legitimate file to load and execute itself. TOUCHSHIFT has been observed containing one to two various payloads which it executes inmemory. Payloads that have been seen include TOUCHSHOT, TOUCHKEY, HOOKSHOT, TOUCHMOVE, and SIDESHOW.