Backdoor.Lavandos.A is especially optimized for ripping off e-banking users of some institutions based in Russia and Ukraine. The tool goes to great lengths in order to ensure that it will successfully snatch your account, no matter where you live. The original.exe file checks what browsers are installed on the PC in. order to generate for each browser a setupapi.dll in the installation root folder for Mozilla Firefox Opera and Internet Explorer browsers. Another.dll file will be created in C:windowssystem32sfcfiles.dll.”]
Source: https://www.bitdefender.com/blog/hotforsecurity/backdoor-lavandos-a-the-ultimate-keylogger/