Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\samieee_obiee_presentation.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
Modifies file system
Creates the following files
- %TEMP%\sgii1muq.0.cs
- %TEMP%\sgii1muq.cmdline
- %TEMP%\sgii1muq.out
- %TEMP%\csccbdd.tmp
- %TEMP%\rescbfd.tmp
- %TEMP%\sgii1muq.dll
- %TEMP%\1d8uyhql.0.cs
- %TEMP%\1d8uyhql.cmdline
- %TEMP%\1d8uyhql.out
- %TEMP%\csccf77.tmp
- %TEMP%\rescf88.tmp
- %TEMP%\1d8uyhql.dll
Deletes the following files
- %TEMP%\rescbfd.tmp
- %TEMP%\csccbdd.tmp
- %TEMP%\sgii1muq.out
- %TEMP%\sgii1muq.dll
- %TEMP%\sgii1muq.0.cs
- %TEMP%\sgii1muq.pdb
- %TEMP%\sgii1muq.cmdline
- %TEMP%\rescf88.tmp
- %TEMP%\csccf77.tmp
- %TEMP%\1d8uyhql.out
- %TEMP%\1d8uyhql.dll
- %TEMP%\1d8uyhql.cmdline
- %TEMP%\1d8uyhql.0.cs
- %TEMP%\1d8uyhql.pdb
Moves the following files
- from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\unins000.dat.52fad1
- from %ProgramFiles(x86)%\steam\libx264-142.dll.crypt to %ProgramFiles(x86)%\steam\libx264-142.dll.crypt.52fad1
- from %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt to %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt.52fad1
- from %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5 to %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5.52fad1
- from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.52fad1
- from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm.52fad1
- from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.52fad1
- from %ProgramFiles(x86)%\qip 2012\unins000.dat to %ProgramFiles(x86)%\qip 2012\unins000.dat.52fad1
- from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.52fad1
- from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.xml.52fad1
- from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\readme.txt.52fad1
- from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.52fad1
- from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.52fad1
- from %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml to %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml.52fad1
- from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.52fad1
- from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.52fad1
- from %ProgramFiles(x86)%\steam\libx264-142.dll.md5 to %ProgramFiles(x86)%\steam\libx264-142.dll.md5.52fad1
- from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini.52fad1
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\sgii1muq.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCBFD.tmp" "%TEMP%\CSCCBDD.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\1d8uyhql.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCF88.tmp" "%TEMP%\CSCCF77.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\sgii1muq.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCBFD.tmp" "%TEMP%\CSCCBDD.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\1d8uyhql.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCF88.tmp" "%TEMP%\CSCCF77.tmp"
