HKLM>\Software\Classes\UsKL1sVP2S\Shell\Open\Command] '' = '%TEMP%\FIFCOM\RandDirGen.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UACHack' = '%TEMP%\FIFCOM\UACHack.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\0rmogxu6.bat
- %TEMP%\fifcom\desktop\32352.ln2ywxl8js
- %TEMP%\fifcom\desktop\24252.3xgzkcgrnn
- %TEMP%\fifcom\desktop\11763.zfyrxhptuy
- %TEMP%\fifcom\desktop\14044.eskjtfxtwm
- %TEMP%\fifcom\desktop\10384.uskl1svp2s
- %TEMP%\fifcom\desktop\5089.73ldlsfhlk
- %TEMP%\fifcom\desktop\3524.osm1qpkfne
- %TEMP%\fifcom\desktop\2594.soxqshmpwm
- %TEMP%\fifcom\desktop\32421.5166hlakgb
- %TEMP%\fifcom\desktop\5526.5166hlakgb
- %TEMP%\fifcom\desktop\13498.xkn7jvzknm
- %TEMP%\fifcom\desktop\25196.xkn7jvzknm
- %TEMP%\fifcom\desktop\31985.zfyrxhptuy
- %TEMP%\fifcom\desktop\9291.eskjtfxtwm
- %TEMP%\fifcom\desktop\3417.uskl1svp2s
- %ProgramFiles%\adobe\reader 11.0\resource\enutxt.pdf.fifcom
- %TEMP%\c7b33n15.bat
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\adobe\symbol.txt.fifcom
- %TEMP%\cqj4dth5.bat
- %TEMP%\0lgy9ro0.bat
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\adobe\zdingbat.txt.fifcom
- %TEMP%\fifcom\desktop\4221.ln2ywxl8js
- %TEMP%\fifcom\desktop\11229.3xgzkcgrnn
- %TEMP%\fifcom\desktop\27287.soxqshmpwm
- %TEMP%\fifcom\desktop\24182.osm1qpkfne
- %TEMP%\fifcom\desktop\31203.73ldlsfhlk
- %TEMP%\fifcom\desktop\24806.eskjtfxtwm
- %TEMP%\fifcom\desktop\12547.uskl1svp2s
- %TEMP%\fifcom\desktop\3147.73ldlsfhlk
- %TEMP%\fifcom\desktop\19992.osm1qpkfne
- %TEMP%\fifcom\desktop\17223.soxqshmpwm
- %TEMP%\fifcom\desktop\16481.5166hlakgb
- %TEMP%\fifcom\desktop\1855.xkn7jvzknm
- %TEMP%\fifcom\desktop\9704.ln2ywxl8js
- %TEMP%\fifcom\desktop\22653.3xgzkcgrnn
- %TEMP%\fifcom\desktop\1724.zfyrxhptuy
- %TEMP%\fifcom\desktop\8914.zfyrxhptuy
- %TEMP%\fifcom\desktop\5366.eskjtfxtwm
- %TEMP%\fifcom\desktop\9479.73ldlsfhlk
- %TEMP%\fifcom\desktop\9250.osm1qpkfne
- %TEMP%\fifcom\desktop\26682.soxqshmpwm
- %TEMP%\fifcom\desktop\1255.5166hlakgb
- %TEMP%\fifcom\desktop\21429.xkn7jvzknm
- %TEMP%\fifcom\desktop\30.ln2ywxl8js
- %TEMP%\fifcom\desktop\24740.3xgzkcgrnn
- %TEMP%\fifcom\desktop\26947.zfyrxhptuy
- %TEMP%\fifcom\desktop\32391.eskjtfxtwm
- %TEMP%\fifcom\desktop\14481.uskl1svp2s
- %TEMP%\fifcom\desktop\5484.uskl1svp2s
- %TEMP%\4ng70h8m.bat
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\centeuro.txt.fifcom
- %TEMP%\87r2s28c.bat
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\corpchar.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_ca.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_gb.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_gb_euro.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_us.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_us_posix.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\adobe\products.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_ca\list.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_gb\list.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_us\list.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_en_ca.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_th_en_ca_v2.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\affdescription.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\changelog.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\license.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme_en_gb.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\wordnet_license.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\readme_en_us.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\added.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\excluded.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_gb\added.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_gb\excluded.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\added.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1258.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1254.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1257.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1253.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\croatian.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\cyrillic.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\greek.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\iceland.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\roman.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\romanian.txt.fifcom
- %TEMP%\cwagtd0j.bat
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\symbol.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\turkish.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\ukraine.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1250.txt.fifcom
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1251.txt.fifcom
- <Current directory>\config\1.vbs
- <Current directory>\config\2.vbs
- <Current directory>\config\3.vbs
- <Current directory>\config\4.vbs
- <Current directory>\config\5.vbs
- <Current directory>\config\6.vbs
- <Current directory>\config\7.vbs
- <Current directory>\config\8.vbs
- <Current directory>\config\9.vbs
- <Current directory>\config\keyboard.vbs
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1252.txt.fifcom
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\excluded.txt.fifcom
- %TEMP%\fifcom\desktop\15080.3xgzkcgrnn
- %TEMP%\fifcom\desktop\17195.ln2ywxl8js
- %TEMP%\fifcom\desktop\14220.xkn7jvzknm
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\enu\signhere.pdf.fifcom
- %TEMP%\fifcom\desktop\6909.73ldlsfhlk
- %TEMP%\fifcom\desktop\10474.osm1qpkfne
- %TEMP%\fifcom\desktop\18585.soxqshmpwm
- %TEMP%\fifcom\desktop\28569.5166hlakgb
- %TEMP%\fifcom\desktop\12018.xkn7jvzknm
- %TEMP%\fifcom\desktop\23681.ln2ywxl8js
- %TEMP%\fifcom\desktop\21538.3xgzkcgrnn
- %TEMP%\fifcom\desktop\15358.zfyrxhptuy
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\words.pdf.fifcom
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\enu\dynamic.pdf.fifcom
- %TEMP%\fifcom\desktop\26909.eskjtfxtwm
- %TEMP%\fifcom\desktop\21059.osm1qpkfne
- %TEMP%\fifcom\desktop\17736.soxqshmpwm
- %TEMP%\fifcom\desktop\491.5166hlakgb
- %TEMP%\fifcom\desktop\32666.xkn7jvzknm
- %TEMP%\fifcom\desktop\18707.ln2ywxl8js
- %TEMP%\fifcom\desktop\12893.3xgzkcgrnn
- %TEMP%\fifcom\desktop\14031.zfyrxhptuy
- %TEMP%\fifcom\desktop\29754.eskjtfxtwm
- %TEMP%\fifcom\desktop\5997.uskl1svp2s
- %TEMP%\fifcom\desktop\24173.uskl1svp2s
- %TEMP%\fifcom\desktop\22526.73ldlsfhlk
- %ProgramFiles%\adobe\reader 11.0\reader\legal\enu\license.html.fifcom
- %ProgramFiles%\adobe\reader 11.0\reader\idtemplates\enu\defaultid.pdf.fifcom
- %ProgramFiles%\adobe\reader 11.0\reader\idtemplates\enu\adobeid.pdf.fifcom
- <LS_APPDATA>\qb1090ab.95\bluescreenuachack1.exe
- <LS_APPDATA>\qb1090ab.95\bluescreenuachack2.exe
- <LS_APPDATA>\qb1090ab.95\demo.exe
- <LS_APPDATA>\qb1090ab.95\fileencoder.exe
- <LS_APPDATA>\qb1090ab.95\jiuyinzhenjing.txt
- <LS_APPDATA>\qb1090ab.95\pop.exe
- <LS_APPDATA>\qb1090ab.95\randdirgen.exe
- <LS_APPDATA>\qb1090ab.95\screendissolve.exe
- <LS_APPDATA>\qb1090ab.95\uachack.exe
- %TEMP%\fifcom\bluescreenuachack1.exe
- <LS_APPDATA>\qb1090ab.95\bluescreen.exe
- %TEMP%\fifcom\bluescreenuachack2.exe
- %TEMP%\fifcom\demo.exe
- %TEMP%\fifcom\fileencoder.exe
- %TEMP%\fifcom\jiuyinzhenjing.txt
- %TEMP%\fifcom\pop.exe
- %TEMP%\fifcom\uachack.exe
- %TEMP%\fifcom\randdirgen.exe
- %TEMP%\fifcom\screendissolve.exe
- %TEMP%\8g266a3b.bat
- nul
- %ProgramFiles%\adobe\reader 11.0\reader\pdfsigqformalrep.pdf.fifcom
- %TEMP%\fifcom\bluescreen.exe
- %TEMP%\fifcom\desktop\398.73ldlsfhlk
- %TEMP%\fifcom\desktop\28561.osm1qpkfne
- %TEMP%\fifcom\desktop\30069.soxqshmpwm
- %TEMP%\fifcom\desktop\5877.5166hlakgb
- %TEMP%\fifcom\desktop\17610.73ldlsfhlk
- %TEMP%\fifcom\desktop\4611.osm1qpkfne
- %TEMP%\fifcom\desktop\2912.soxqshmpwm
- %TEMP%\fifcom\desktop\22620.5166hlakgb
- %TEMP%\fifcom\desktop\25325.xkn7jvzknm
- %TEMP%\fifcom\desktop\24240.ln2ywxl8js
- %TEMP%\fifcom\desktop\10115.3xgzkcgrnn
- %TEMP%\fifcom\desktop\22308.zfyrxhptuy
- %TEMP%\fifcom\desktop\11942.eskjtfxtwm
- %TEMP%\fifcom\desktop\21596.uskl1svp2s
- %TEMP%\fifcom\desktop\23831.73ldlsfhlk
- %TEMP%\fifcom\desktop\1979.osm1qpkfne
- %TEMP%\fifcom\desktop\16228.soxqshmpwm
- %TEMP%\fifcom\desktop\18841.5166hlakgb
- %TEMP%\fifcom\desktop\26412.xkn7jvzknm
- %TEMP%\fifcom\desktop\7532.ln2ywxl8js
- %TEMP%\fifcom\desktop\22195.3xgzkcgrnn
- %TEMP%\fifcom\desktop\24055.zfyrxhptuy
- %TEMP%\fifcom\desktop\6485.eskjtfxtwm
- %TEMP%\fifcom\desktop\11730.uskl1svp2s
- %TEMP%\fifcom\desktop\29032.73ldlsfhlk
- %TEMP%\fifcom\desktop\18468.osm1qpkfne
- %TEMP%\fifcom\desktop\17512.soxqshmpwm
- %TEMP%\fifcom\desktop\16460.uskl1svp2s
- %TEMP%\fifcom\desktop\9643.zfyrxhptuy
- %TEMP%\fifcom\desktop\15359.eskjtfxtwm
- %TEMP%\fifcom\desktop\12061.3xgzkcgrnn
- %TEMP%\fifcom\desktop\26124.xkn7jvzknm
- %TEMP%\fifcom\desktop\4274.ln2ywxl8js
- %TEMP%\fifcom\desktop\31088.3xgzkcgrnn
- %TEMP%\fifcom\desktop\6999.zfyrxhptuy
- %TEMP%\fifcom\desktop\7857.eskjtfxtwm
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\enu\standardbusiness.pdf.fifcom
- %TEMP%\fifcom\desktop\25670.uskl1svp2s
- %TEMP%\fifcom\desktop\2022.73ldlsfhlk
- %TEMP%\fifcom\desktop\30315.osm1qpkfne
- %TEMP%\fifcom\desktop\14993.soxqshmpwm
- %TEMP%\fifcom\desktop\1198.5166hlakgb
- %TEMP%\fifcom\desktop\23613.xkn7jvzknm
- %TEMP%\fifcom\desktop\20112.ln2ywxl8js
- %TEMP%\fifcom\desktop\19859.3xgzkcgrnn
- %TEMP%\fifcom\desktop\26753.zfyrxhptuy
- %TEMP%\fifcom\desktop\16900.eskjtfxtwm
- %TEMP%\fifcom\desktop\13542.uskl1svp2s
- %TEMP%\fifcom\desktop\8115.73ldlsfhlk
- %TEMP%\fifcom\desktop\8194.osm1qpkfne
- %TEMP%\fifcom\desktop\7262.soxqshmpwm
- %TEMP%\fifcom\desktop\28384.5166hlakgb
- %TEMP%\fifcom\desktop\16928.xkn7jvzknm
- %TEMP%\fifcom\desktop\17287.ln2ywxl8js
- %TEMP%\fifcom\desktop\27876.5166hlakgb
- %CommonProgramFiles%\microsoft shared\office10\ctryinfo.txt.fifcom
Deletes the following files
- %TEMP%\cqj4dth5.bat
- %TEMP%\c7b33n15.bat
- %TEMP%\0lgy9ro0.bat
- %TEMP%\4ng70h8m.bat
- %TEMP%\87r2s28c.bat
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Media Center Tray Applet' WindowName: ''
- ClassName: '' WindowName: 'View Available Networks'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Creates and executes the following
- '%TEMP%\fifcom\fileencoder.exe'
- '%TEMP%\fifcom\randdirgen.exe'
- '%TEMP%\fifcom\pop.exe'
- '<SYSTEM32>\wscript.exe' "<Current directory>\config\1.vbs"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\0RMOGXU6.bat" "<Full path to file>" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\8G266A3B.bat" %TEMP%\FIFCOM\FileEncoder.exe "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\C7B33N15.bat" %TEMP%\FIFCOM\RandDirGen.exe "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CQJ4DTH5.bat" %TEMP%\FIFCOM\RandDirGen.exe "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\0LGY9RO0.bat" %TEMP%\FIFCOM\RandDirGen.exe "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\4NG70H8M.bat" %TEMP%\FIFCOM\RandDirGen.exe "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\87R2S28C.bat" %TEMP%\FIFCOM\RandDirGen.exe "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CWAGTD0J.bat" %TEMP%\FIFCOM\Pop.exe "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\0RMOGXU6.bat" "<Full path to file>" "
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\P...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\license.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\changelog.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Provider...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\affDescription.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Pro...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_th_en_CA_v2.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Provi...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\List.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Pl...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\List.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Pl...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\List.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Pl...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Adobe\Products.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Adobe\Products.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\LanguageNames2\DisplayLangua...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\LanguageNames2\DisplayLanguageName...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\LanguageNames2\DisplayLanguag...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\LanguageNames2\DisplayLanguageName...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\LanguageNames2\DisplayLanguageName...
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT.FIFCOM"
- '<SYSTEM32>\ping.exe' -n 11 127.1
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT.FIFCOM"
- '<SYSTEM32>\attrib.exe' +s +a +h +r config
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT.FIFCOM"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CWAGTD0J.bat" %TEMP%\FIFCOM\Pop.exe "
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README_en_GB.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Provi...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\WordNet_license.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Pr...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\README_en_US.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Provi...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\added.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\...
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\FireFox\chrome\browser\content\browser\license.html" "%ProgramFiles%\FireFox\chrome\browser\content\browser\license.html.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\FireFox\chrome\browser\content\browser\inspector.html" "%ProgramFiles%\FireFox\chrome\browser\content\browser\inspector.html.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\FireFox\README.txt" "%ProgramFiles%\FireFox\README.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Plugins\FTP\Notes_rus.txt" "%ProgramFiles%\Far2\Plugins\FTP\Notes_rus.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Plugins\FTP\Notes.txt" "%ProgramFiles%\Far2\Plugins\FTP\Notes.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Plugins\FTP\FtpCmds_rus.txt" "%ProgramFiles%\Far2\Plugins\FTP\FtpCmds_rus.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Plugins\FTP\FtpCmds.txt" "%ProgramFiles%\Far2\Plugins\FTP\FtpCmds.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Documentation\rus\TechInfo.txt" "%ProgramFiles%\Far2\Documentation\rus\TechInfo.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Documentation\rus\Plugins_Review.txt" "%ProgramFiles%\Far2\Documentation\rus\Plugins_Review.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Documentation\rus\Plugins_Install.txt" "%ProgramFiles%\Far2\Documentation\rus\Plugins_Install.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Documentation\rus\Far_FAQ.txt" "%ProgramFiles%\Far2\Documentation\rus\Far_FAQ.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Documentation\rus\Bug_Report.txt" "%ProgramFiles%\Far2\Documentation\rus\Bug_Report.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Documentation\rus\Arc_Support.txt" "%ProgramFiles%\Far2\Documentation\rus\Arc_Support.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Documentation\eng\Plugins_Review.txt" "%ProgramFiles%\Far2\Documentation\eng\Plugins_Review.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Documentation\eng\TechInfo.txt" "%ProgramFiles%\Far2\Documentation\eng\TechInfo.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Documentation\eng\Plugins_Install.txt" "%ProgramFiles%\Far2\Documentation\eng\Plugins_Install.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Documentation\eng\Far_FAQ.txt" "%ProgramFiles%\Far2\Documentation\eng\Far_FAQ.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Documentation\eng\Bug_Report.txt" "%ProgramFiles%\Far2\Documentation\eng\Bug_Report.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Documentation\eng\Arc_Support.txt" "%ProgramFiles%\Far2\Documentation\eng\Arc_Support.txt.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Far2\Addons\README.TXT" "%ProgramFiles%\Far2\Addons\README.TXT.FIFCOM"
- '<SYSTEM32>\ping.exe' -n 10 127.1
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\microsoft shared\Smart Tag\METCONV.TXT" "%CommonProgramFiles%\microsoft shared\Smart Tag\METCONV.TXT.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\microsoft shared\Office10\CTRYINFO.TXT" "%CommonProgramFiles%\microsoft shared\Office10\CTRYINFO.TXT.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Excluded.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguisti...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Added.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\excluded.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguisti...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\added.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\...
- '<SYSTEM32>\certutil.exe' -encode "%CommonProgramFiles%\Adobe\Reader\11.0\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\excluded.txt" "%CommonProgramFiles%\Adobe\Reader\11.0\Linguisti...
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\FireFox\chrome\browser\content\browser\tabview.html" "%ProgramFiles%\FireFox\chrome\browser\content\browser\tabview.html.FIFCOM"
- '<SYSTEM32>\ping.exe' -n 60 127.1
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT.FIFCOM"
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc "OSM1QpKfNe"\DefaultIcon=<SYSTEM32>\shell32.dll,-13"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Reader\IDTemplates\ENU\AdobeID.pdf" "%ProgramFiles%\Adobe\Reader 11.0\Reader\IDTemplates\ENU\AdobeID.pdf.FIFCOM"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc "73ldLSFhLk"\DefaultIcon=<SYSTEM32>\shell32.dll,-3"
- '<SYSTEM32>\cmd.exe' /S /D /c" ftype "UsKL1sVP2S"=%TEMP%\FIFCOM\RandDirGen.exe"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Reader\PDFSigQFormalRep.pdf" "%ProgramFiles%\Adobe\Reader 11.0\Reader\PDFSigQFormalRep.pdf.FIFCOM"
- '<SYSTEM32>\cmd.exe' /S /D /c" ftype "EsKjtFXTWm"=%TEMP%\FIFCOM\BlueScreen.exe"
- '<SYSTEM32>\cmd.exe' /S /D /c" ftype "ZfYRXHpTuy"=mshta.exe vbscript:Execute("msgbox "" Alipay Red Envelope!""&vbNewLine&"" Please Search:""&vbNewLine&"" [6 1 9 8 3 2 5 5 1]"",0,""FIFCOM VIRUS"":close")"
- '<SYSTEM32>\cmd.exe' /S /D /c" ftype "3XgzkcGrnN"=%TEMP%\FIFCOM\FileEncoder.exe"
- '<SYSTEM32>\cmd.exe' /S /D /c" ftype "Ln2yWXl8Js"=%TEMP%\FIFCOM\Pop.exe"
- '<SYSTEM32>\cmd.exe' /S /D /c" ftype "Xkn7jvZKnm"=%TEMP%\FIFCOM\ScreenDissolve.exe"
- '<SYSTEM32>\cmd.exe' /S /D /c" ftype "5166HlaKgb"=mshta.exe vbscript:Execute("msgbox "" Your computer has been hacked by FIFCOM""&vbNewLine&vbNewLine&ChrW(10139)&"" Subscribe to my Bilibili:""&vbNewLine&vbNewLine&"...
- '<SYSTEM32>\cmd.exe' /S /D /c" ftype "SOxqsHMPwM"=iexplore.exe https://space.bilibili.com/22112700"
- '<SYSTEM32>\cmd.exe' /S /D /c" ftype "OSM1QpKfNe"=notepad.exe %TEMP%\FIFCOM\JiuyinZhenjing.txt"
- '<SYSTEM32>\cmd.exe' /S /D /c" ftype "73ldLSFhLk"=mshta.exe vbscript:CreateObject("SAPI.SpVoice").speak("Hello!I am FIFCOM,Please subscribe to my bilibili channel,thank you.")(Window.close) "
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc .UsKL1sVP2S=UsKL1sVP2S"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc .EsKjtFXTWm=EsKjtFXTWm"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc .ZfYRXHpTuy=ZfYRXHpTuy"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc .3XgzkcGrnN=3XgzkcGrnN"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc .Ln2yWXl8Js=Ln2yWXl8Js"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc .Xkn7jvZKnm=Xkn7jvZKnm"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc .5166HlaKgb=5166HlaKgb"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc .SOxqsHMPwM=SOxqsHMPwM"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc .OSM1QpKfNe=OSM1QpKfNe"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\8G266A3B.bat" %TEMP%\FIFCOM\FileEncoder.exe "
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc .73ldLSFhLk=73ldLSFhLk"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo Y"
- '<SYSTEM32>\notepad.exe' %TEMP%\FIFCOM\JiuyinZhenjing.txt
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Reader\IDTemplates\ENU\DefaultID.pdf" "%ProgramFiles%\Adobe\Reader 11.0\Reader\IDTemplates\ENU\DefaultID.pdf.FIFCOM"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc "SOxqsHMPwM"\DefaultIcon=<SYSTEM32>\shell32.dll,-14"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Reader\Legal\ENU\license.html" "%ProgramFiles%\Adobe\Reader 11.0\Reader\Legal\ENU\license.html.FIFCOM"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc "5166HlaKgb"\DefaultIcon=<SYSTEM32>\shell32.dll,-24"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT.FIFCOM...
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT.FIFCOM...
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\87R2S28C.bat" %TEMP%\FIFCOM\RandDirGen.exe "
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT.FIFCOM...
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop /d "%TEMP%\FIFCOM\Desktop\
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\4NG70H8M.bat" %TEMP%\FIFCOM\RandDirGen.exe "
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "UACHack" /t REG_SZ /f /d "%TEMP%\FIFCOM\UACHack.exe"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT.FIFCOM...
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\0LGY9RO0.bat" %TEMP%\FIFCOM\RandDirGen.exe "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CQJ4DTH5.bat" %TEMP%\FIFCOM\RandDirGen.exe "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\C7B33N15.bat" %TEMP%\FIFCOM\RandDirGen.exe "
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt.FI...
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt.FIFCOM...
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\ENUtxt.pdf" "%ProgramFiles%\Adobe\Reader 11.0\Resource\ENUtxt.pdf.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" "%ProgramFiles%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness....
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc "UsKL1sVP2S"\DefaultIcon=<SYSTEM32>\shell32.dll,-27"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" "%ProgramFiles%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.FIFCOM"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc "EsKjtFXTWm"\DefaultIcon=<SYSTEM32>\shell32.dll,-22"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc "ZfYRXHpTuy"\DefaultIcon=<SYSTEM32>\shell32.dll,-25"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" "%ProgramFiles%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.FIFCOM"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc "3XgzkcGrnN"\DefaultIcon=<SYSTEM32>\shell32.dll,-48"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc "Ln2yWXl8Js"\DefaultIcon=<SYSTEM32>\shell32.dll,-42"
- '<SYSTEM32>\cmd.exe' /S /D /c" assoc "Xkn7jvZKnm"\DefaultIcon=<SYSTEM32>\shell32.dll,-26"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\Words.pdf" "%ProgramFiles%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\Words.pdf.FIFCOM"
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT" "%ProgramFiles%\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT.FIFCOM...
- '<SYSTEM32>\certutil.exe' -encode "%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\keyhole_forward_mask.svg" "%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\keyhole_forward_mask.svg.FIFC...
