Trojan.Encoder.32482

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\indogerman2010.pptx

Modifies file system

Creates the following files

%TEMP%\tieongxp.0.cs
%TEMP%\tieongxp.cmdline
%TEMP%\tieongxp.out
%TEMP%\csc7ecc.tmp
%TEMP%\res7edc.tmp
%TEMP%\tieongxp.dll
%TEMP%\dbti1izi.0.cs
%TEMP%\dbti1izi.cmdline
%TEMP%\dbti1izi.out
%TEMP%\csc81aa.tmp
%TEMP%\res81ab.tmp
%TEMP%\dbti1izi.dll

Deletes the following files

%TEMP%\res7edc.tmp
%TEMP%\csc7ecc.tmp
%TEMP%\tieongxp.cmdline
%TEMP%\tieongxp.pdb
%TEMP%\tieongxp.dll
%TEMP%\tieongxp.0.cs
%TEMP%\tieongxp.out
%TEMP%\res81ab.tmp
%TEMP%\csc81aa.tmp
%TEMP%\dbti1izi.dll
%TEMP%\dbti1izi.0.cs
%TEMP%\dbti1izi.cmdline
%TEMP%\dbti1izi.pdb
%TEMP%\dbti1izi.out

Moves the following files

from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm.100d2c
from %ProgramFiles(x86)%\steam\graphics\radselstd.tga to %ProgramFiles(x86)%\steam\graphics\radselstd.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - alien intercourse 4.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - alien intercourse 4.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\radunseldis.tga to %ProgramFiles(x86)%\steam\graphics\radunseldis.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - alienated (evilrice trinity tron remix).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - alienated (evilrice trinity tron remix).avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\radunselfocus.tga to %ProgramFiles(x86)%\steam\graphics\radunselfocus.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - hash the planet.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - hash the planet.avs.100d2c
from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\whatsnew.txt.100d2c
from %ProgramFiles(x86)%\winamp\system\aacdec.w5s to %ProgramFiles(x86)%\winamp\system\aacdec.w5s.100d2c
from %ProgramFiles(x86)%\steam\graphics\radunselstd.tga to %ProgramFiles(x86)%\steam\graphics\radunselstd.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - warm freeform.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - warm freeform.avs.100d2c
from %ProgramFiles%\firefox\freebl3.chk to %ProgramFiles%\firefox\freebl3.chk.100d2c
from %ProgramFiles%\firefox\js.log to %ProgramFiles%\firefox\js.log.100d2c
from %ProgramFiles%\firefox\greprefs.js to %ProgramFiles%\firefox\greprefs.js.100d2c
from %ProgramFiles(x86)%\winamp\system\alac.w5s to %ProgramFiles(x86)%\winamp\system\alac.w5s.100d2c
from %ProgramFiles%\firefox\platform.ini to %ProgramFiles%\firefox\platform.ini.100d2c
from %ProgramFiles(x86)%\steam\graphics\rampdown_1.tga to %ProgramFiles(x86)%\steam\graphics\rampdown_1.tga.100d2c
from %ProgramFiles(x86)%\winamp\system\aacdec.wbm to %ProgramFiles(x86)%\winamp\system\aacdec.wbm.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - golden.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - golden.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\rampdown_2.tga to %ProgramFiles(x86)%\steam\graphics\rampdown_2.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - rittaufdemfeuerstrahl.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - rittaufdemfeuerstrahl.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\rampdown_3.tga to %ProgramFiles(x86)%\steam\graphics\rampdown_3.tga.100d2c
from %ProgramFiles(x86)%\winamp\system\adpcm.w5s to %ProgramFiles(x86)%\winamp\system\adpcm.w5s.100d2c
from %ProgramFiles(x86)%\winamp\system\adpcm.wbm to %ProgramFiles(x86)%\winamp\system\adpcm.wbm.100d2c
from %ProgramFiles(x86)%\steam\graphics\rampdown_4.tga to %ProgramFiles(x86)%\steam\graphics\rampdown_4.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - spindle.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - spindle.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\rampup_1.tga to %ProgramFiles(x86)%\steam\graphics\rampup_1.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - spirit realm (plasmoid rmx).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - spirit realm (plasmoid rmx).avs.100d2c
from %ProgramFiles%\firefox\nssdbm3.chk to %ProgramFiles%\firefox\nssdbm3.chk.100d2c
from %ProgramFiles(x86)%\steam\graphics\radselfocus.tga to %ProgramFiles(x86)%\steam\graphics\radselfocus.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\osx_max_down.tga to %ProgramFiles(x86)%\steam\graphics\osx_max_down.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_norwegian.tga to %ProgramFiles(x86)%\steam\graphics\new_button_norwegian.tga.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_voicechat_voicelevels.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_voicechat_voicelevels.tga.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_voiceholdactivity.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_voiceholdactivity.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_spanish.tga to %ProgramFiles(x86)%\steam\graphics\new_button_spanish.tga.100d2c
from %ProgramFiles(x86)%\winamp\skins\bento\scripts\mcvcore.maki to %ProgramFiles(x86)%\winamp\skins\bento\scripts\mcvcore.maki.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_swedish.tga to %ProgramFiles(x86)%\steam\graphics\new_button_swedish.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\addborder.ape to %ProgramFiles(x86)%\winamp\plugins\avs\addborder.ape.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_tab.tga to %ProgramFiles(x86)%\steam\graphics\new_tab.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\osx_close_def.tga to %ProgramFiles(x86)%\steam\graphics\osx_close_def.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\osx_close_down.tga to %ProgramFiles(x86)%\steam\graphics\osx_close_down.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\osx_close_hov.tga to %ProgramFiles(x86)%\steam\graphics\osx_close_hov.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\osx_max_def.tga to %ProgramFiles(x86)%\steam\graphics\osx_max_def.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\colormap.ape to %ProgramFiles(x86)%\winamp\plugins\avs\colormap.ape.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - fury (extreme remix) by fsk.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - fury (extreme remix) by fsk.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\osx_max_hov.tga to %ProgramFiles(x86)%\steam\graphics\osx_max_hov.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\osx_min_def.tga to %ProgramFiles(x86)%\steam\graphics\osx_min_def.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\acid - twitchy liquid shit (mixing plastics mix by tuggummi).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\acid - twitchy liquid shit (mixing plastics mix by tuggummi).avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\osx_min_down.tga to %ProgramFiles(x86)%\steam\graphics\osx_min_down.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\amphirion - ex deux mechanica.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\amphirion - ex deux mechanica.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\osx_min_hov.tga to %ProgramFiles(x86)%\steam\graphics\osx_min_hov.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\amphirion - geometric sustinance.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\amphirion - geometric sustinance.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\osx_win_dis.tga to %ProgramFiles(x86)%\steam\graphics\osx_win_dis.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - data flow.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - data flow.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\radseldis.tga to %ProgramFiles(x86)%\steam\graphics\radseldis.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - fractal (slo-mo metallic) (u).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - fractal (slo-mo metallic) (u).avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\radseldown.tga to %ProgramFiles(x86)%\steam\graphics\radseldown.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - helium.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - helium.avs.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\fuk - afterburner remix.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\fuk - afterburner remix.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\rampup_2.tga to %ProgramFiles(x86)%\steam\graphics\rampup_2.tga.100d2c
from %ProgramFiles(x86)%\winamp\system\alac.wbm to %ProgramFiles(x86)%\winamp\system\alac.wbm.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\s_kupers - curvism 002 (tuggummi's paprika mix).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\s_kupers - curvism 002 (tuggummi's paprika mix).avs.100d2c
from %ProgramFiles(x86)%\winamp\system\gif.w5s to %ProgramFiles(x86)%\winamp\system\gif.w5s.100d2c
from %ProgramFiles(x86)%\steam\graphics\scrtopleft.tga to %ProgramFiles(x86)%\steam\graphics\scrtopleft.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\s_kupers - gace.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\s_kupers - gace.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\scrtopright.tga to %ProgramFiles(x86)%\steam\graphics\scrtopright.tga.100d2c
from %ProgramFiles(x86)%\winamp\system\gracenote.w5s to %ProgramFiles(x86)%\winamp\system\gracenote.w5s.100d2c
from %ProgramFiles(x86)%\steam\graphics\shadowbottom.tga to %ProgramFiles(x86)%\steam\graphics\shadowbottom.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\s_kupers - the revenge of mt. doom.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\s_kupers - the revenge of mt. doom.avs.100d2c
from %ProgramFiles(x86)%\winamp\system\h264.w5s to %ProgramFiles(x86)%\winamp\system\h264.w5s.100d2c
from %ProgramFiles(x86)%\steam\graphics\shadowslanttop.tga to %ProgramFiles(x86)%\steam\graphics\shadowslanttop.tga.100d2c
from %ProgramFiles(x86)%\winamp\system\h264.wbm to %ProgramFiles(x86)%\winamp\system\h264.wbm.100d2c
from %ProgramFiles(x86)%\winamp\system\filereader.w5s to %ProgramFiles(x86)%\winamp\system\filereader.w5s.100d2c
from %ProgramFiles(x86)%\steam\graphics\scrtop.tga to %ProgramFiles(x86)%\steam\graphics\scrtop.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\tonic - one more (bw contest).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\tonic - one more (bw contest).avs.100d2c
from %ProgramFiles(x86)%\winamp\system\jnetlib.w5s to %ProgramFiles(x86)%\winamp\system\jnetlib.w5s.100d2c
from %ProgramFiles(x86)%\steam\graphics\simbottom.tga to %ProgramFiles(x86)%\steam\graphics\simbottom.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\tuggummi - let me out!.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\tuggummi - let me out!.avs.100d2c
from %ProgramFiles(x86)%\winamp\system\jpeg.w5s to %ProgramFiles(x86)%\winamp\system\jpeg.w5s.100d2c
from %ProgramFiles(x86)%\steam\graphics\simtop.tga to %ProgramFiles(x86)%\steam\graphics\simtop.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\tuggummi - shiny metal curves.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\tuggummi - shiny metal curves.avs.100d2c
from %ProgramFiles(x86)%\winamp\system\mp4v.w5s to %ProgramFiles(x86)%\winamp\system\mp4v.w5s.100d2c
from %ProgramFiles(x86)%\winamp\system\mp4v.wbm to %ProgramFiles(x86)%\winamp\system\mp4v.wbm.100d2c
from %ProgramFiles(x86)%\steam\graphics\streaming_intro.tga to %ProgramFiles(x86)%\steam\graphics\streaming_intro.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\unconed - butterfly caught.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\unconed - butterfly caught.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\streaming_shortcut_16.tga to %ProgramFiles(x86)%\steam\graphics\streaming_shortcut_16.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\shadowtop.tga to %ProgramFiles(x86)%\steam\graphics\shadowtop.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\tonic - zoomed picture from one insect.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\tonic - zoomed picture from one insect.avs.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\shock value - source of power.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\shock value - source of power.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\scrright.tga to %ProgramFiles(x86)%\steam\graphics\scrright.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\shock value - architectural design (v.1.01).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\shock value - architectural design (v.1.01).avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\rampup_3.tga to %ProgramFiles(x86)%\steam\graphics\rampup_3.tga.100d2c
from %ProgramFiles(x86)%\winamp\system\albumart.w5s to %ProgramFiles(x86)%\winamp\system\albumart.w5s.100d2c
from %ProgramFiles(x86)%\steam\graphics\rampup_4.tga to %ProgramFiles(x86)%\steam\graphics\rampup_4.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\fuk - ice cube.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\fuk - ice cube.avs.100d2c
from %ProgramFiles(x86)%\winamp\system\auth.w5s to %ProgramFiles(x86)%\winamp\system\auth.w5s.100d2c
from %ProgramFiles(x86)%\steam\graphics\resizer.tga to %ProgramFiles(x86)%\steam\graphics\resizer.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\jay-fatboy - pieces of a dead world.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\jay-fatboy - pieces of a dead world.avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\resizer_over.tga to %ProgramFiles(x86)%\steam\graphics\resizer_over.tga.100d2c
from %ProgramFiles(x86)%\winamp\system\bmp.w5s to %ProgramFiles(x86)%\winamp\system\bmp.w5s.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\jheriko - alien device (gallery remix by zamuz).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\jheriko - alien device (gallery remix by zamuz).avs.100d2c
from %ProgramFiles(x86)%\steam\graphics\scrbottom.tga to %ProgramFiles(x86)%\steam\graphics\scrbottom.tga.100d2c
from %ProgramFiles(x86)%\winamp\skins\big bento\about\about.maki to %ProgramFiles(x86)%\winamp\skins\big bento\about\about.maki.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\fuk - cube.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\fuk - cube.avs.100d2c
from %ProgramFiles(x86)%\winamp\system\devices.w5s to %ProgramFiles(x86)%\winamp\system\devices.w5s.100d2c
from %ProgramFiles(x86)%\steam\graphics\scrbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\scrbottomleft.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\nemoorange - clockwork.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\nemoorange - clockwork.avs.100d2c
from %ProgramFiles(x86)%\winamp\system\dlmgr.w5s to %ProgramFiles(x86)%\winamp\system\dlmgr.w5s.100d2c
from %ProgramFiles(x86)%\steam\graphics\scrbottomright.tga to %ProgramFiles(x86)%\steam\graphics\scrbottomright.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\nemoorange - the light of speed.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\nemoorange - the light of speed.avs.100d2c
from %ProgramFiles(x86)%\winamp\system\f263.w5s to %ProgramFiles(x86)%\winamp\system\f263.w5s.100d2c
from %ProgramFiles(x86)%\steam\graphics\scrends.tga to %ProgramFiles(x86)%\steam\graphics\scrends.tga.100d2c
from %ProgramFiles%\firefox\readme.txt to %ProgramFiles%\firefox\readme.txt.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\nemoorange vs el-vis - dreamtime2.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\nemoorange vs el-vis - dreamtime2.avs.100d2c
from %ProgramFiles(x86)%\winamp\system\f263.wbm to %ProgramFiles(x86)%\winamp\system\f263.wbm.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\intro_movie.webm to %ProgramFiles(x86)%\steam\tenfoot\resource\images\intro_movie.webm.100d2c
from %ProgramFiles(x86)%\steam\graphics\scrleft.tga to %ProgramFiles(x86)%\steam\graphics\scrleft.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\nemoorange - building blocks.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\nemoorange - building blocks.avs.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_voicechat_audiolevels.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_voicechat_audiolevels.tga.100d2c
from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\unconed - daedalus.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\unconed - daedalus.avs.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_voicechatactivity.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_voicechatactivity.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_hover_spanish.tga to %ProgramFiles(x86)%\steam\graphics\new_button_hover_spanish.tga.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\bg_gradient_mask.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\bg_gradient_mask.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\mini_shrink.tga to %ProgramFiles(x86)%\steam\graphics\mini_shrink.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\mini_shrink_mouseover.tga to %ProgramFiles(x86)%\steam\graphics\mini_shrink_mouseover.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\mnusepcenter.tga to %ProgramFiles(x86)%\steam\graphics\mnusepcenter.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\mnusepleft.tga to %ProgramFiles(x86)%\steam\graphics\mnusepleft.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_background.tga to %ProgramFiles(x86)%\steam\graphics\music_background.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_browse_default.tga to %ProgramFiles(x86)%\steam\graphics\music_browse_default.tga.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\browser\favorites_closetab.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\browser\favorites_closetab.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_browse_disabled.tga to %ProgramFiles(x86)%\steam\graphics\music_browse_disabled.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_browse_hover.tga to %ProgramFiles(x86)%\steam\graphics\music_browse_hover.tga.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\browser\reticle.webm to %ProgramFiles(x86)%\steam\tenfoot\resource\images\browser\reticle.webm.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\browser\reticle_80_80.webm to %ProgramFiles(x86)%\steam\tenfoot\resource\images\browser\reticle_80_80.webm.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_pause_default.tga to %ProgramFiles(x86)%\steam\graphics\music_pause_default.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-de-de.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-de-de.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_pause_disabled.tga to %ProgramFiles(x86)%\steam\graphics\music_pause_disabled.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_pause_hover.tga to %ProgramFiles(x86)%\steam\graphics\music_pause_hover.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_placeholder_album.tga to %ProgramFiles(x86)%\steam\graphics\music_placeholder_album.tga.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\collapse.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\collapse.tga.100d2c
from %ProgramFiles(x86)%\winamp\microsoft.vc90.crt\microsoft.vc90.crt.manifest to %ProgramFiles(x86)%\winamp\microsoft.vc90.crt\microsoft.vc90.crt.manifest.100d2c
from %ProgramFiles(x86)%\winamp\components\ssdp.w6c to %ProgramFiles(x86)%\winamp\components\ssdp.w6c.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_player_bg.tga to %ProgramFiles(x86)%\steam\graphics\music_player_bg.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_player_placeholder_album.tga to %ProgramFiles(x86)%\steam\graphics\music_player_placeholder_album.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_player_placeholder_album_400.tga to %ProgramFiles(x86)%\steam\graphics\music_player_placeholder_album_400.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_play_default.tga to %ProgramFiles(x86)%\steam\graphics\music_play_default.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_play_disabled.tga to %ProgramFiles(x86)%\steam\graphics\music_play_disabled.tga.100d2c
from %ProgramFiles(x86)%\winamp\pconfig.dcf to %ProgramFiles(x86)%\winamp\pconfig.dcf.100d2c
from %ProgramFiles(x86)%\steam\graphics\mini_expand_mouseover.tga to %ProgramFiles(x86)%\steam\graphics\mini_expand_mouseover.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_details_mask.tga to %ProgramFiles(x86)%\steam\graphics\music_details_mask.tga.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\betabutton4.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\betabutton4.tga.100d2c
from %ProgramFiles(x86)%\steam\steam.exe.old to %ProgramFiles(x86)%\steam\steam.exe.old.100d2c
from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.100d2c
from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\readme.txt.100d2c
from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.100d2c
from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.100d2c
from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.100d2c
from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.100d2c
from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.100d2c
from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.100d2c
from %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5 to %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5.100d2c
from %ProgramFiles(x86)%\steam\libx264-142.dll.md5 to %ProgramFiles(x86)%\steam\libx264-142.dll.md5.100d2c
from %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt to %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt.100d2c
from %ProgramFiles(x86)%\steam\libx264-142.dll.crypt to %ProgramFiles(x86)%\steam\libx264-142.dll.crypt.100d2c
from %ProgramFiles(x86)%\steam\graphics\minithrobber08.tga to %ProgramFiles(x86)%\steam\graphics\minithrobber08.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\minithrobberinactive.tga to %ProgramFiles(x86)%\steam\graphics\minithrobberinactive.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\minithrobber09.tga to %ProgramFiles(x86)%\steam\graphics\minithrobber09.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\minithrobber10.tga to %ProgramFiles(x86)%\steam\graphics\minithrobber10.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\minithrobber11.tga to %ProgramFiles(x86)%\steam\graphics\minithrobber11.tga.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\browser\webkit.css to %ProgramFiles(x86)%\steam\tenfoot\resource\browser\webkit.css.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\default_keybinds.cfg to %ProgramFiles(x86)%\steam\tenfoot\resource\default_keybinds.cfg.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\fonts\droidsansthai-regular.ttf to %ProgramFiles(x86)%\steam\tenfoot\resource\fonts\droidsansthai-regular.ttf.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\fonts\license_cjk.txt to %ProgramFiles(x86)%\steam\tenfoot\resource\fonts\license_cjk.txt.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\fonts\notosanscjkjp-regular.otf to %ProgramFiles(x86)%\steam\tenfoot\resource\fonts\notosanscjkjp-regular.otf.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\fonts\tenfoot.uifont to %ProgramFiles(x86)%\steam\tenfoot\resource\fonts\tenfoot.uifont.100d2c
from %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css to %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css.100d2c
from %ProgramFiles(x86)%\steam\graphics\minithrobber12.tga to %ProgramFiles(x86)%\steam\graphics\minithrobber12.tga.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\abutton.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\abutton.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\mini_expand.tga to %ProgramFiles(x86)%\steam\graphics\mini_expand.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_play_hover.tga to %ProgramFiles(x86)%\steam\graphics\music_play_hover.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_repeat1_default.tga to %ProgramFiles(x86)%\steam\graphics\music_repeat1_default.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-es-us.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-es-us.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_trackfwd_default.tga to %ProgramFiles(x86)%\steam\graphics\music_trackfwd_default.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-zh-cn.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-zh-cn.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_trackfwd_disabled.tga to %ProgramFiles(x86)%\steam\graphics\music_trackfwd_disabled.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_trackfwd_hover.tga to %ProgramFiles(x86)%\steam\graphics\music_trackfwd_hover.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-zh-tw.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-zh-tw.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_volume_default.tga to %ProgramFiles(x86)%\steam\graphics\music_volume_default.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_volume_disabled.tga to %ProgramFiles(x86)%\steam\graphics\music_volume_disabled.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_volume_hover.tga to %ProgramFiles(x86)%\steam\graphics\music_volume_hover.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_volume_mute_default.tga to %ProgramFiles(x86)%\steam\graphics\music_volume_mute_default.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_volume_mute_disabled.tga to %ProgramFiles(x86)%\steam\graphics\music_volume_mute_disabled.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_volume_mute_hover.tga to %ProgramFiles(x86)%\steam\graphics\music_volume_mute_hover.tga.100d2c
from %ProgramFiles(x86)%\winamp\paths.ini to %ProgramFiles(x86)%\winamp\paths.ini.100d2c
from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini.100d2c
from %ProgramFiles(x86)%\steam\graphics\nav2_highlight_selected.tga to %ProgramFiles(x86)%\steam\graphics\nav2_highlight_selected.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button.tga to %ProgramFiles(x86)%\steam\graphics\new_button.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_danish.tga to %ProgramFiles(x86)%\steam\graphics\new_button_danish.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_french.tga to %ProgramFiles(x86)%\steam\graphics\new_button_french.tga.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_indicator_voicehold.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_indicator_voicehold.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_german.tga to %ProgramFiles(x86)%\steam\graphics\new_button_german.tga.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_list_item_panel_labels_mask.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_list_item_panel_labels_mask.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_hover.tga to %ProgramFiles(x86)%\steam\graphics\new_button_hover.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_hover_danish.tga to %ProgramFiles(x86)%\steam\graphics\new_button_hover_danish.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_hover_french.tga to %ProgramFiles(x86)%\steam\graphics\new_button_hover_french.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_hover_german.tga to %ProgramFiles(x86)%\steam\graphics\new_button_hover_german.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_hover_italian.tga to %ProgramFiles(x86)%\steam\graphics\new_button_hover_italian.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\nav_highlight_selected.tga to %ProgramFiles(x86)%\steam\graphics\nav_highlight_selected.tga.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_chatactivity.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\friends\friends_chatactivity.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-tr-tr.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-tr-tr.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_trackback_hover.tga to %ProgramFiles(x86)%\steam\graphics\music_trackback_hover.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_trackback_disabled.tga to %ProgramFiles(x86)%\steam\graphics\music_trackback_disabled.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_repeat1_disabled.tga to %ProgramFiles(x86)%\steam\graphics\music_repeat1_disabled.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_repeat1_enabled.tga to %ProgramFiles(x86)%\steam\graphics\music_repeat1_enabled.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-hu-hu.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-hu-hu.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_repeat1_enabled_hover.tga to %ProgramFiles(x86)%\steam\graphics\music_repeat1_enabled_hover.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-id-id.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-id-id.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_repeat_default.tga to %ProgramFiles(x86)%\steam\graphics\music_repeat_default.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_repeat_disabled.tga to %ProgramFiles(x86)%\steam\graphics\music_repeat_disabled.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-it-it.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-it-it.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_repeat_enabled.tga to %ProgramFiles(x86)%\steam\graphics\music_repeat_enabled.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-ja-jp.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-ja-jp.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_repeat_enabled_hover.tga to %ProgramFiles(x86)%\steam\graphics\music_repeat_enabled_hover.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-ko-kr.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-ko-kr.wlz.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-fr-fr.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-fr-fr.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_repeat_hover.tga to %ProgramFiles(x86)%\steam\graphics\music_repeat_hover.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-nl-nl.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-nl-nl.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_shuffle_disabled.tga to %ProgramFiles(x86)%\steam\graphics\music_shuffle_disabled.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-pl-pl.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-pl-pl.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_shuffle_enabled.tga to %ProgramFiles(x86)%\steam\graphics\music_shuffle_enabled.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-pt-br.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-pt-br.wlz.100d2c
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\expand.tga to %ProgramFiles(x86)%\steam\tenfoot\resource\images\expand.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_shuffle_enabled_hover.tga to %ProgramFiles(x86)%\steam\graphics\music_shuffle_enabled_hover.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-ro-ro.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-ro-ro.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_shuffle_hover.tga to %ProgramFiles(x86)%\steam\graphics\music_shuffle_hover.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-ru-ru.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-ru-ru.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_trackback_default.tga to %ProgramFiles(x86)%\steam\graphics\music_trackback_default.tga.100d2c
from %ProgramFiles(x86)%\winamp\lang\winamp-sv-se.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-sv-se.wlz.100d2c
from %ProgramFiles(x86)%\steam\graphics\music_shuffle_default.tga to %ProgramFiles(x86)%\steam\graphics\music_shuffle_default.tga.100d2c
from %ProgramFiles(x86)%\steam\graphics\new_button_hover_swedish.tga to %ProgramFiles(x86)%\steam\graphics\new_button_hover_swedish.tga.100d2c
from %ProgramFiles(x86)%\winamp\system\ombrowser.w5s to %ProgramFiles(x86)%\winamp\system\ombrowser.w5s.100d2c

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tieongxp.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7EDC.tmp" "%TEMP%\CSC7ECC.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\dbti1izi.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES81AB.tmp" "%TEMP%\CSC81AA.tmp"' (with hidden window)

Executes the following

'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tieongxp.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7EDC.tmp" "%TEMP%\CSC7ECC.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\dbti1izi.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES81AB.tmp" "%TEMP%\CSC81AA.tmp"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial