Technical Information
Malicious functions
Creates and executes the following
- '%WINDIR%\installer\msib902.tmp' /b 3 120 0
Modifies file system
Deletes the following files
- %WINDIR%\installer\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\sc_reader.ico
- %WINDIR%\installer\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\apifile_8.ico
- %WINDIR%\installer\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\fdffile_8.ico
- %WINDIR%\installer\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\pdxfile_8.ico
- %WINDIR%\installer\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\secstorefile.ico
- %WINDIR%\installer\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\xdpfile_8.ico
- %WINDIR%\installer\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\xfdffile_8.ico
- %WINDIR%\installer\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\pdffile_8.ico
- %WINDIR%\installer\ce993.msp
- %WINDIR%\installer\299fe1.msp
Moves the following system files
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\a3dutils.dll to C:\config.msi\fabd7.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\escript.api to C:\config.msi\fabfc.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\fillsign.aapp to C:\config.msi\fabfd.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\home.aapp to C:\config.msi\fabfe.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\ia32.api to C:\config.msi\fabff.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\icudtl.dat to C:\config.msi\fac00.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\jp2klib.dll to C:\config.msi\fac01.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\jsbytecodewin.bin to C:\config.msi\fac02.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\libcef.dll.15ee1c08_ed51_465d_b6f3_fb152b1cc435 to C:\config.msi\fac03.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\logsession.dll to C:\config.msi\fac04.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\logtransport2.exe to C:\config.msi\fac05.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\makeaccessible.api_non_opt to C:\config.msi\fac06.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\multimedia.api_non_opt to C:\config.msi\fac07.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\nppdf32.dll to C:\config.msi\fac08.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\edit_r_rhp.aapp to C:\config.msi\fabfa.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\en_us.pak.15ee1c08_ed51_465d_b6f3_fb152b1cc435 to C:\config.msi\fabfb.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\nppdf32.dll_apollo to C:\config.msi\fac09.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\pddom.api_non_opt to C:\config.msi\fac0a.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\_4bitmapibroker.exe to C:\config.msi\fac18.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\weblink.api to C:\config.msi\fac17.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\updater.api_non_opt to C:\config.msi\fac16.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\tesselate.x3d to C:\config.msi\fac15.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\spelling.api to C:\config.msi\fac14.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\bib.dll_non_opt to C:\config.msi\fabef.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\sendmail.api to C:\config.msi\fac13.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\saveasrtf.api_non_opt to C:\config.msi\fac11.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\rt3d.dll to C:\config.msi\fac10.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\reflow.api_non_opt to C:\config.msi\fac0f.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\readoutloud.api to C:\config.msi\fac0e.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\rdrservicesupdater.exe to C:\config.msi\fac0d.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\prcr.x3d to C:\config.msi\fac0c.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\ppklite.api to C:\config.msi\fac0b.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\edit_r_full.aapp to C:\config.msi\fabf9.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\ebook.api to C:\config.msi\fabf8.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\dva.api to C:\config.msi\fabf7.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\ace.dll_non_opt to C:\config.msi\fabd9.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acrobroker.exe to C:\config.msi\fabda.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acrocef.exe.15ee1c08_ed51_465d_b6f3_fb152b1cc435 to C:\config.msi\fabdb.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acroform.api__non_opt to C:\config.msi\fabdc.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acropdf.dll to C:\config.msi\fabdd.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acropdf64.dll to C:\config.msi\fabde.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acropdfimpl.dll to C:\config.msi\fabdf.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acropdfimpl64.dll to C:\config.msi\fabe0.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acrord32.dll to C:\config.msi\fabe1.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acrord32.exe to C:\config.msi\fabe2.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acrord32info.exe to C:\config.msi\fabe3.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acrord32res.dll to C:\config.msi\fabe4.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acrosup64.dll to C:\config.msi\fabe5.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\adelrcp.exe to C:\config.msi\fabe6.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\accessibility.api_non_opt to C:\config.msi\fabd8.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\adobearm.exe.bdca7721_f290_4124_bbed_7a15fe7694eb to C:\config.msi\fabe7.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\drvsoft.x3d to C:\config.msi\fabf6.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\adobearmhelper.exe.bdca7721_f290_4124_bbed_7a15fe7694eb to C:\config.msi\fabe8.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\adobecollabsync.exe to C:\config.msi\fabe9.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\adoberfp.dll to C:\config.msi\fabea.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\agm.dll to C:\config.msi\fabeb.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\aiodlite.dll to C:\config.msi\fabec.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\annots.api to C:\config.msi\fabed.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\search.api to C:\config.msi\fac12.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\armsvc.exe.bdca7721_f290_4124_bbed_7a15fe7694eb to C:\config.msi\fabee.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\_difr.x3d to C:\config.msi\fac19.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\cef.pak.15ee1c08_ed51_465d_b6f3_fb152b1cc435 to C:\config.msi\fabf1.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\checkers.api to C:\config.msi\fabf2.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\cooltype.dll_non_opt to C:\config.msi\fabf3.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\digsig.api to C:\config.msi\fabf4.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\drvdx9.x3d to C:\config.msi\fabf5.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\bibutils.dll to C:\config.msi\fabf0.rbf
- from %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\cachesize.txt to C:\config.msi\fac1a.rbf
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat
Miscellaneous
Searches for the following windows
- ClassName: 'Distiller' WindowName: ''
- ClassName: 'AdobeCollabSynchronizerNotification' WindowName: ''
Executes the following
- '<SYSTEM32>\msiexec.exe' /x {AC76BA86-7AD7-1033-7B44-AC0F074E4100} /qb- /norestart
