Trojan.Encoder.33747

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'qZhotTgfr3' = '<Full path to file>'

Malicious functions

Terminates or attempts to terminate

the following user processes:

firefox.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc

Modifies file system

Creates the following files

C:\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportarchive\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\sqm\upload\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\sqm\sessions\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\sqm\manifest\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\drm\cache\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\en-us\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\temp\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\x879q8-readme.txt
%LOCALAPPDATA%\microsoft help\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\x879q8-readme.txt
%LOCALAPPDATA%\google\x879q8-readme.txt
%LOCALAPPDATA%\cef\x879q8-readme.txt
%LOCALAPPDATA%\applicationhistory\x879q8-readme.txt
%LOCALAPPDATA%\adobe\x879q8-readme.txt
C:\users\default\appdata\roaming\microsoft\x879q8-readme.txt
C:\users\default\appdata\roaming\media center programs\x879q8-readme.txt
C:\users\default\appdata\local\temp\x879q8-readme.txt
C:\users\default\appdata\local\microsoft\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\x879q8-readme.txt
%HOMEPATH%\favorites\msn websites\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\event viewer\views\applicationviewsrootnode\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\x879q8-readme.txt
%ALLUSERSPROFILE%\oracle\java\javapath\x879q8-readme.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\wwansvc\profiles\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\support\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\localcopy\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\templates\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\sqm\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\ringtones\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\power efficiency diagnostics\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\gameexplorer\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\x879q8-readme.txt
%ALLUSERSPROFILE%\sun\java\java update\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\x879q8-readme.txt
C:\users\default\appdata\local\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\x879q8-readme.txt
C:\users\default\appdata\roaming\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\x879q8-readme.txt
%ALLUSERSPROFILE%\adobe\arm\s\10428\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\x879q8-readme.txt
%LOCALAPPDATA%\mozilla\x879q8-readme.txt
%HOMEPATH%\favorites\microsoft websites\x879q8-readme.txt
%HOMEPATH%\favorites\links for united states\x879q8-readme.txt
%HOMEPATH%\favorites\links\x879q8-readme.txt
%APPDATA%\x879q8-readme.txt
%LOCALAPPDATA%low\x879q8-readme.txt
%LOCALAPPDATA%\x879q8-readme.txt
C:\users\public\videos\sample videos\x879q8-readme.txt
C:\users\public\recorded tv\sample media\x879q8-readme.txt
C:\users\public\pictures\sample pictures\x879q8-readme.txt
C:\users\public\music\sample music\x879q8-readme.txt
%HOMEPATH%\favorites\windows live\x879q8-readme.txt
%LOCALAPPDATA%\opera software\x879q8-readme.txt
%LOCALAPPDATA%\programs\x879q8-readme.txt
%LOCALAPPDATA%\steam\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\event viewer\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\device metadata\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\dbgclr\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\credentials\x879q8-readme.txt
%LOCALAPPDATA%\google\crashreports\x879q8-readme.txt
%LOCALAPPDATA%\google\chrome\x879q8-readme.txt
%LOCALAPPDATA%\cef\user data\x879q8-readme.txt
%LOCALAPPDATA%\adobe\color\x879q8-readme.txt
%LOCALAPPDATA%\adobe\acrocef\x879q8-readme.txt
%LOCALAPPDATA%\adobe\acrobat\x879q8-readme.txt
C:\users\default\appdata\roaming\microsoft\windows\x879q8-readme.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\x879q8-readme.txt
C:\users\default\appdata\local\microsoft\windows\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\feeds\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\feeds cache\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\internet explorer\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\media player\x879q8-readme.txt
%TEMP%\webinstaller\x879q8-readme.txt
%TEMP%\temp1_fp_13.0.0.182_archive.zip\x879q8-readme.txt
%TEMP%\opera installer\x879q8-readme.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\x879q8-readme.txt
%TEMP%\low\x879q8-readme.txt
%TEMP%\lilo.1516\x879q8-readme.txt
%TEMP%\hsperfdata_user\x879q8-readme.txt
%TEMP%\adobe_admlogs\x879q8-readme.txt
%TEMP%\acrord32_sbx\x879q8-readme.txt
%LOCALAPPDATA%\steam\htmlcache\x879q8-readme.txt
%LOCALAPPDATA%\opera software\opera stable\x879q8-readme.txt
%LOCALAPPDATA%\programs\common\x879q8-readme.txt
%LOCALAPPDATA%\mozilla\updates\x879q8-readme.txt
%LOCALAPPDATA%\mozilla\firefox\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\windows sidebar\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\windows media\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\windows mail\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\windows\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\taskschedulerconfig\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\publisher\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\office\x879q8-readme.txt
%LOCALAPPDATA%\microsoft\msdn\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\drm\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0731c4f1\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\x879q8-readme.txt
%APPDATA%\qip\x879q8-readme.txt
%APPDATA%\opera software\x879q8-readme.txt
%APPDATA%\mra\x879q8-readme.txt
%APPDATA%\mozilla\x879q8-readme.txt
%APPDATA%\mirc\x879q8-readme.txt
%APPDATA%\microsoft\x879q8-readme.txt
%APPDATA%\media center programs\x879q8-readme.txt
%APPDATA%\mail.ru\x879q8-readme.txt
%APPDATA%\macromedia\x879q8-readme.txt
%APPDATA%\identities\x879q8-readme.txt
%APPDATA%\icqm\x879q8-readme.txt
%APPDATA%\icq-profile\x879q8-readme.txt
%APPDATA%\ghisler\x879q8-readme.txt
%APPDATA%\adobe\x879q8-readme.txt
%LOCALAPPDATA%low\sun\x879q8-readme.txt
%LOCALAPPDATA%low\oracle\x879q8-readme.txt
%LOCALAPPDATA%low\microsoft\x879q8-readme.txt
%LOCALAPPDATA%low\adobe\x879q8-readme.txt
%LOCALAPPDATA%\virtualstore\x879q8-readme.txt
%LOCALAPPDATA%\thunderbird\x879q8-readme.txt
%TEMP%\x879q8-readme.txt
%APPDATA%\qipguard\x879q8-readme.txt
%APPDATA%\telegram desktop\x879q8-readme.txt
%APPDATA%\thunderbird\x879q8-readme.txt
%APPDATA%\winamp\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winamp\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tablet pc\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qip 2012\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\x879q8-readme.txt
%TEMP%\wpdnse\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\google chrome\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_5d5d8b7c1982ab7c66cf747e7b18b39e2441a_cab_073d8027\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\x879q8-readme.txt
%HOMEPATH%\documents\x879q8-readme.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\x879q8-readme.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\x879q8-readme.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\x879q8-readme.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\x879q8-readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\x879q8-readme.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\x879q8-readme.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\x879q8-readme.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\x879q8-readme.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\x879q8-readme.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\x879q8-readme.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\x879q8-readme.txt
C:\far2\pluginsdk\headers.pas\x879q8-readme.txt
C:\far2\pluginsdk\headers.c\x879q8-readme.txt
C:\far2\plugins\tmppanel\x879q8-readme.txt
C:\far2\plugins\proclist\x879q8-readme.txt
C:\far2\plugins\network\x879q8-readme.txt
C:\far2\plugins\macroview\x879q8-readme.txt
C:\far2\plugins\hlfviewer\x879q8-readme.txt
C:\far2\plugins\ftp\x879q8-readme.txt
C:\far2\plugins\filecase\x879q8-readme.txt
C:\far2\plugins\farcmds\x879q8-readme.txt
C:\far2\plugins\editcase\x879q8-readme.txt
C:\far2\plugins\emenu\x879q8-readme.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\x879q8-readme.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\search\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\office\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\network\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\netframework\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\mf\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\media player\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\ilscache\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\event viewer\x879q8-readme.txt
%HOMEPATH%\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\ehome\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\drm\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\devicesync\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\x879q8-readme.txt
%ALLUSERSPROFILE%\adobe\setup\x879q8-readme.txt
%ALLUSERSPROFILE%\adobe\arm\x879q8-readme.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\x879q8-readme.txt
C:\far2\plugins\drawline\x879q8-readme.txt
C:\far2\plugins\compare\x879q8-readme.txt
C:\far2\plugins\brackets\x879q8-readme.txt
C:\msocache\all users\x879q8-readme.txt
C:\far2\pluginsdk\x879q8-readme.txt
C:\far2\plugins\x879q8-readme.txt
C:\far2\fexcept\x879q8-readme.txt
C:\far2\encyclopedia\x879q8-readme.txt
C:\far2\documentation\x879q8-readme.txt
C:\far2\addons\x879q8-readme.txt
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\x879q8-readme.txt
C:\users\x879q8-readme.txt
C:\totalcmd\x879q8-readme.txt
C:\system volume information\x879q8-readme.txt
C:\recovery\x879q8-readme.txt
%ALLUSERSPROFILE%\x879q8-readme.txt
%ProgramFiles(x86)%\x879q8-readme.txt
%ProgramFiles%\x879q8-readme.txt
C:\perflogs\x879q8-readme.txt
<Current directory>\x879q8-readme.txt
C:\msocache\x879q8-readme.txt
C:\far2\x879q8-readme.txt
C:\$recycle.bin\x879q8-readme.txt
%ProgramFiles%\microsoft sql server compact edition\x879q8-readme.txt
%ALLUSERSPROFILE%\adobe\x879q8-readme.txt
C:\perflogs\admin\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\x879q8-readme.txt
C:\far2\plugins\autowrap\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft help\x879q8-readme.txt
C:\far2\plugins\arclite\x879q8-readme.txt
C:\far2\plugins\align\x879q8-readme.txt
C:\far2\encyclopedia\tap\x879q8-readme.txt
C:\far2\documentation\rus\x879q8-readme.txt
C:\far2\documentation\eng\x879q8-readme.txt
C:\far2\addons\xlat\x879q8-readme.txt
C:\far2\addons\shell\x879q8-readme.txt
C:\far2\addons\setup\x879q8-readme.txt
C:\far2\addons\macros\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\identitycrl\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\x879q8-readme.txt
C:\users\public\x879q8-readme.txt
C:\users\default\x879q8-readme.txt
C:\totalcmd\language\x879q8-readme.txt
C:\system volume information\spp\x879q8-readme.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\x879q8-readme.txt
%ALLUSERSPROFILE%\sun\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\x879q8-readme.txt
%ALLUSERSPROFILE%\oracle\x879q8-readme.txt
%ALLUSERSPROFILE%\mozilla\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft toolkit\x879q8-readme.txt
C:\far2\addons\colors\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\vault\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\x879q8-readme.txt
%ALLUSERSPROFILE%\adobe\arm\reader_15.008.20082\x879q8-readme.txt
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\x879q8-readme.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\desktop\x879q8-readme.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\x879q8-readme.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\x879q8-readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\x879q8-readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\x879q8-readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\x879q8-readme.txt
C:\far2\plugins\ftp\lib\x879q8-readme.txt
C:\far2\addons\xlat\russian\x879q8-readme.txt
C:\far2\addons\colors\default_highlighting\x879q8-readme.txt
C:\far2\addons\colors\custom_highlighting\x879q8-readme.txt
%HOMEPATH%\voip\x879q8-readme.txt
%HOMEPATH%\videos\x879q8-readme.txt
%HOMEPATH%\searches\x879q8-readme.txt
%HOMEPATH%\saved games\x879q8-readme.txt
%HOMEPATH%\pictures\x879q8-readme.txt
%HOMEPATH%\music\x879q8-readme.txt
%HOMEPATH%\links\x879q8-readme.txt
%HOMEPATH%\favorites\x879q8-readme.txt
%HOMEPATH%\downloads\x879q8-readme.txt
%ALLUSERSPROFILE%\adobe\arm\s\x879q8-readme.txt
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\x879q8-readme.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\temp\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\outbound\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\network\connections\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\8.0\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\netframework\breadcrumbstore\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\event viewer\views\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\ehome\logs\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\drm\server\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\keys\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\caches\x879q8-readme.txt
C:\users\default\pictures\x879q8-readme.txt
%HOMEPATH%\desktop\x879q8-readme.txt
%HOMEPATH%\contacts\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\x879q8-readme.txt
%ALLUSERSPROFILE%\oracle\java\x879q8-readme.txt
%ALLUSERSPROFILE%\mozilla\logs\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\wwansvc\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\wpd\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\x879q8-readme.txt
C:\users\public\videos\x879q8-readme.txt
C:\users\public\recorded tv\x879q8-readme.txt
C:\users\public\pictures\x879q8-readme.txt
C:\users\public\music\x879q8-readme.txt
C:\users\public\libraries\x879q8-readme.txt
C:\users\public\favorites\x879q8-readme.txt
C:\users\public\downloads\x879q8-readme.txt
C:\users\public\documents\x879q8-readme.txt
C:\users\public\desktop\x879q8-readme.txt
C:\users\default\videos\x879q8-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\ait\x879q8-readme.txt
C:\users\default\saved games\x879q8-readme.txt
C:\users\default\music\x879q8-readme.txt
C:\users\default\links\x879q8-readme.txt
C:\users\default\favorites\x879q8-readme.txt
C:\users\default\downloads\x879q8-readme.txt
C:\users\default\documents\x879q8-readme.txt
C:\users\default\desktop\x879q8-readme.txt
C:\users\default\appdata\x879q8-readme.txt
C:\system volume information\spp\onlinemetadatacache\x879q8-readme.txt
%ALLUSERSPROFILE%\sun\java\x879q8-readme.txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\x879q8-readme.txt
%HOMEPATH%\appdata\x879q8-readme.txt
volume{c84d25cd-f368-11e4-889d-806e6f6e6963}\system volume information\tracking.log.tmp

Moves the following files

from %ProgramFiles%\desktop.ini to %ProgramFiles%\desktop.ini.x879q8
from %APPDATA%\icqm\icqsetup.exe to %APPDATA%\icqm\icqsetup.exe.x879q8
from %APPDATA%\icqm\icq.exe to %APPDATA%\icqm\icq.exe.x879q8
from %APPDATA%\ghisler\wincmd.ini to %APPDATA%\ghisler\wincmd.ini.x879q8
from volume{c84d25cd-f368-11e4-889d-806e6f6e6963}\system volume information\tracking.log.tmp to volume{c84d25cd-f368-11e4-889d-806e6f6e6963}\system volume information\tracking.log
from %TEMP%\wmsetup.log to %TEMP%\wmsetup.log.x879q8
from %TEMP%\setupexe(20160310140634718).log to %TEMP%\setupexe(20160310140634718).log.x879q8
from %TEMP%\setupexe(201603101200226dc).log to %TEMP%\setupexe(201603101200226dc).log.x879q8
from %TEMP%\setupexe(20151124155624744).log to %TEMP%\setupexe(20151124155624744).log.x879q8
from %TEMP%\rgie195.tmp-tmp to %TEMP%\rgie195.tmp-tmp.x879q8
from %TEMP%\rgie195.tmp to %TEMP%\rgie195.tmp.x879q8
from %TEMP%\rgi8564.tmp-tmp to %TEMP%\rgi8564.tmp-tmp.x879q8
from %TEMP%\rgi8564.tmp to %TEMP%\rgi8564.tmp.x879q8
from %TEMP%\ose00001.exe to %TEMP%\ose00001.exe.x879q8
from %TEMP%\ose00000.exe to %TEMP%\ose00000.exe.x879q8
from %TEMP%\msie45bf.log to %TEMP%\msie45bf.log.x879q8
from %TEMP%\msid38c.log to %TEMP%\msid38c.log.x879q8
from %TEMP%\msieb217.log to %TEMP%\msieb217.log.x879q8
from %APPDATA%\icqm\libvoip_x86.dll to %APPDATA%\icqm\libvoip_x86.dll.x879q8
from %APPDATA%\icqm\mrainplaceviewer.dll to %APPDATA%\icqm\mrainplaceviewer.dll.x879q8
from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.x879q8
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.x879q8
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe.x879q8
from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe.x879q8
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.x879q8
from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.x879q8
from %APPDATA%\qipguard\sqlite3.dll to %APPDATA%\qipguard\sqlite3.dll.x879q8
from %APPDATA%\qipguard\qipguard.exe to %APPDATA%\qipguard\qipguard.exe.x879q8
from %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt to %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt.x879q8
from %APPDATA%\qipguard\chrome.dll to %APPDATA%\qipguard\chrome.dll.x879q8
from %APPDATA%\qipguard\cache to %APPDATA%\qipguard\cache.x879q8
from %APPDATA%\mirc\servers.ini to %APPDATA%\mirc\servers.ini.x879q8
from %APPDATA%\mirc\urls.ini to %APPDATA%\mirc\urls.ini.x879q8
from %APPDATA%\mirc\mirc.ini to %APPDATA%\mirc\mirc.ini.x879q8
from %APPDATA%\icqm\vivo.dll to %APPDATA%\icqm\vivo.dll.x879q8
from %APPDATA%\icqm\sciter32.dll to %APPDATA%\icqm\sciter32.dll.x879q8
from %TEMP%\msic204f.log to %TEMP%\msic204f.log.x879q8
from %TEMP%\msi1cfbe.log to %TEMP%\msi1cfbe.log.x879q8
from %TEMP%\mirc741.exe to %TEMP%\mirc741.exe.x879q8
from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.x879q8
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.x879q8
from %TEMP%\aspnetsetup.log to %TEMP%\aspnetsetup.log.x879q8
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.x879q8
from %TEMP%\adobearm.log to %TEMP%\adobearm.log.x879q8
from %TEMP%\adobearm_notlocked.log to %TEMP%\adobearm_notlocked.log.x879q8
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcese35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcese35.dll.x879q8
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceqp35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceqp35.dll.x879q8
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceoledb35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceoledb35.dll.x879q8
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceme35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceme35.dll.x879q8
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceer35en.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceer35en.dll.x879q8
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcecompact35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcecompact35.dll.x879q8
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceca35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceca35.dll.x879q8
from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\desktop.ini.x879q8
from %TEMP%\aspnetsetup_00003.log to %TEMP%\aspnetsetup_00003.log.x879q8
from %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.x879q8
from %TEMP%\aspnetsetup_00002.log to %TEMP%\aspnetsetup_00002.log.x879q8
from %TEMP%\dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt.x879q8
from %TEMP%\microsoft .net framework 4.7.1 setup_20200610_200621826-msi_netfx_full_x64.msi.txt to %TEMP%\microsoft .net framework 4.7.1 setup_20200610_200621826-msi_netfx_full_x64.msi.txt.x879q8
from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.x879q8
from %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txt to %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txt.x879q8
from %TEMP%\jusched.log to %TEMP%\jusched.log.x879q8
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.x879q8
from %TEMP%\dotnetfxsdk.log to %TEMP%\dotnetfxsdk.log.x879q8
from %TEMP%\dotnetfx.log to %TEMP%\dotnetfx.log.x879q8
from %TEMP%\dd_wcf_ca_smci_20200611_031101_060.txt to %TEMP%\dd_wcf_ca_smci_20200611_031101_060.txt.x879q8
from %APPDATA%\qipguard\qipguard_upd.exe to %APPDATA%\qipguard\qipguard_upd.exe.x879q8
from %APPDATA%\winamp\winamp.ini to %APPDATA%\winamp\winamp.ini.x879q8
from %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt to %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt.x879q8
from %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log.x879q8
from %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log.x879q8
from %TEMP%\dd_vcredist_x86_20151216210157.log to %TEMP%\dd_vcredist_x86_20151216210157.log.x879q8
from %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log.x879q8
from %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log.x879q8
from %TEMP%\dd_vcredist_amd64_20151216210341.log to %TEMP%\dd_vcredist_amd64_20151216210341.log.x879q8
from %TEMP%\dd_wcf_ca_smci_20200611_031056_919.txt to %TEMP%\dd_wcf_ca_smci_20200611_031056_919.txt.x879q8
from %APPDATA%\winamp\winamp.m3u8 to %APPDATA%\winamp\winamp.m3u8.x879q8

Modifies the following files

C:\far2\changelog
C:\totalcmd\tcunin64.wul
C:\totalcmd\size!.txt
C:\totalcmd\register.rtf
C:\totalcmd\no.bar
C:\totalcmd\keyboard.txt
C:\totalcmd\history.txt
C:\totalcmd\descript.ion
C:\totalcmd\default.bar
C:\system volume information\tracking.log
%ProgramFiles(x86)%\desktop.ini
%ProgramFiles%\desktop.ini
C:\far2\savesettings.cmd
C:\far2\restoresettings.cmd
C:\far2\file_id.diz
C:\far2\farspa.lng
C:\far2\farrus.lng
C:\far2\farrus.hlf
C:\far2\farpol.lng
C:\far2\farhun.lng
C:\far2\farhun.hlf
C:\far2\farger.lng
C:\far2\fareng.lng
C:\far2\fareng.hlf
C:\far2\farcze.lng
C:\far2\far.map
C:\far2\clearpluginscache.cmd
C:\far2\changelog_eng
C:\totalcmd\tcuninst.wul
C:\totalcmd\totalcmd.chm

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial