Trojan.Encoder.33431

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\highly_cited_2001.xlsx
<Drive name for removable media>:\systisoft.pem
<Drive name for removable media>:\suspendedcompanies.xlsx
<Drive name for removable media>:\swc_2009-03-02.rdf
<Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf
<Drive name for removable media>:\disclosuredetails.xlsx
<Drive name for removable media>:\al.xlsx
<Drive name for removable media>:\video_1.mp4
<Drive name for removable media>:\video.mp4
<Drive name for removable media>:\phytoremediation.rtf
<Drive name for removable media>:\investmentbankca_ca8.pem
<Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv
<Drive name for removable media>:\fungalnameauthors.rtf
<Drive name for removable media>:\spanner.mov
<Drive name for removable media>:\etc6_m_1.mov
<Drive name for removable media>:\scan.mov
<Drive name for removable media>:\removedtitles_records.zip
<Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx
<Drive name for removable media>:\productos.xls
<Drive name for removable media>:\subjectclassification.xls
<Drive name for removable media>:\contractualdeadlines.xls
<Drive name for removable media>:\excel_example.xls
<Drive name for removable media>:\pandp.rtf
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4
<Drive name for removable media>:\proposaltemplates.ppt
<Drive name for removable media>:\price030215.xls
<Drive name for removable media>:\sim_gametheory_to_finance.ppt
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\metac.ppt
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\ksearch_esa_talk.ppt
<Drive name for removable media>:\taxus_baccata.rdf
<Drive name for removable media>:\pubnet_855.rtf
<Drive name for removable media>:\waterlandhealthkano.rtf
<Drive name for removable media>:\2013_smccc_competition_points_jul2013.xlsx
<Drive name for removable media>:\ppswamp.ppt
<Drive name for removable media>:\bc01.pdf
<Drive name for removable media>:\ff_ot_user_guide.pdf
<Drive name for removable media>:\digest.rdf
<Drive name for removable media>:\contenttypes.rdf
<Drive name for removable media>:\20140114.rdf
<Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.mp4
<Drive name for removable media>:\military_callsigns_0311.rtf
<Drive name for removable media>:\lom602.pdf
<Drive name for removable media>:\productos.zip
<Drive name for removable media>:\cert.pem
<Drive name for removable media>:\testwmv.wmv
<Drive name for removable media>:\ck.pem
<Drive name for removable media>:\server.pem
<Drive name for removable media>:\browse.htm
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\issi2013_template_for_posters.docx
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\file_p_00000000_1371597592.docx
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\cea6a2-readme.txt
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\tcm851ax32.exe
<Drive name for removable media>:\flower_trans_matte.wmv
<Drive name for removable media>:\tree_view.htm
<Drive name for removable media>:\calculatorworksheet.zip
<Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.pdf
<Drive name for removable media>:\firefly1.mov
<Drive name for removable media>:\dag2_panel1_320_ref.mov
<Drive name for removable media>:\4f0bf7ff71f28.jpeg
<Drive name for removable media>:\parnas_01.jpeg
<Drive name for removable media>:\api-hashmap.html
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\210252809.jpeg
<Drive name for removable media>:\chromesetup.exe
<Drive name for removable media>:\ck_ugo.pem
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
<Drive name for removable media>:\wrar520.exe
<Drive name for removable media>:\dotnetfx45_full_setup.exe
<Drive name for removable media>:\skypesetup.exe
<Drive name for removable media>:\iisstart.html
<Drive name for removable media>:\about.html
<Drive name for removable media>:\glidescope_review_rev_010.docx
<Drive name for removable media>:\ituneshelpunavailable.html
<Drive name for removable media>:\utorrent.exe
<Drive name for removable media>:\browse.html
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\adadsi.html
<Drive name for removable media>:\file1.ppt

Modifies file system

Creates the following files

%TEMP%\4mw0vvg2.0.cs
%ProgramFiles(x86)%\opera\cea6a2-readme.txt
%ProgramFiles(x86)%\qip 2012\cea6a2-readme.txt
%ProgramFiles(x86)%\k-lite codec pack\cea6a2-readme.txt
%ProgramFiles(x86)%\pidgin\cea6a2-readme.txt
%ProgramFiles(x86)%\msbuild\cea6a2-readme.txt
%ProgramFiles%\ashmaisv\cea6a2-readme.txt
%ProgramFiles%\ashskpck\cea6a2-readme.txt
%ProgramFiles(x86)%\winamp\cea6a2-readme.txt
%ProgramFiles(x86)%\steam\cea6a2-readme.txt
%ProgramFiles%\ashwebsv\cea6a2-readme.txt
%ProgramFiles(x86)%\steam\graphics\cea6a2-readme.txt
%ProgramFiles%\avgamsvr\cea6a2-readme.txt
%ProgramFiles%\ashavast\cea6a2-readme.txt
%ProgramFiles%\ashavsrv\cea6a2-readme.txt
%ProgramFiles%\avgfwsrv\cea6a2-readme.txt
%ProgramFiles%\autotrace\cea6a2-readme.txt
%ProgramFiles%\autostartexplorer\cea6a2-readme.txt
%ProgramFiles%\aswupdsv\cea6a2-readme.txt
%ProgramFiles%\autodown\cea6a2-readme.txt
%ProgramFiles%\ashupd\cea6a2-readme.txt
%ProgramFiles%\ashskpcc\cea6a2-readme.txt
%ProgramFiles%\ashserv\cea6a2-readme.txt
%ALLUSERSPROFILE%\microsoft\ilscache\cea6a2-readme.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\cea6a2-readme.txt
%ProgramFiles%\avcenter\cea6a2-readme.txt
%ProgramFiles%\avcmd\cea6a2-readme.txt
%ProgramFiles%\avgdiag\cea6a2-readme.txt
%ProgramFiles%\avgemc\cea6a2-readme.txt
%ProgramFiles%\avadmin\cea6a2-readme.txt
%ProgramFiles%\ashdisp\cea6a2-readme.txt
%ProgramFiles%\ashenhcd\cea6a2-readme.txt
%ProgramFiles%\ashdug\cea6a2-readme.txt
%TEMP%\4mw0vvg2.out
%TEMP%\csc78a8.tmp
%TEMP%\res78b9.tmp
%TEMP%\4mw0vvg2.dll
%TEMP%\2jy4ijef.0.cs
%TEMP%\2jy4ijef.cmdline
%TEMP%\2jy4ijef.out
%TEMP%\csc7ccd.tmp
%TEMP%\res7cdd.tmp
%TEMP%\2jy4ijef.dll
D:\cea6a2-readme.txt
C:\far2\cea6a2-readme.txt
%ALLUSERSPROFILE%\cea6a2-readme.txt
%TEMP%\4mw0vvg2.cmdline
C:\totalcmd\cea6a2-readme.txt
C:\far2\addons\cea6a2-readme.txt
%ProgramFiles%\aim6\cea6a2-readme.txt
%ProgramFiles%\airdefense\cea6a2-readme.txt
%ProgramFiles%\almon\cea6a2-readme.txt
%ProgramFiles%\aimpro\cea6a2-readme.txt
%ProgramFiles%\amsn\cea6a2-readme.txt
%ProgramFiles%\alsvc\cea6a2-readme.txt
%ProgramFiles%\ash\cea6a2-readme.txt
%ProgramFiles%\ageofconan\cea6a2-readme.txt
%ProgramFiles%\ahnsd\cea6a2-readme.txt
%ProgramFiles(x86)%\mirc\cea6a2-readme.txt
%ProgramFiles%\ashlogv\cea6a2-readme.txt
%ProgramFiles%\ashchest\cea6a2-readme.txt
C:\far2\encyclopedia\cea6a2-readme.txt
%ProgramFiles%\avciman\cea6a2-readme.txt
%ProgramFiles%\avgcc\cea6a2-readme.txt

Deletes the following files

%TEMP%\res78b9.tmp
%TEMP%\csc78a8.tmp
%TEMP%\4mw0vvg2.0.cs
%TEMP%\4mw0vvg2.dll
%TEMP%\4mw0vvg2.pdb
%TEMP%\4mw0vvg2.out
%TEMP%\4mw0vvg2.cmdline
%TEMP%\res7cdd.tmp
%TEMP%\csc7ccd.tmp
%TEMP%\2jy4ijef.cmdline
%TEMP%\2jy4ijef.out
%TEMP%\2jy4ijef.pdb
%TEMP%\2jy4ijef.dll
%TEMP%\2jy4ijef.0.cs

Moves the following files

from %ProgramFiles%\aim6\aim6.exe to %ProgramFiles%\aim6\9f3dddf2.cea6a2
from %ProgramFiles(x86)%\steam\graphics\friendslistslantbg.tga to %ProgramFiles(x86)%\steam\graphics\daae5f49fbe3c524064847.cea6a2
from %ProgramFiles(x86)%\steam\graphics\flag_top_hover.tga to %ProgramFiles(x86)%\steam\graphics\78ee2e44844ecc687d.cea6a2
from %ProgramFiles(x86)%\steam\graphics\flag_top.tga to %ProgramFiles(x86)%\steam\graphics\06203bae9f8f.cea6a2
from %ProgramFiles(x86)%\steam\graphics\flag_right_hover.tga to %ProgramFiles(x86)%\steam\graphics\8b70ce512bbf27e4441e.cea6a2
from %ProgramFiles(x86)%\steam\graphics\flag_right.tga to %ProgramFiles(x86)%\steam\graphics\4b8a7f29a145ed.cea6a2
from %ProgramFiles(x86)%\steam\graphics\flag_left_hover.tga to %ProgramFiles(x86)%\steam\graphics\2fa9f9a6797b03e59c1.cea6a2
from %ProgramFiles(x86)%\steam\graphics\flag_left.tga to %ProgramFiles(x86)%\steam\graphics\2d43ce1a290d0.cea6a2
from %ProgramFiles(x86)%\steam\graphics\flag_inactive_top_hover.tga to %ProgramFiles(x86)%\steam\graphics\d6279b1785e709b9e87128991a9.cea6a2
from %ProgramFiles%\avgemc\avgemc.exe to %ProgramFiles%\avgemc\029a9987b8.cea6a2
from %ProgramFiles%\avgfwsrv\avgfwsrv.exe to %ProgramFiles%\avgfwsrv\3fa8c21824db.cea6a2
from %ProgramFiles%\avgamsvr\avgamsvr.exe to %ProgramFiles%\avgamsvr\485e11a27929.cea6a2
from %ProgramFiles(x86)%\steam\graphics\flag_inactive_top.tga to %ProgramFiles(x86)%\steam\graphics\bfaf5d05b16fd14974d46.cea6a2
from %ProgramFiles(x86)%\steam\graphics\cloud_uhoh.tga to %ProgramFiles(x86)%\steam\graphics\84960634761a3e.cea6a2
from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\c3c9eeeea945.cea6a2
from %ProgramFiles(x86)%\steam\streaming_client.exe to %ProgramFiles(x86)%\steam\8996dc9e7fa5a5fe3724.cea6a2
from %ProgramFiles(x86)%\steam\steamerrorreporter.exe to %ProgramFiles(x86)%\steam\a6dd53a674374e28ed6e35.cea6a2
from %ProgramFiles%\ashwebsv\ashwebsv.exe to %ProgramFiles%\ashwebsv\b2425c2a0420.cea6a2
from %ProgramFiles(x86)%\steam\thirdpartylegalnotices.html to %ProgramFiles(x86)%\steam\cd2e95e6a231195efab7b3ace9e.cea6a2
from %ProgramFiles(x86)%\steam\steam.exe to %ProgramFiles(x86)%\steam\0052ab034.cea6a2
from %ProgramFiles(x86)%\steam\writeminidump.exe to %ProgramFiles(x86)%\steam\d1271e8c57a9f1fb8.cea6a2
from %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css to %ProgramFiles(x86)%\steam\94f7c4b74bfda8b4f55d6428c8.cea6a2
from %ProgramFiles(x86)%\steam\graphics\friendslist_header2.tga to %ProgramFiles(x86)%\steam\graphics\3da9c4a1f832b4960389be3.cea6a2
from %ProgramFiles(x86)%\steam\graphics\friendspanelleftbg.tga to %ProgramFiles(x86)%\steam\graphics\50716f92d0b211cb33e9b4.cea6a2
from %ProgramFiles(x86)%\steam\graphics\friendspanelleftbg_down.tga to %ProgramFiles(x86)%\steam\graphics\da07c55ec8db6599e4e58c2044a.cea6a2
from %ProgramFiles(x86)%\steam\graphics\friendspanelleftbg_over.tga to %ProgramFiles(x86)%\steam\graphics\44ea24327c426ac4670569f2e7c.cea6a2
from %ProgramFiles%\avgdiag\avgdiag.exe to %ProgramFiles%\avgdiag\f0cbf734975.cea6a2
from %ProgramFiles%\avcmd\avcmd.exe to %ProgramFiles%\avcmd\411138999.cea6a2
from %ProgramFiles%\avcenter\avcenter.exe to %ProgramFiles%\avcenter\e13eb856f483.cea6a2
from %ProgramFiles%\avciman\avciman.exe to %ProgramFiles%\avciman\089e8f622b6.cea6a2
from %ProgramFiles(x86)%\steam\graphics\icon_button_forward.tga to %ProgramFiles(x86)%\steam\graphics\5322a1919e58cc405cb5cd8.cea6a2
from %ProgramFiles(x86)%\steam\graphics\icon_button_detail_down.tga to %ProgramFiles(x86)%\steam\graphics\67c5ef3a15d9a4791ad311a7602.cea6a2
from %ProgramFiles(x86)%\steam\graphics\html_lock.tga to %ProgramFiles(x86)%\steam\graphics\4d261cda9f697.cea6a2
from %ProgramFiles%\ashserv\ashserv.exe to %ProgramFiles%\ashserv\016b3e1be72.cea6a2
from %ProgramFiles%\ashskpcc\ashskpcc.exe to %ProgramFiles%\ashskpcc\f413794cbba4.cea6a2
from %ProgramFiles%\ashupd\ashupd.exe to %ProgramFiles%\ashupd\6c03bbbb00.cea6a2
from %ProgramFiles%\aswupdsv\aswupdsv.exe to %ProgramFiles%\aswupdsv\95dcfecea774.cea6a2
from %ProgramFiles%\autodown\autodown.exe to %ProgramFiles%\autodown\47c12f96af45.cea6a2
from %ProgramFiles%\autostartexplorer\autostartexplorer.exe to %ProgramFiles%\autostartexplorer\81a546591bdb7c35c1558.cea6a2
from %ProgramFiles%\autotrace\autotrace.exe to %ProgramFiles%\autotrace\5314aef31a516.cea6a2
from %ProgramFiles%\avadmin\avadmin.exe to %ProgramFiles%\avadmin\003a26a267f.cea6a2
from %ProgramFiles(x86)%\steam\graphics\grid_top_focus2.tga to %ProgramFiles(x86)%\steam\graphics\15cc42342bc4e455a57.cea6a2
from %ProgramFiles(x86)%\steam\graphics\grid_btm_focus2.tga to %ProgramFiles(x86)%\steam\graphics\73de865764f7e7c9a38.cea6a2
from %ProgramFiles(x86)%\steam\graphics\gridview_mask.tga to %ProgramFiles(x86)%\steam\graphics\85def9801b697d5f0.cea6a2
from %ProgramFiles(x86)%\steam\graphics\gift_wizard_heart.tga to %ProgramFiles(x86)%\steam\graphics\c683e3964c0eb4a5aba25.cea6a2
from %ProgramFiles(x86)%\steam\graphics\gift_wizard_friends.tga to %ProgramFiles(x86)%\steam\graphics\3e3690a0d4246f5e84be8cd.cea6a2
from %ProgramFiles(x86)%\steam\graphics\friends_icon.tga to %ProgramFiles(x86)%\steam\graphics\c1a3f33d9c22948e.cea6a2
from %ProgramFiles(x86)%\steam\graphics\friendspanelrightbg.tga to %ProgramFiles(x86)%\steam\graphics\bdac7bf8f9a38b5e8791c9f.cea6a2
from %ProgramFiles%\avgcc\avgcc.exe to %ProgramFiles%\avgcc\c94b2be59.cea6a2
from %ProgramFiles(x86)%\steam\steam.exe.old to %ProgramFiles(x86)%\steam\3b4a50893fd52.cea6a2
from %ProgramFiles%\ashskpck\ashskpck.exe to %ProgramFiles%\ashskpck\abc73f94b95d.cea6a2
from %ProgramFiles%\ashmaisv\ashmaisv.exe to %ProgramFiles%\ashmaisv\dd814dc7aa14.cea6a2
from %ProgramFiles(x86)%\mirc\uninstall.exe to %ProgramFiles(x86)%\mirc\b653d95fceff6.cea6a2
from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\9bb2f109fc05.cea6a2
from %ProgramFiles(x86)%\mirc\mirc.exe to %ProgramFiles(x86)%\mirc\9552e831.cea6a2
from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\b7f6cc668b.cea6a2
from %ProgramFiles%\ashavsrv\ashavsrv.exe to %ProgramFiles%\ashavsrv\3c6a2cee421c.cea6a2
from %ProgramFiles%\ashavast\ashavast.exe to %ProgramFiles%\ashavast\5c18d51804be.cea6a2
from %ProgramFiles%\ashdisp\ashdisp.exe to %ProgramFiles%\ashdisp\892e268a2e6.cea6a2
from %ProgramFiles%\ashenhcd\ashenhcd.exe to %ProgramFiles%\ashenhcd\e3fedf264bc0.cea6a2
from %ProgramFiles%\ashdug\ashdug.exe to %ProgramFiles%\ashdug\84cbd922de.cea6a2
from %ProgramFiles%\ashchest\ashchest.exe to %ProgramFiles%\ashchest\6bd373d2661c.cea6a2
from %ProgramFiles%\ashlogv\ashlogv.exe to %ProgramFiles%\ashlogv\9bcd1728dad.cea6a2
from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\0f9addff.cea6a2
from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\0a5b708a8717.cea6a2
from %ProgramFiles%\ahnsd\ahnsd.exe to %ProgramFiles%\ahnsd\2088250b5.cea6a2
from %ProgramFiles%\ageofconan\ageofconan.exe to %ProgramFiles%\ageofconan\16d54e57b931f0.cea6a2
from %ProgramFiles%\ash\ash.exe to %ProgramFiles%\ash\0cce716.cea6a2
from %ProgramFiles%\alsvc\alsvc.exe to %ProgramFiles%\alsvc\d3a4716dd.cea6a2
from %ProgramFiles%\amsn\amsn.exe to %ProgramFiles%\amsn\e08b04ad.cea6a2
from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\a2815c2b25.cea6a2
from %ProgramFiles%\almon\almon.exe to %ProgramFiles%\almon\8a367781c.cea6a2
from %ProgramFiles%\airdefense\airdefense.exe to %ProgramFiles%\airdefense\ec224f94cb692a.cea6a2
from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\97b0374c3e6b915ff765859.cea6a2
from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\97bcaa3bd911383f7eed.cea6a2
from %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml to %ProgramFiles(x86)%\opera\925919ab41da2a0b3ab18ea11fa01306d0e.cea6a2
from %ProgramFiles(x86)%\opera\launcher.exe to %ProgramFiles(x86)%\opera\56c894b3fe9a.cea6a2
from %ProgramFiles(x86)%\steam\uninstall.exe to %ProgramFiles(x86)%\steam\133dd5e6477cf.cea6a2
from %ProgramFiles(x86)%\steam\gameoverlayui.exe to %ProgramFiles(x86)%\steam\7e599954b86a67bc9.cea6a2
from %ProgramFiles(x86)%\steam\libx264-142.dll.crypt to %ProgramFiles(x86)%\steam\49b0734908a0013b45195.cea6a2
from %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt to %ProgramFiles(x86)%\steam\d2fc5332c821d86a1a22ea1.cea6a2
from %ProgramFiles(x86)%\winamp\uninstwa.exe to %ProgramFiles(x86)%\winamp\6a58bc4ef192.cea6a2
from %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5 to %ProgramFiles(x86)%\steam\895dde89f64e53a9ccb0e.cea6a2
from %ProgramFiles(x86)%\steam\libx264-142.dll.md5 to %ProgramFiles(x86)%\steam\1e0280ee53bcedc50c6.cea6a2
from %ProgramFiles(x86)%\winamp\elevator.exe to %ProgramFiles(x86)%\winamp\ac1ce7fa2cde.cea6a2
from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\4875b07b78f.cea6a2
from %ProgramFiles(x86)%\winamp\paths.ini to %ProgramFiles(x86)%\winamp\cb0352c4c.cea6a2
from %ProgramFiles(x86)%\pidgin\pidgin-uninst.exe to %ProgramFiles(x86)%\pidgin\599ef7afc860ab9be.cea6a2
from %ProgramFiles(x86)%\winamp\pconfig.dcf to %ProgramFiles(x86)%\winamp\2ef07b32594.cea6a2
from %ProgramFiles(x86)%\pidgin\pidgin.exe to %ProgramFiles(x86)%\pidgin\d1806278fe.cea6a2
from %ProgramFiles(x86)%\qip 2012\unins000.exe to %ProgramFiles(x86)%\qip 2012\52a3d1f15d44.cea6a2
from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\db218c78bcb5.cea6a2
from %ProgramFiles(x86)%\k-lite codec pack\unins000.exe to %ProgramFiles(x86)%\k-lite codec pack\f9f3829bd442.cea6a2
from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\7d6968670ef2.cea6a2
from %ProgramFiles(x86)%\qip 2012\qip.exe to %ProgramFiles(x86)%\qip 2012\d316afe.cea6a2
from %ProgramFiles(x86)%\qip 2012\unins000.dat to %ProgramFiles(x86)%\qip 2012\ca192a215ccd.cea6a2
from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\529ae8c266f0f9a14cfb463fa695a521e.cea6a2
from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\b2592b653757bdefc7a1.cea6a2
from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\bec9b9ead3423.cea6a2
from %ProgramFiles(x86)%\steam\steamerrorreporter64.exe to %ProgramFiles(x86)%\steam\044a485d3eb3e7d47a505588.cea6a2
from %ProgramFiles(x86)%\steam\graphics\icon_button_forward_over.tga to %ProgramFiles(x86)%\steam\graphics\41c428846ca9a227d0842cc43c53.cea6a2

Modifies the following files

D:\install.log
C:\far2\fareng.lng
C:\far2\farcze.lng
C:\far2\fareng.hlf
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\waterresourcesag.pptx
C:\far2\far.map
C:\far2\changelog_eng
C:\far2\changelog
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\dial.bmp
C:\far2\farhun.hlf
C:\far2\farhun.lng

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\4mw0vvg2.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES78B9.tmp" "%TEMP%\CSC78A8.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2jy4ijef.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7CDD.tmp" "%TEMP%\CSC7CCD.tmp"' (with hidden window)

Executes the following

'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\4mw0vvg2.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES78B9.tmp" "%TEMP%\CSC78A8.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2jy4ijef.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7CDD.tmp" "%TEMP%\CSC7CCD.tmp"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial