When first run Troj/Lineag-AN copies itself to <Windows>\help\EB6C4499B05F.exe and creates the following files:
<Root>\1.hiv
<Root>\2.hiv
<Current Folder>\2.bat
<Windows>\1.bat
<Windows>\help\EB6C4499B05F.dll
The file EB6C4499B05F.dll is detected as Mal/LineDLL-B.
The file EB6C4499B05F.dll is registered as a COM object and shell extension, creating registry entries under:
HKCR\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{1DBD6574-D6D0-4782-94C3-69619E719765}