Trojan.Encoder.40853

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%WINDIR%\system.ini
<SYSTEM32>\tasks\readme.txt
%WINDIR%\tasks\readme.txt
<SYSTEM32>\tasks\adobe acrobat update task
<SYSTEM32>\tasks\opera scheduled autoupdate 1694565166

Changes the following executable system files

%WINDIR%\microsoft.net\netfxrepair.1029.dll
<SYSTEM32>\mfc140jpn.dll
<SYSTEM32>\mfc140kor.dll
<SYSTEM32>\mfc140u.dll
<SYSTEM32>\mfcm100u.dll
<SYSTEM32>\mfcm120u.dll
<SYSTEM32>\mfcm140u.dll
<SYSTEM32>\msclmd.dll
<DRIVERS>\vhdmp.sys
<SYSTEM32>\msvcp140_1.dll
<SYSTEM32>\msvcr110d.dll
<SYSTEM32>\msvcr120d.dll
<SYSTEM32>\mfc100deu.dll
<SYSTEM32>\mfc140ita.dll
<SYSTEM32>\mfc140cht.dll
<SYSTEM32>\mfc140chs.dll
<SYSTEM32>\mfc110deu.dll
<SYSTEM32>\mfc110fra.dll
<SYSTEM32>\mfc110ita.dll
<SYSTEM32>\mfc120enu.dll
<SYSTEM32>\mfc120esn.dll
<SYSTEM32>\mfc120fra.dll
<SYSTEM32>\mfc120kor.dll
<SYSTEM32>\mfc140.dll
<SYSTEM32>\mfc120u.dll
<SYSTEM32>\mfc140fra.dll
<SYSTEM32>\mfc140enu.dll
<SYSTEM32>\mfc140esn.dll
<SYSTEM32>\mfc100rus.dll
<SYSTEM32>\mfc110cht.dll
<DRIVERS>\pcmcia.sys
<SYSTEM32>\mfc100fra.dll
<SYSTEM32>\fm20.dll
<DRIVERS>\sffp_mmc.sys
<DRIVERS>\synth3dvsc.sys
<DRIVERS>\wd.sys
<DRIVERS>\intelide.sys
<SYSTEM32>\brcoinst.dll
<DRIVERS>\e1g6032e.sys
<DRIVERS>\bthmodem.sys
<DRIVERS>\brfiltup.sys
<DRIVERS>\flpydisk.sys
<DRIVERS>\brfiltlo.sys
<DRIVERS>\lsi_scsi.sys
<DRIVERS>\iirsp.sys
<SYSTEM32>\mfc120ita.dll
<SYSTEM32>\mfc120rus.dll
<SYSTEM32>\mfc120jpn.dll
<SYSTEM32>\mfc100enu.dll
<SYSTEM32>\mfc100esn.dll
<SYSTEM32>\mfc100ita.dll
<SYSTEM32>\mfc100kor.dll
<SYSTEM32>\mfc100u.dll
<SYSTEM32>\mfc110chs.dll
<SYSTEM32>\mfc110enu.dll
<SYSTEM32>\mfc110esn.dll
<SYSTEM32>\mfc110jpn.dll
<SYSTEM32>\mfc110kor.dll
<SYSTEM32>\mfc110u.dll
<SYSTEM32>\mfc120deu.dll
<SYSTEM32>\fm20enu.dll
<SYSTEM32>\mfc100chs.dll
<DRIVERS>\secdrv.sys
<SYSTEM32>\mfc140rus.dll
<SYSTEM32>\mfcm140.dll
<SYSTEM32>\vccorlib140d.dll
<SYSTEM32>\vcomp110.dll
<SYSTEM32>\vcomp120.dll
<SYSTEM32>\vcomp140.dll
<SYSTEM32>\vcruntime140d.dll
<SYSTEM32>\ven2232.olb
<SYSTEM32>\msvcp140_2.dll
<SYSTEM32>\vmbuscoinstaller.dll
<SYSTEM32>\vmbuspipe.dll
<SYSTEM32>\vmicres.dll
<SYSTEM32>\vmstorfltres.dll
<SYSTEM32>\mfc110.dll
<SYSTEM32>\vcamp120.dll
<SYSTEM32>\vcamp140.dll
<SYSTEM32>\vccorlib120.dll
<SYSTEM32>\vcamp110.dll
<SYSTEM32>\vbame.dll
<SYSTEM32>\vccorlib140.dll
<SYSTEM32>\mfc140deu.dll
<SYSTEM32>\vmbusres.dll
<SYSTEM32>\windowsaccessbridge-64.dll
<SYSTEM32>\vccorlib110.dll
<SYSTEM32>\vmicsvc.exe
<SYSTEM32>\vcruntime140_1.dll
<SYSTEM32>\vmdcoinstall.dll
<SYSTEM32>\vmictimeprovider.dll
<SYSTEM32>\vcomp100.dll
<SYSTEM32>\mpsigstub.exe
<SYSTEM32>\msvcr90d.dll
<SYSTEM32>\mfcm110.dll
<SYSTEM32>\mfcm110u.dll
<SYSTEM32>\streamci.dll
<SYSTEM32>\iccoinstall.dll
<SYSTEM32>\iscsilog.dll
<SYSTEM32>\msvcp100.dll
<SYSTEM32>\msvcm90d.dll
<SYSTEM32>\msvcp110.dll
<SYSTEM32>\msvcp100d.dll
<SYSTEM32>\msvcp120.dll
<SYSTEM32>\msvcp120d.dll
<SYSTEM32>\msvcp110d.dll
<SYSTEM32>\msvcp140.dll
<SYSTEM32>\msvcp140d.dll
<SYSTEM32>\mfcm100.dll
<SYSTEM32>\mfcm120.dll
<SYSTEM32>\ucrtbased.dll
<SYSTEM32>\msvcp140_atomic_wait.dll
<SYSTEM32>\msvcr100d.dll
<SYSTEM32>\msvcr100.dll
<SYSTEM32>\msvcr120.dll
<SYSTEM32>\msvcr110.dll
<SYSTEM32>\mfc100.dll
<SYSTEM32>\mfc100cht.dll
<SYSTEM32>\mfc100jpn.dll
<SYSTEM32>\mfc110rus.dll
<SYSTEM32>\mfc120chs.dll
<SYSTEM32>\mfc120.dll
<SYSTEM32>\mfc120cht.dll
<SYSTEM32>\msvcp140_codecvt_ids.dll
<SYSTEM32>\msvcr100_clr0400.dll
<SYSTEM32>\msvcp90d.dll
<DRIVERS>\nvstor.sys
<DRIVERS>\lsi_sas2.sys
<DRIVERS>\ipmidrv.sys
<DRIVERS>\amdk8.sys
<DRIVERS>\amdsbs.sys
<DRIVERS>\b57nd60a.sys
<DRIVERS>\blbdrive.sys
<DRIVERS>\brusbmdm.sys
<DRIVERS>\brusbser.sys
<DRIVERS>\circlass.sys
<DRIVERS>\cmdide.sys
<DRIVERS>\compbatt.sys
<DRIVERS>\crcdisk.sys
<DRIVERS>\dmvsc.sys
<DRIVERS>\elxstor.sys
<DRIVERS>\agp440.sys
<DRIVERS>\nfrd960.sys
<DRIVERS>\adp94xx.sys
<DRIVERS>\iastorv.sys
<DRIVERS>\isapnp.sys
<DRIVERS>\kbdhid.sys
<DRIVERS>\lsi_fc.sys
<DRIVERS>\lsi_sas.sys
<DRIVERS>\megasas.sys
<DRIVERS>\megasr.sys
<SYSTEM32>\circoinst.dll
<DRIVERS>\msahci.sys
<DRIVERS>\msdsm.sys
<DRIVERS>\msiscsi.sys
<DRIVERS>\mtconfig.sys
<DRIVERS>\hidbatt.sys
<DRIVERS>\gagp30kx.sys
<DRIVERS>\hidir.sys
<SYSTEM32>\dmvscres.dll
%WINDIR%\microsoft.net\netfxrepair.1046.dll
%WINDIR%\microsoft.net\netfxrepair.1030.dll
%WINDIR%\microsoft.net\netfxrepair.1025.dll
%WINDIR%\microsoft.net\netfxrepair.1031.dll
%WINDIR%\microsoft.net\netfxrepair.1033.dll
%WINDIR%\microsoft.net\netfxrepair.1035.dll
%WINDIR%\microsoft.net\netfxrepair.1038.dll
%WINDIR%\microsoft.net\netfxrepair.1040.dll
%WINDIR%\microsoft.net\netfxrepair.1037.dll
%WINDIR%\microsoft.net\netfxrepair.1036.dll
%WINDIR%\microsoft.net\netfxrepair.1042.dll
%WINDIR%\microsoft.net\netfxrepair.1041.dll
%WINDIR%\microsoft.net\netfxrepair.1043.dll
<DRIVERS>\1394ohci.sys
<DRIVERS>\nvraid.sys
%WINDIR%\microsoft.net\netfxrepair.1028.dll
%WINDIR%\microsoft.net\netfxrepair.1049.dll
%WINDIR%\microsoft.net\netfxrepair.1055.dll
%WINDIR%\microsoft.net\netfxrepair.1053.dll
%WINDIR%\microsoft.net\netfxrepair.2052.dll
%WINDIR%\microsoft.net\netfxrepair.2070.dll
%WINDIR%\microsoft.net\netfxrepair.3076.dll
%WINDIR%\microsoft.net\netfxrepair.3082.dll
%WINDIR%\microsoft.net\netfxrepair.exe
%WINDIR%\microsoft.net\netfxrepair.1032.dll
<SYSTEM32>\atl110.dll
<SYSTEM32>\concrt140d.dll
<SYSTEM32>\aspnet_counters.dll
%WINDIR%\microsoft.net\netfxrepair.1045.dll
%WINDIR%\microsoft.net\netfxrepair.1044.dll
<DRIVERS>\amdide.sys
<DRIVERS>\ohci1394.sys
<DRIVERS>\serenum.sys
<DRIVERS>\sffp_sd.sys
<DRIVERS>\sfloppy.sys
<DRIVERS>\stexstor.sys
<DRIVERS>\storvsc.sys
<DRIVERS>\tsusbhub.sys
<DRIVERS>\tsusbgd.sys
<DRIVERS>\uliagpkx.sys
<DRIVERS>\usbccgp.sys
<DRIVERS>\usbcir.sys
<DRIVERS>\usbstor.sys
<DRIVERS>\usbuhci.sys
<SYSTEM32>\concrt140.dll
<DRIVERS>\processr.sys
<DRIVERS>\sffdisk.sys
<DRIVERS>\viaide.sys
<DRIVERS>\vms3cap.sys
<DRIVERS>\vsmraid.sys
<DRIVERS>\wacompen.sys
<DRIVERS>\winhv.sys
<DRIVERS>\1394bus.sys
<DRIVERS>\acpipmi.sys
<DRIVERS>\brserwdm.sys
<DRIVERS>\bxvbda.sys
<DRIVERS>\hcw85cir.sys
<DRIVERS>\hidbth.sys
<DRIVERS>\hpsamd.sys
<DRIVERS>\vmstorfl.sys
<DRIVERS>\vmbus.sys
<DRIVERS>\vmbushid.sys
<DRIVERS>\ql40xx.sys
<DRIVERS>\parport.sys
<DRIVERS>\pciide.sys
<DRIVERS>\sbp2port.sys
<DRIVERS>\serial.sys
<DRIVERS>\sisraid2.sys
<DRIVERS>\sisraid4.sys
<DRIVERS>\swenum.sys
<DRIVERS>\terminpt.sys
<DRIVERS>\uagp35.sys
<DRIVERS>\umpass.sys
<DRIVERS>\usbehci.sys
<DRIVERS>\usbprint.sys
<DRIVERS>\wmiacpi.sys
<SYSTEM32>\dll64.dll
<SYSTEM32>\atl100.dll
<DRIVERS>\ql2300.sys
<DRIVERS>\adpahci.sys
<DRIVERS>\aliide.sys
<DRIVERS>\amdxata.sys
<DRIVERS>\amdsata.sys
<DRIVERS>\amdppm.sys
<DRIVERS>\arc.sys
<DRIVERS>\arcsas.sys
<DRIVERS>\brserid.sys
<SYSTEM32>\en-us\dfshim.dll.mui
<DRIVERS>\errdev.sys
<DRIVERS>\evbda.sys
<DRIVERS>\monitor.sys
<DRIVERS>\mpio.sys
<DRIVERS>\nv_agp.sys
<DRIVERS>\adpu320.sys
<SYSTEM32>\vccorlib110d.dll
<SYSTEM32>\vccorlib120d.dll

Modifies file system

Creates the following files

%HOMEPATH%\documents\readme.txt
%WINDIR%\softwaredistribution\readme.txt
%WINDIR%\softwaredistribution\datastore\readme.txt
%WINDIR%\shellnew\readme.txt
%WINDIR%\setup\state\readme.txt
%WINDIR%\panther\unattendgc\setuperr.log
%WINDIR%\servicing\editions\readme.txt
%WINDIR%\serviceprofiles\networkservice\readme.txt
%WINDIR%\serviceprofiles\localservice\readme.txt
%WINDIR%\media\afternoon\readme.txt
%WINDIR%\security\logs\readme.txt
%WINDIR%\security\database\readme.txt
%WINDIR%\schemas\availablenetwork\readme.txt
%WINDIR%\resources\themes\readme.txt
%WINDIR%\resources\ease of access themes\readme.txt
%WINDIR%\registration\readme.txt
%WINDIR%\prefetch\readyboot\readme.txt
%WINDIR%\prefetch\readme.txt
%WINDIR%\policydefinitions\en-us\readme.txt
%WINDIR%\softwaredistribution\postrebooteventcache\readme.txt
<SYSTEM32>\readme.txt
<SYSTEM32>\hr-hr\readme.txt
%WINDIR%\pla\system\readme.txt
<SYSTEM32>\ar-sa\readme.txt
<SYSTEM32>\he-il\readme.txt
<SYSTEM32>\fr-fr\readme.txt
<SYSTEM32>\fi-fi\readme.txt
<SYSTEM32>\et-ee\readme.txt
<SYSTEM32>\es-es\readme.txt
<SYSTEM32>\en-us\readme.txt
<SYSTEM32>\en\readme.txt
<SYSTEM32>\el-gr\readme.txt
<DRIVERS>\readme.txt
<SYSTEM32>\dism\readme.txt
<SYSTEM32>\de-de\readme.txt
<SYSTEM32>\da-dk\readme.txt
<SYSTEM32>\cs-cz\readme.txt
<SYSTEM32>\config\readme.txt
<SYSTEM32>\com\readme.txt
<SYSTEM32>\codeintegrity\readme.txt
<SYSTEM32>\catroot2\readme.txt
<SYSTEM32>\bg-bg\readme.txt
%WINDIR%\policydefinitions\readme.txt
%WINDIR%\schemas\wcn\readme.txt
%WINDIR%\pla\rules\readme.txt
%WINDIR%\pla\reports\readme.txt
<SYSTEM32>\hu-hu\readme.txt
%WINDIR%\inf\windows workflow foundation 3.0.0.0\readme.txt
%WINDIR%\installer\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\readme.txt
%WINDIR%\installer\{90140000-006e-0409-1000-0000000ff1ce}\readme.txt
%WINDIR%\installer\{90140000-0043-0000-1000-0000000ff1ce}\readme.txt
%WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\readme.txt
%WINDIR%\installer\readme.txt
%WINDIR%\inf\wsearchidxpi\readme.txt
%WINDIR%\inf\wmiaprpl\readme.txt
%WINDIR%\inf\windows workflow foundation 4.0.0.0\readme.txt
%WINDIR%\inf\usbhub\readme.txt
%WINDIR%\logs\cbs\readme.txt
%WINDIR%\inf\ugthrsvc\readme.txt
%WINDIR%\inf\ugatherer\readme.txt
%WINDIR%\inf\termservice\readme.txt
%WINDIR%\inf\tapisrv\readme.txt
%WINDIR%\inf\smsvchost 4.0.0.0\readme.txt
%WINDIR%\inf\smsvchost 3.0.0.0\readme.txt
%WINDIR%\inf\servicemodelservice 3.0.0.0\readme.txt
%WINDIR%\logs\dpx\readme.txt
%WINDIR%\inf\servicemodelendpoint 3.0.0.0\readme.txt
%WINDIR%\media\calligraphy\readme.txt
%WINDIR%\media\readme.txt
%WINDIR%\performance\winsat\readme.txt
%WINDIR%\l2schemas\readme.txt
%WINDIR%\panther\unattendgc\readme.txt
%WINDIR%\panther\readme.txt
%WINDIR%\panther\actionqueue\readme.txt
%WINDIR%\offline web pages\readme.txt
%WINDIR%\microsoft.net\readme.txt
%WINDIR%\microsoft.net\framework64\readme.txt
%WINDIR%\microsoft.net\framework\readme.txt
%WINDIR%\media\sonata\readme.txt
%WINDIR%\media\savanna\readme.txt
%WINDIR%\media\raga\readme.txt
%WINDIR%\media\quirky\readme.txt
%WINDIR%\media\landscape\readme.txt
%WINDIR%\media\heritage\readme.txt
%WINDIR%\media\garden\readme.txt
%WINDIR%\media\festival\readme.txt
%WINDIR%\media\delta\readme.txt
%WINDIR%\media\cityscape\readme.txt
%WINDIR%\media\characters\readme.txt
%WINDIR%\inf\servicemodeloperation 3.0.0.0\readme.txt
<SYSTEM32>\ias\readme.txt
<SYSTEM32>\sk-sk\readme.txt
%WINDIR%\syswow64\nb-no\readme.txt
%WINDIR%\syswow64\migwiz\readme.txt
%WINDIR%\syswow64\migration\readme.txt
%WINDIR%\syswow64\manifeststore\readme.txt
%WINDIR%\syswow64\lv-lv\readme.txt
%WINDIR%\syswow64\lt-lt\readme.txt
%WINDIR%\syswow64\ko-kr\readme.txt
%WINDIR%\syswow64\ja-jp\readme.txt
%WINDIR%\syswow64\oobe\readme.txt
%WINDIR%\syswow64\nl-nl\readme.txt
%WINDIR%\syswow64\hu-hu\readme.txt
%WINDIR%\syswow64\hr-hr\readme.txt
%WINDIR%\syswow64\he-il\readme.txt
%WINDIR%\syswow64\fr-fr\readme.txt
%WINDIR%\syswow64\fi-fi\readme.txt
%WINDIR%\syswow64\et-ee\readme.txt
%WINDIR%\syswow64\es-es\readme.txt
%WINDIR%\syswow64\en-us\readme.txt
%WINDIR%\syswow64\it-it\readme.txt
%WINDIR%\syswow64\drivers\readme.txt
%WINDIR%\syswow64\pl-pl\readme.txt
%WINDIR%\tapi\readme.txt
%WINDIR%\syswow64\zh-tw\readme.txt
%WINDIR%\syswow64\zh-hk\readme.txt
%WINDIR%\syswow64\zh-cn\readme.txt
%WINDIR%\syswow64\wbem\readme.txt
%WINDIR%\syswow64\uk-ua\readme.txt
%WINDIR%\syswow64\tr-tr\readme.txt
%WINDIR%\syswow64\th-th\readme.txt
%WINDIR%\syswow64\sv-se\readme.txt
%WINDIR%\syswow64\sr-latn-cs\readme.txt
%WINDIR%\syswow64\sppui\readme.txt
%WINDIR%\syswow64\sl-si\readme.txt
%WINDIR%\syswow64\sk-sk\readme.txt
%WINDIR%\syswow64\setup\readme.txt
%WINDIR%\syswow64\ru-ru\readme.txt
%WINDIR%\syswow64\ro-ro\readme.txt
%WINDIR%\syswow64\recovery\readme.txt
%WINDIR%\syswow64\ras\readme.txt
%WINDIR%\syswow64\pt-pt\readme.txt
%WINDIR%\syswow64\en\readme.txt
%WINDIR%\syswow64\installshield\readme.txt
%WINDIR%\syswow64\el-gr\readme.txt
%WINDIR%\syswow64\dism\readme.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\readme.txt
<SYSTEM32>\it-it\readme.txt
<SYSTEM32>\ru-ru\readme.txt
<SYSTEM32>\ro-ro\readme.txt
<SYSTEM32>\restore\readme.txt
<SYSTEM32>\recovery\readme.txt
<SYSTEM32>\ras\readme.txt
<SYSTEM32>\pt-pt\readme.txt
<SYSTEM32>\pt-br\readme.txt
<SYSTEM32>\pl-pl\readme.txt
<SYSTEM32>\oobe\readme.txt
<SYSTEM32>\nl-nl\readme.txt
<SYSTEM32>\nb-no\readme.txt
<SYSTEM32>\msdtc\readme.txt
<SYSTEM32>\migwiz\readme.txt
<SYSTEM32>\migration\readme.txt
<SYSTEM32>\manifeststore\readme.txt
<SYSTEM32>\lv-lv\readme.txt
<SYSTEM32>\lt-lt\readme.txt
<SYSTEM32>\ko-kr\readme.txt
<SYSTEM32>\setup\readme.txt
<SYSTEM32>\ja-jp\readme.txt
<SYSTEM32>\sl-si\readme.txt
<SYSTEM32>\sppui\readme.txt
<SYSTEM32>\sr-latn-cs\readme.txt
%WINDIR%\syswow64\da-dk\readme.txt
%WINDIR%\syswow64\cs-cz\readme.txt
%WINDIR%\syswow64\com\readme.txt
%WINDIR%\syswow64\bg-bg\readme.txt
%WINDIR%\syswow64\ar-sa\readme.txt
%WINDIR%\syswow64\readme.txt
<SYSTEM32>\zh-tw\readme.txt
<SYSTEM32>\zh-hk\readme.txt
<SYSTEM32>\zh-cn\readme.txt
<SYSTEM32>\winbioplugins\readme.txt
<SYSTEM32>\wfp\readme.txt
<SYSTEM32>\wdi\readme.txt
<SYSTEM32>\wbem\readme.txt
<SYSTEM32>\uk-ua\readme.txt
<SYSTEM32>\tr-tr\readme.txt
<SYSTEM32>\th-th\readme.txt
<SYSTEM32>\sysprep\readme.txt
<SYSTEM32>\sv-se\readme.txt
%WINDIR%\syswow64\de-de\readme.txt
%WINDIR%\inf\remoteaccess\readme.txt
%WINDIR%\inf\rdyboost\readme.txt
%WINDIR%\inf\msdtc bridge 4.0.0.0\readme.txt
%ProgramFiles%\windows media player\en-us\readme.txt
%ProgramFiles%\windows mail\readme.txt
%ProgramFiles%\windows mail\en-us\readme.txt
%ProgramFiles%\windows journal\templates\readme.txt
%ProgramFiles%\windows journal\readme.txt
%ProgramFiles%\windows journal\en-us\readme.txt
%ProgramFiles%\windows defender\readme.txt
%ProgramFiles%\windows media player\readme.txt
%ProgramFiles%\windows media player\skins\readme.txt
%ProgramFiles%\windows defender\en-us\readme.txt
%ProgramFiles%\mozilla thunderbird\isp\readme.txt
%ProgramFiles%\mozilla thunderbird\fonts\readme.txt
%ProgramFiles%\mozilla thunderbird\features\readme.txt
%ProgramFiles%\mozilla thunderbird\readme.txt
%ProgramFiles%\mozilla firefox\uninstall\readme.txt
%ProgramFiles%\mozilla firefox\fonts\readme.txt
%ProgramFiles%\mozilla firefox\distibution\readme.txt
%ProgramFiles%\mozilla thunderbird\visualelements\readme.txt
%ProgramFiles%\mozilla thunderbird\uninstall\readme.txt
%ProgramFiles(x86)%\opera\readme.txt
%ProgramFiles%\windows nt\accessories\readme.txt
%ProgramFiles(x86)%\msbuild\readme.txt
%ProgramFiles(x86)%\microsoft.net\redistlist\readme.txt
%ProgramFiles(x86)%\microsoft.net\primary interop assemblies\readme.txt
%ProgramFiles(x86)%\microsoft office\office14\readme.txt
%ProgramFiles(x86)%\internet explorer\signup\readme.txt
%ProgramFiles(x86)%\internet explorer\readme.txt
%ProgramFiles(x86)%\internet explorer\en-us\readme.txt
%ProgramFiles(x86)%\readme.txt
%CommonProgramFiles(x86)%\system\readme.txt
%CommonProgramFiles(x86)%\steam\readme.txt
%CommonProgramFiles(x86)%\services\readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\readme.txt
%ProgramFiles%\windows sidebar\readme.txt
%ProgramFiles%\windows sidebar\en-us\readme.txt
%ProgramFiles%\windows portable devices\readme.txt
%ProgramFiles%\windows photo viewer\readme.txt
%ProgramFiles%\windows photo viewer\en-us\readme.txt
%ProgramFiles%\windows nt\tabletextservice\readme.txt
%ProgramFiles%\mozilla firefox\browser\readme.txt
%ProgramFiles%\mozilla firefox\readme.txt
%ProgramFiles%\windows media player\network sharing\readme.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\readme.txt
%ProgramFiles%\microsoft office\office14\readme.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\readme.txt
%HOMEPATH%\favorites\links for united states\readme.txt
C:\kms\readme.txt
<Current directory>\readme.txt
C:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\readme.txt
%HOMEPATH%\saved games\readme.txt
%HOMEPATH%\links\readme.txt
%HOMEPATH%\favorites\windows live\readme.txt
%HOMEPATH%\favorites\msn websites\readme.txt
%HOMEPATH%\favorites\microsoft websites\readme.txt
%HOMEPATH%\favorites\links\readme.txt
%ProgramFiles(x86)%\opera\assets\readme.txt
%HOMEPATH%\favorites\readme.txt
%HOMEPATH%\contacts\readme.txt
%HOMEPATH%\videos\readme.txt
%HOMEPATH%\music\readme.txt
%HOMEPATH%\downloads\readme.txt
%HOMEPATH%\pictures\readme.txt
%HOMEPATH%\desktop\readme.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\readme.txt
%ProgramFiles(x86)%\opera\29.0.1795.47\readme.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme.txt
%ProgramFiles%\internet explorer\signup\readme.txt
%ProgramFiles%\internet explorer\readme.txt
%ProgramFiles%\internet explorer\en-us\readme.txt
%ProgramFiles%\dvd maker\shared\readme.txt
%ProgramFiles%\dvd maker\en-us\readme.txt
%ProgramFiles%\dvd maker\readme.txt
%ProgramFiles%\readme.txt
%CommonProgramFiles%\system\readme.txt
%CommonProgramFiles%\services\readme.txt
%CommonProgramFiles%\designer\readme.txt
C:\readme.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\readme.txt
%ProgramFiles%\microsoft office\document themes 14\readme.txt
%ProgramFiles%\windows media player\media renderer\readme.txt
%ProgramFiles(x86)%\steam\readme.txt
%WINDIR%\ehome\en-us\readme.txt
%WINDIR%\appcompat\programs\readme.txt
%WINDIR%\ehome\createdisc\readme.txt
%WINDIR%\ehome\readme.txt
%WINDIR%\downloaded program files\readme.txt
%WINDIR%\debug\wia\readme.txt
%WINDIR%\debug\readme.txt
%WINDIR%\cursors\readme.txt
%WINDIR%\branding\shellbrd\readme.txt
%WINDIR%\branding\basebrd\readme.txt
%WINDIR%\bitlockerdiscoveryvolumecontents\readme.txt
%WINDIR%\readme.txt
%WINDIR%\assembly\nativeimages_v4.0.30319_64\readme.txt
%WINDIR%\assembly\nativeimages_v4.0.30319_32\readme.txt
%WINDIR%\assembly\nativeimages_v2.0.50727_64\readme.txt
%WINDIR%\assembly\nativeimages_v2.0.50727_32\readme.txt
%WINDIR%\assembly\readme.txt
%WINDIR%\apppatch\en-us\readme.txt
%WINDIR%\apppatch\apppatch64\readme.txt
%WINDIR%\apppatch\readme.txt
%ProgramFiles(x86)%\steam\bin\readme.txt
%WINDIR%\ehome\mediarenderer\readme.txt
%WINDIR%\ehome\wow\readme.txt
%WINDIR%\en-us\readme.txt
%WINDIR%\fonts\readme.txt
%WINDIR%\inf\msdtc\readme.txt
%WINDIR%\inf\esent\readme.txt
%WINDIR%\inf\en-us\readme.txt
%WINDIR%\inf\bits\readme.txt
%WINDIR%\inf\aspnet_state\readme.txt
%WINDIR%\inf\asp.net_4.0.30319\readme.txt
%WINDIR%\inf\asp.net\readme.txt
%WINDIR%\inf\readme.txt
%WINDIR%\inf\.netframework\readme.txt
%WINDIR%\inf\.net memory cache 4.0\readme.txt
%WINDIR%\inf\.net data provider for sqlserver\readme.txt
%WINDIR%\inf\.net data provider for oracle\readme.txt
%WINDIR%\inf\.net clr networking 4.0.0.0\readme.txt
%WINDIR%\inf\.net clr networking\readme.txt
%WINDIR%\inf\.net clr data\readme.txt
%WINDIR%\ime\readme.txt
%WINDIR%\ime\en-us\readme.txt
%WINDIR%\globalization\sorting\readme.txt
%WINDIR%\inf\msdtc bridge 3.0.0.0\readme.txt
%WINDIR%\syswow64\pt-br\readme.txt
%WINDIR%\temp\readme.txt
%HOMEPATH%\readme.txt
%ProgramFiles(x86)%\windows media player\skins\readme.txt
%ALLUSERSPROFILE%\microsoft\identitycrl\readme.txt
%ProgramFiles(x86)%\windows sidebar\readme.txt
%ProgramFiles(x86)%\windows sidebar\en-us\readme.txt
%ProgramFiles(x86)%\windows portable devices\readme.txt
%ProgramFiles(x86)%\windows photo viewer\readme.txt
%ProgramFiles(x86)%\windows photo viewer\en-us\readme.txt
%ProgramFiles(x86)%\windows nt\tabletextservice\readme.txt
%ProgramFiles(x86)%\windows nt\accessories\readme.txt
%ProgramFiles(x86)%\windows media player\readme.txt
%ALLUSERSPROFILE%\microsoft\office\readme.txt
%ProgramFiles(x86)%\windows media player\media renderer\readme.txt
%ProgramFiles(x86)%\windows media player\en-us\readme.txt
%ProgramFiles(x86)%\windows mail\readme.txt
%ProgramFiles(x86)%\windows mail\en-us\readme.txt
%ProgramFiles(x86)%\windows defender\readme.txt
%ProgramFiles(x86)%\windows defender\en-us\readme.txt
%ProgramFiles(x86)%\steam\public\readme.txt
%ProgramFiles(x86)%\steam\logs\readme.txt
%HOMEPATH%\searches\readme.txt
%WINDIR%\addins\readme.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\readme.txt
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\readme.txt
%ALLUSERSPROFILE%\microsoft\mf\readme.txt
C:\users\public\videos\readme.txt
C:\users\public\recorded tv\readme.txt
C:\users\public\pictures\readme.txt
C:\users\public\music\readme.txt
C:\users\public\libraries\readme.txt
C:\users\public\downloads\readme.txt
C:\users\public\documents\readme.txt
C:\users\public\readme.txt
C:\users\public\desktop\readme.txt
C:\users\readme.txt
C:\users\default\readme.txt
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\readme.txt
%ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\readme.txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\readme.txt
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\readme.txt
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\readme.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\readme.txt
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\readme.txt
%ALLUSERSPROFILE%\microsoft help\readme.txt
%WINDIR%\twain_32\readme.txt

Modifies the following files

%HOMEPATH%\documents\desktop.ini
%HOMEPATH%\favorites\msn websites\msn entertainment.url
%HOMEPATH%\contacts\user.contact
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url
%HOMEPATH%\favorites\microsoft websites\microsoft at work.url
%HOMEPATH%\videos\desktop.ini
%HOMEPATH%\favorites\microsoft websites\microsoft store.url
%HOMEPATH%\favorites\links for united states\desktop.ini
%HOMEPATH%\favorites\links\web slice gallery.url
%HOMEPATH%\favorites\links\desktop.ini
%HOMEPATH%\favorites\links for united states\usa.gov.url
%HOMEPATH%\favorites\links for united states\gobiernousa.gov.url
%HOMEPATH%\contacts\desktop.ini
%HOMEPATH%\favorites\desktop.ini
%HOMEPATH%\music\desktop.ini
%HOMEPATH%\downloads\desktop.ini
%HOMEPATH%\pictures\desktop.ini
%HOMEPATH%\desktop\telegram.lnk
%HOMEPATH%\desktop\google chrome.lnk
%HOMEPATH%\desktop\desktop.ini
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\2.jpeg
%HOMEPATH%\favorites\msn websites\msn autos.url
%HOMEPATH%\favorites\msn websites\msn.url

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Miscellaneous

Restarts the analyzed sample

Executes the following

'<Full path to file>' --food' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial