Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\hitlersnastylittlecrypteromgwtfhelp.key23
- <Drive name for removable media>:\helloreadmenow23.txt
Modifies file system
Creates the following files
- C:\users\public\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\helloreadmenow23.txt
- C:\far2\plugins\align\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\align\helloreadmenow23.txt
- C:\far2\plugins\arclite\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\fexcept\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\fexcept\helloreadmenow23.txt
- C:\far2\plugins\arclite\helloreadmenow23.txt
- C:\far2\plugins\brackets\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\brackets\helloreadmenow23.txt
- C:\far2\plugins\compare\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\compare\helloreadmenow23.txt
- C:\far2\plugins\drawline\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\autowrap\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\autowrap\helloreadmenow23.txt
- C:\far2\plugins\editcase\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\drawline\helloreadmenow23.txt
- C:\far2\encyclopedia\helloreadmenow23.txt
- %HOMEPATH%\voip\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\voip\helloreadmenow23.txt
- C:\far2\addons\xlat\helloreadmenow23.txt
- C:\far2\addons\xlat\russian\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\encyclopedia\tap\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\videos\helloreadmenow23.txt
- C:\far2\encyclopedia\tap\helloreadmenow23.txt
- C:\far2\addons\xlat\russian\helloreadmenow23.txt
- C:\far2\documentation\eng\helloreadmenow23.txt
- C:\far2\documentation\rus\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\documentation\rus\helloreadmenow23.txt
- C:\far2\encyclopedia\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\documentation\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\documentation\helloreadmenow23.txt
- C:\far2\documentation\eng\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\addons\colors\custom_highlighting\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\editcase\helloreadmenow23.txt
- C:\far2\pluginsdk\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\pluginsdk\headers.c\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\pluginsdk\headers.c\helloreadmenow23.txt
- C:\far2\pluginsdk\headers.pas\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\pluginsdk\headers.pas\helloreadmenow23.txt
- C:\far2\plugins\tmppanel\helloreadmenow23.txt
- <Current directory>\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\pluginsdk\helloreadmenow23.txt
- C:\perflogs\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\perflogs\admin\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\perflogs\admin\helloreadmenow23.txt
- C:\totalcmd\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\totalcmd\helloreadmenow23.txt
- <Current directory>\helloreadmenow23.txt
- C:\far2\plugins\tmppanel\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\perflogs\helloreadmenow23.txt
- C:\far2\plugins\proclist\helloreadmenow23.txt
- C:\far2\plugins\proclist\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\emenu\helloreadmenow23.txt
- C:\far2\plugins\farcmds\helloreadmenow23.txt
- C:\far2\plugins\filecase\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\filecase\helloreadmenow23.txt
- C:\far2\plugins\ftp\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\ftp\helloreadmenow23.txt
- C:\far2\plugins\ftp\lib\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\farcmds\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\ftp\lib\helloreadmenow23.txt
- C:\far2\plugins\hlfviewer\helloreadmenow23.txt
- C:\far2\plugins\macroview\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\macroview\helloreadmenow23.txt
- C:\far2\plugins\network\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\network\helloreadmenow23.txt
- %HOMEPATH%\videos\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\hlfviewer\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\addons\xlat\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\searches\helloreadmenow23.txt
- %HOMEPATH%\searches\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\addons\shell\helloreadmenow23.txt
- C:\users\public\recorded tv\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\users\public\recorded tv\helloreadmenow23.txt
- C:\users\public\recorded tv\sample media\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\users\public\recorded tv\sample media\helloreadmenow23.txt
- C:\users\public\pictures\sample pictures\helloreadmenow23.txt
- C:\users\public\pictures\helloreadmenow23.txt
- C:\far2\addons\helloreadmenow23.txt
- C:\users\public\videos\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\users\public\videos\sample videos\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\users\public\videos\sample videos\helloreadmenow23.txt
- %HOMEPATH%\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\helloreadmenow23.txt
- C:\far2\addons\colors\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\addons\colors\helloreadmenow23.txt
- C:\users\public\videos\helloreadmenow23.txt
- C:\users\public\pictures\sample pictures\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\users\public\pictures\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\contacts\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\users\public\documents\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\users\public\documents\helloreadmenow23.txt
- C:\users\public\downloads\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\helloreadmenow23.txt
- D:\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\users\public\helloreadmenow23.txt
- D:\helloreadmenow23.txt
- C:\users\public\music\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\users\public\music\helloreadmenow23.txt
- C:\far2\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\helloreadmenow23.txt
- C:\users\public\music\sample music\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\users\public\music\sample music\helloreadmenow23.txt
- C:\users\public\downloads\helloreadmenow23.txt
- C:\totalcmd\language\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\plugins\emenu\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\contacts\helloreadmenow23.txt
- %HOMEPATH%\desktop\helloreadmenow23.txt
- %HOMEPATH%\favorites\msn websites\helloreadmenow23.txt
- %HOMEPATH%\favorites\windows live\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\favorites\windows live\helloreadmenow23.txt
- %HOMEPATH%\links\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\addons\setup\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\links\helloreadmenow23.txt
- %HOMEPATH%\favorites\msn websites\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\music\helloreadmenow23.txt
- %HOMEPATH%\pictures\helloreadmenow23.txt
- %HOMEPATH%\saved games\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\addons\shell\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\saved games\helloreadmenow23.txt
- %HOMEPATH%\music\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\addons\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\pictures\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\addons\setup\helloreadmenow23.txt
- %HOMEPATH%\favorites\microsoft websites\helloreadmenow23.txt
- %HOMEPATH%\favorites\microsoft websites\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\documents\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\documents\helloreadmenow23.txt
- C:\far2\addons\colors\default_highlighting\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\addons\colors\default_highlighting\helloreadmenow23.txt
- %HOMEPATH%\downloads\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\addons\colors\custom_highlighting\helloreadmenow23.txt
- %HOMEPATH%\downloads\helloreadmenow23.txt
- %HOMEPATH%\favorites\helloreadmenow23.txt
- C:\far2\addons\macros\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\far2\addons\macros\helloreadmenow23.txt
- %HOMEPATH%\favorites\links\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\favorites\links\helloreadmenow23.txt
- %HOMEPATH%\favorites\links for united states\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\favorites\hitlersnastylittlecrypteromgwtfhelp.key23
- %HOMEPATH%\favorites\links for united states\helloreadmenow23.txt
- %HOMEPATH%\desktop\hitlersnastylittlecrypteromgwtfhelp.key23
- C:\totalcmd\language\helloreadmenow23.txt
Modifies user data files (Trojan.Encoder).
Network activity
UDP
- DNS ASK la###macau.com
