Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\start.bat
Creates the following files on removable media
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\alert.html
- <Drive name for removable media>:\ituneshelpunavailable.html
- <Drive name for removable media>:\pushkin.jpeg
- <Drive name for removable media>:\pushkin.jpg
- <Drive name for removable media>:\systisoft.pem
- <Drive name for removable media>:\investmentbankca_ca8.pem
- <Drive name for removable media>:\breakpoint.png
- <Drive name for removable media>:\contractualdeadlines.zip
- <Drive name for removable media>:\contenttypes.rdf
- <Drive name for removable media>:\digest.rdf
- <Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf
- <Drive name for removable media>:\trivial-merge.htm
- <Drive name for removable media>:\price030215.zip
- <Drive name for removable media>:\trivial-merge.html
- <Drive name for removable media>:\howto-index.html
- <Drive name for removable media>:\64bit_notes.htm
- <Drive name for removable media>:\advice_process.htm
- <Drive name for removable media>:\alert.htm
- <Drive name for removable media>:\1189.jpeg
- <Drive name for removable media>:\productos.zip
- <Drive name for removable media>:\about.htm
- <Drive name for removable media>:\browse.htm
- <Drive name for removable media>:\about.html
- <Drive name for removable media>:\2013_smccc_competition_points_jul2013.xlsx
- <Drive name for removable media>:\fiche_inscription_2015.zip
- <Drive name for removable media>:\router_manual.rtf
- <Drive name for removable media>:\168.jpg
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\210252809.jpeg
- <Drive name for removable media>:\region-north-karelia.jpeg
- <Drive name for removable media>:\3.jpeg
- <Drive name for removable media>:\issi2013_template_for_posters.docx
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\sdszfo.docx
- <Drive name for removable media>:\region-north-karelia.jpg
- <Drive name for removable media>:\ck.pem
- <Drive name for removable media>:\spanner.mov
- <Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.mp4
- <Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf
- <Drive name for removable media>:\delongcacert.pem
- <Drive name for removable media>:\fiche_inscription_2015.xls
- <Drive name for removable media>:\removedtitles_records.xls
- <Drive name for removable media>:\cleanlyrics.png
- <Drive name for removable media>:\swc_2009-03-02.rdf
- <Drive name for removable media>:\taxus_baccata.rdf
- <Drive name for removable media>:\sioc.rdf
- <Drive name for removable media>:\1189.jpg
- <Drive name for removable media>:\contractualdeadlines.xls
Modifies file system
Creates the following files
- %PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\60ab7492cc039a867c9d2b0144c3d0d6_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- C:\users\public\public
- C:\users\public\unique_id_do_not_remove
- %PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304839888e02_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- D:\decrypt_information.html
- D:\$recycle.bin\decrypt_information.html
- C:\decrypt_information.html
- C:\far2\decrypt_information.html
- C:\far2\addons\decrypt_information.html
- C:\far2\addons\colors\decrypt_information.html
- C:\far2\addons\xlat\decrypt_information.html
- C:\far2\documentation\decrypt_information.html
- C:\far2\encyclopedia\decrypt_information.html
- C:\far2\plugins\decrypt_information.html
Modifies user data files (Trojan.Encoder).
