Trojan.Encoder.38820

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\8mzewjmupmmp1gxfwr.exe

Creates the following files on removable media

<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\writingcompletesarnarrative_1103.ppt
<Drive name for removable media>:\ppswamp.ppt
<Drive name for removable media>:\sacs_presentation_sacs_qep_improving_rt_education_final.ppt
<Drive name for removable media>:\accountsreceivable.ppt
<Drive name for removable media>:\metac.ppt
<Drive name for removable media>:\ksearch_esa_talk.ppt
<Drive name for removable media>:\arrow-down.png
<Drive name for removable media>:\dissolveanother.png
<Drive name for removable media>:\background.png
<Drive name for removable media>:\calibre.png
<Drive name for removable media>:\ck_ugo.pem
<Drive name for removable media>:\cert.pem
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\file1.ppt
<Drive name for removable media>:\investmentbankca_ca8.pem
<Drive name for removable media>:\hhhlcert.pem
<Drive name for removable media>:\server.pem
<Drive name for removable media>:\systisoft.pem
<Drive name for removable media>:\dualectls.pdf
<Drive name for removable media>:\bc01.pdf
<Drive name for removable media>:\10thingscondoms.pdf
<Drive name for removable media>:\spib_pima.pdf
<Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf
<Drive name for removable media>:\7790_preview.pdf
<Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.pdf
<Drive name for removable media>:\video_1.mp4
<Drive name for removable media>:\tunpersonalca1.pem
<Drive name for removable media>:\notepad.exe
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\price.zip
<Drive name for removable media>:\removedtitles_records.zip
<Drive name for removable media>:\excel_example.zip
<Drive name for removable media>:\1sm_price.zip
<Drive name for removable media>:\national_autism_preparation_programs.xlsx
<Drive name for removable media>:\applicant.xlsx
<Drive name for removable media>:\al.xlsx
<Drive name for removable media>:\2013_finalsummaryforweb.xlsx
<Drive name for removable media>:\disclosuredetails.xlsx
<Drive name for removable media>:\productos.xls
<Drive name for removable media>:\contractualdeadlines.xls
<Drive name for removable media>:\price030215.xls
<Drive name for removable media>:\excel_example.xls
<Drive name for removable media>:\subjectclassification.xls
<Drive name for removable media>:\removedtitles_records.xls
<Drive name for removable media>:\guide_reorganization_mapping.xls
<Drive name for removable media>:\babyboymaintoscenesbackground.wmv
<Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv
<Drive name for removable media>:\flower_trans_matte.wmv
<Drive name for removable media>:\babyboymaintoscenesbackground_pal.wmv
<Drive name for removable media>:\fungalnameauthors.rtf
<Drive name for removable media>:\krsweden.rtf
<Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf
<Drive name for removable media>:\swc_2009-03-02.rdf
<Drive name for removable media>:\digest.rdf
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\video.mp4
<Drive name for removable media>:\irgeek.pem
<Drive name for removable media>:\clip_1080_5sec_10mbps_h264.mp4
<Drive name for removable media>:\firefly1.mov
<Drive name for removable media>:\spanner.mov
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\adhd_and_obesity.docx
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
<Drive name for removable media>:\glidescope_review_rev_010.docx
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\issi2013_template_for_posters.docx
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\wrar520.exe
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\price030215.zip
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
<Drive name for removable media>:\tcm851ax32.exe
<Drive name for removable media>:\sdszfo.docx
<Drive name for removable media>:\scan.mov
<Drive name for removable media>:\etc6_m_1.mov
<Drive name for removable media>:\4f0bf7ff71f28.jpg
<Drive name for removable media>:\13.jpg
<Drive name for removable media>:\parnas_01.jpg
<Drive name for removable media>:\1189.jpg
<Drive name for removable media>:\210252809.jpg
<Drive name for removable media>:\13.jpeg
<Drive name for removable media>:\pushkin.jpeg
<Drive name for removable media>:\1189.jpeg
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\4f0bf7ff71f28.jpeg
<Drive name for removable media>:\168.jpeg
<Drive name for removable media>:\region-north-karelia.jpeg
<Drive name for removable media>:\2.jpeg
<Drive name for removable media>:\howto-index.html
<Drive name for removable media>:\iisstart.html
<Drive name for removable media>:\about.html
<Drive name for removable media>:\adadsi.html
<Drive name for removable media>:\trivial-merge.html
<Drive name for removable media>:\ituneshelpunavailable.html
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\advice_process.htm
<Drive name for removable media>:\tree_view.htm
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\ituneshelpunavailable.htm
<Drive name for removable media>:\utorrent.exe
<Drive name for removable media>:\---==%$$$open_me_up$$$==---.txt

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

deletes volume shadow copies.

Hooks functions

in browsers

iexplore.exe process, mshtml.dll module
iexplore.exe process, crypt32.dll module

Terminates or attempts to terminate

the following user processes:

firefox.exe

Modifies file system

Creates the following files

D:\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\oracle\java\javapath\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\wwansvc\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows security health\logs\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows security health\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\winmsipc\server\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft onedrive\setup\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft help\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft onedrive\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\oracle\java\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\wpd\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\mozilla\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\mozilla\updates\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\oracle\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\winmsipc\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\s-1-5-21-2377844457-1847597103-2569463324-1000\---==%$$$open_me_up$$$==---.txt
C:\users\default\---==%$$$open_me_up$$$==---.txt
C:\users\default\videos\---==%$$$open_me_up$$$==---.txt
C:\users\default\saved games\---==%$$$open_me_up$$$==---.txt
C:\users\default\pictures\---==%$$$open_me_up$$$==---.txt
C:\users\default\music\---==%$$$open_me_up$$$==---.txt
C:\users\public\desktop\---==%$$$open_me_up$$$==---.txt
C:\users\default\links\---==%$$$open_me_up$$$==---.txt
C:\users\default\downloads\---==%$$$open_me_up$$$==---.txt
C:\users\default\documents\---==%$$$open_me_up$$$==---.txt
C:\users\default\desktop\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\roaming\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\roaming\microsoft\---==%$$$open_me_up$$$==---.txt
C:\users\default\favorites\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\local\---==%$$$open_me_up$$$==---.txt
C:\users\public\documents\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\connecteddevicesplatform\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\connecteddevicesplatform\l.user\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\comms\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\comms\unistoredb\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\comms\unistore\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\---==%$$$open_me_up$$$==---.txt
C:\users\public\accountpictures\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\.oracle_jre_usage\---==%$$$open_me_up$$$==---.txt
C:\users\public\---==%$$$open_me_up$$$==---.txt
C:\users\public\videos\---==%$$$open_me_up$$$==---.txt
C:\users\public\pictures\---==%$$$open_me_up$$$==---.txt
C:\users\public\music\---==%$$$open_me_up$$$==---.txt
C:\users\public\libraries\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\3d objects\---==%$$$open_me_up$$$==---.txt
C:\users\public\downloads\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\local\temp\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\search\data\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.mixedreality.portal_8wekyb3d8bbwe\s-1-5-21-2377844457-1847597103-2569463324-1000\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.mixedreality.portal_8wekyb3d8bbwe\s-1-5-21-2377844457-1847597103-2569463324-1000\systemappdata\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.microsoftstickynotes_8wekyb3d8bbwe\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.microsoftstickynotes_8wekyb3d8bbwe\s-1-5-21-2377844457-1847597103-2569463324-1000\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.microsoftstickynotes_8wekyb3d8bbwe\s-1-5-21-2377844457-1847597103-2569463324-1000\systemappdata\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.mixedreality.portal_8wekyb3d8bbwe\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.skypeapp_kzf8qxf38zg5c\s-1-5-21-2377844457-1847597103-2569463324-1000\systemappdata\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.microsoft3dviewer_8wekyb3d8bbwe\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.microsoft3dviewer_8wekyb3d8bbwe\s-1-5-21-2377844457-1847597103-2569463324-1000\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.microsoft3dviewer_8wekyb3d8bbwe\s-1-5-21-2377844457-1847597103-2569463324-1000\systemappdata\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-2377844457-1847597103-2569463324-1000\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\s-1-5-21-2377844457-1847597103-2569463324-1000\systemappdata\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-2377844457-1847597103-2569463324-1000\systemappdata\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.skypeapp_kzf8qxf38zg5c\s-1-5-21-2377844457-1847597103-2569463324-1000\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\---==%$$$open_me_up$$$==---.txt
C:\recovery\windowsre\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\local\microsoft\windows sidebar\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\local\microsoft\windows sidebar\gadgets\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\local\microsoft\inputpersonalization\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\local\microsoft\inputpersonalization\traineddatastore\---==%$$$open_me_up$$$==---.txt
C:\recovery\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\local\microsoft\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\microsoft.skypeapp_kzf8qxf38zg5c\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\windowsholographicdevices\spatialstore\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\usoshared\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\usoshared\logs\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\softwaredistribution\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\regid.1991-06.com.microsoft\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\windowsholographicdevices\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\systemkeys\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\pcpksp\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\pcpksp\windowsaik\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\devicesync\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\siufloc\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\sideload\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\localtracestore\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\feedbackhub\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\eventtranscript\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\etllogs\scenarioshutdownlogger\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\etllogs\autologger\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedscenarios\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\customtraceprofiles\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\etllogs\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\softlanding\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\appv\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\appv\setup\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\softlandingstage\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
<Current directory>\---==%$$$open_me_up$$$==---.txt
C:\kms\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\etllogs\shutdownlogger\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\---==%$$$open_me_up$$$==---.txt
C:\perflogs\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\adobe\setup\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\adobe\arm\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\adobe\arm\s\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\adobe\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\keys\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\features\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\clean store\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\updates\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\nisbackup\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\default\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\backup\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\timetraveldebuggingstorage\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\localcopy\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\uev\templates\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\wdf\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\vault\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\uev\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender advanced threat protection\temp\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender advanced threat protection\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\network inspection system\support\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\store\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\service\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\results\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\results\resource\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\network inspection system\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\platform\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\04\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\01\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\cachemanager\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\backupstore\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\quarantine\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\19\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\comms\unistore\data\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\extensions\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\storage health\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\drm\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\channels\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\devicestatedata\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\drm\server\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\network\connections\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\identitycrl\production\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\identitycrl\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\mapdata\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\mf\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\netframework\breadcrumbstore\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\identitycrl\int\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\uev\scripts\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\office\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\network\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\speech_onecore\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\spectrum\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\smsrouter\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\settings\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\office\heartbeat\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\settings\accounts\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\netframework\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\search\data\temp\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\provisioning\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\provisioning\assetcache\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\provisioning\assetcache\cellularux\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\search\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\---==%$$$open_me_up$$$==---.txt

Modifies the following files

<Drive name for removable media>:\archer.avi
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.msi
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excellr.cab
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.msi
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\owow64ww.cab
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.msi
C:\kms\kms_vl_all_aio_debug.log
C:\kms\kms_vl_all_aio.cmd
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\correct.avi
D:\install.log
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.msi
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\pptlr.cab

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)

Executes the following

'%WINDIR%\explorer.exe'
'<SYSTEM32>\svchost.exe' -k wsappx -p

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial