Trojan.Encoder.41245

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\microossfttss.url.lnk

Creates the following files on removable media

<Drive name for removable media>:\rairfxelr\makpcapqg.exe
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\february_catalogue__2015.doc.exe
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\cveuropeo.doc.exe
<Drive name for removable media>:\fi51.doc.exe
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\ovp25012015.doc.exe
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\adhd_and_obesity.docx
<Drive name for removable media>:\weeklysheet1215.doc.exe
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\testcertificate.cer.exe
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\sdksampleprivdeveloper.cer.exe
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\delete.avi.exe
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\000814251_video_01.avi.exe
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\sdszfo.docx
<Drive name for removable media>:\lisp_success.doc.exe
<Drive name for removable media>:\dashborder_96.bmp.exe
<Drive name for removable media>:\dialmap.bmp.exe
<Drive name for removable media>:\dashborder_144.bmp.exe
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer.exe
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\pmd.cer.exe
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx

Modifies file system

Creates the following files

%APPDATA%\microossfttss.exe
%TEMP%\autcd10.tmp
%TEMP%\autcd51.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxcd54.tmp
%TEMP%\autcd52.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autccff.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autccff.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcxcdc0.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxce1e.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxcc59.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autccff.tmp.tok
%ALLUSERSPROFILE%\cjdyzmqbe\nwfieldnotes1966.docx.ico
%TEMP%\autcfa1.tmp
%TEMP%\autcfa2.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autcf7e.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autcf7e.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcxcfe2.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd031.tmp
%ALLUSERSPROFILE%\cjdyzmqbe\adhd_and_obesity.docx.ico
%LOCALAPPDATA%\autoit v3\aut2exe\autd152.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\autcf7e.tmp.tok
%TEMP%\autcf90.tmp
%ALLUSERSPROFILE%\cjdyzmqbe\weeklysheet1215.doc.ico
%LOCALAPPDATA%\autoit v3\aut2exe\autcb98.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autcb98.tmp.a3x
%TEMP%\autc968.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autc976.tmp.tok
%TEMP%\autc997.tmp
%TEMP%\autc9b8.tmp
%TEMP%\autc9b9.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autc976.tmp.a3x
%TEMP%\autc97a.tmp
%TEMP%\autc97b.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autc957.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autc957.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\autc957.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcxca08.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxca67.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxcae3.tmp
%ALLUSERSPROFILE%\cjdyzmqbe\ovp25012015.doc.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcxcb22.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autcb98.tmp.tok
%TEMP%\autcba9.tmp
%TEMP%\autcbbb.tmp
%TEMP%\autcbbc.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autc976.tmp.exe
%TEMP%\autd164.tmp
%TEMP%\autd176.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd973.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd152.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autd690.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autd690.tmp.exe
%ALLUSERSPROFILE%\cjdyzmqbe\hadac_newsletter_july_2010_final.docx.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd780.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd77a.tmp.tok
%TEMP%\autd78b.tmp
%TEMP%\autd78d.tmp
%TEMP%\autd79e.tmp
%TEMP%\autd6b3.tmp
%TEMP%\autd6b4.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd77a.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd82b.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd8f7.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd92f.tmp.tok
%TEMP%\autd931.tmp
%TEMP%\autd942.tmp
%TEMP%\autd943.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd92f.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autd92f.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autd77a.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd7cf.tmp
%TEMP%\autd6a1.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd690.tmp.tok
%ALLUSERSPROFILE%\cjdyzmqbe\sdszfo.docx.ico
%ALLUSERSPROFILE%\cjdyzmqbe\holycrosschurchinstructions.docx.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd252.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd2d0.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd355.tmp.tok
%TEMP%\autd395.tmp
%TEMP%\autd3b7.tmp
%ALLUSERSPROFILE%\cjdyzmqbe\thlps_keeper_mayer_1965.docx.ico
%TEMP%\autd3b8.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd355.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autd152.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autd355.tmp.exe
%TEMP%\autd441.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd445.tmp
%TEMP%\autd453.tmp
%TEMP%\autd454.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd420.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autd420.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd494.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd4e1.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd520.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd420.tmp.tok
%ALLUSERSPROFILE%\cjdyzmqbe\lisp_success.doc.ico
%TEMP%\autd175.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxc845.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autbcaa.tmp.a3x
%TEMP%\autb993.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autb97e.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autb97e.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcxb9b4.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxb9d2.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxba31.tmp
%ALLUSERSPROFILE%\cjdyzmqbe\dashborder_144.bmp.ico
%LOCALAPPDATA%\autoit v3\aut2exe\autbb81.tmp.tok
%TEMP%\autb980.tmp
%TEMP%\autb992.tmp
%TEMP%\autbb83.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autbb81.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autbb81.tmp.exe
%ALLUSERSPROFILE%\cjdyzmqbe\pmd.cer.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcxbc23.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxbc91.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autbcaa.tmp.tok
%TEMP%\autbcac.tmp
%TEMP%\autbccd.tmp
%TEMP%\autbb95.tmp
%TEMP%\autbb96.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autb97e.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\rcxb917.tmp
%ALLUSERSPROFILE%\cjdyzmqbe\dialmap.bmp.ico
%ALLUSERSPROFILE%\cjdyzmqbe\delete.avi.ico
%TEMP%\autb441.tmp
%APPDATA%\zinmkzhld\zwqbgqczt.exe
%APPDATA%\zinmkzhld\exoejnqte.au3
%ALLUSERSPROFILE%\cjdyzmqbe\000814251_video_01.avi.ico
%LOCALAPPDATA%\autoit v3\aut2exe\autb6e0.tmp.tok
%TEMP%\autb6f1.tmp
%TEMP%\autb703.tmp
%TEMP%\autb704.tmp
%ALLUSERSPROFILE%\cjdyzmqbe\ejlpnwwfo.ico
%LOCALAPPDATA%\autoit v3\aut2exe\autb6e0.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\rcxb743.tmp
%ALLUSERSPROFILE%\cjdyzmqbe\dashborder_96.bmp.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcxb792.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autb885.tmp.tok
%TEMP%\autb896.tmp
%TEMP%\autb8a8.tmp
%TEMP%\autb8a9.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autb885.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autb885.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autb6e0.tmp.exe
%TEMP%\autbcce.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autbcaa.tmp.exe
%ALLUSERSPROFILE%\cjdyzmqbe\cveuropeo.doc.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcxbcee.tmp
%ALLUSERSPROFILE%\cjdyzmqbe\contosoroot_1.cer.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcxc306.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxc384.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autc38d.tmp.tok
%TEMP%\autc38f.tmp
%TEMP%\autc3a0.tmp
%TEMP%\autc3b1.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autc38d.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autc254.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autc254.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autc38d.tmp.exe
%ALLUSERSPROFILE%\cjdyzmqbe\february_catalogue__2015.doc.ico
%ALLUSERSPROFILE%\cjdyzmqbe\fi51.doc.ico
%LOCALAPPDATA%\autoit v3\aut2exe\autc6e7.tmp.tok
%TEMP%\autc6e9.tmp
%TEMP%\autc6fa.tmp
%TEMP%\autc6fb.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autc6e7.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autc6e7.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcxc40f.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxc4bc.tmp
%TEMP%\autc259.tmp
%TEMP%\autc258.tmp
%TEMP%\autc256.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxbd9b.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autbfd5.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\autbfd6.tmp.tok
%TEMP%\autbfe6.tmp
%ALLUSERSPROFILE%\cjdyzmqbe\sdksampleprivdeveloper.cer.ico
%TEMP%\autbff8.tmp
%TEMP%\autbff9.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autbfd5.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autbfd5.tmp.exe
%ALLUSERSPROFILE%\cjdyzmqbe\sdksampleunprivdeveloper.cer.ico
%TEMP%\autbff6.tmp
%TEMP%\autc009.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autbfd6.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autbfd6.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcxc038.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxc096.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxc097.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxc114.tmp
%ALLUSERSPROFILE%\cjdyzmqbe\testcertificate.cer.ico
%LOCALAPPDATA%\autoit v3\aut2exe\autc254.tmp.tok
%TEMP%\autc008.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxc7e6.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcxd9b2.tmp

Sets the 'hidden' attribute to the following files

<Drive name for removable media>:\rairfxelr\makpcapqg.exe

Deletes the following files

%TEMP%\autb441.tmp
%TEMP%\autd176.tmp
%TEMP%\autd175.tmp
%TEMP%\autd164.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autcf7e.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autcf7e.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autcf7e.tmp.tok
%TEMP%\autcfa2.tmp
%TEMP%\autcfa1.tmp
%TEMP%\autcf90.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autccff.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autccff.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autccff.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\autcb98.tmp.exe
%TEMP%\autc9b9.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autcb98.tmp.a3x
%TEMP%\autcd52.tmp
%TEMP%\autcd51.tmp
%TEMP%\autcd10.tmp
%TEMP%\autcbbc.tmp
%TEMP%\autcbbb.tmp
%TEMP%\autcba9.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autc957.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autc957.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autc957.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\autc976.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autc976.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autc976.tmp.tok
%TEMP%\autc97b.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autcb98.tmp.tok
%TEMP%\autc97a.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd152.tmp.tok
%TEMP%\autd6b3.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd77a.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\autd92f.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autd92f.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autd92f.tmp.tok
%TEMP%\autd943.tmp
%TEMP%\autd942.tmp
%TEMP%\autd931.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd690.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autd690.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autd690.tmp.tok
%TEMP%\autd79e.tmp
%TEMP%\autd78d.tmp
%TEMP%\autd78b.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd152.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autd152.tmp.a3x
%TEMP%\autd6a1.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd420.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autd420.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autd420.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\autd355.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autd355.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autd355.tmp.tok
%TEMP%\autd454.tmp
%TEMP%\autd453.tmp
%TEMP%\autd441.tmp
%TEMP%\autd3b8.tmp
%TEMP%\autd3b7.tmp
%TEMP%\autd395.tmp
%TEMP%\autd6b4.tmp
%TEMP%\autc9b8.tmp
%TEMP%\autc997.tmp
%TEMP%\autc968.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autbb81.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autbb81.tmp.tok
%TEMP%\autbcce.tmp
%TEMP%\autbccd.tmp
%TEMP%\autbcac.tmp
%TEMP%\autbb96.tmp
%TEMP%\autbb95.tmp
%TEMP%\autbb83.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autb97e.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autb97e.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autb97e.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\autb885.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autbcaa.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\autb885.tmp.a3x
%TEMP%\autb993.tmp
%TEMP%\autb992.tmp
%TEMP%\autb980.tmp
%TEMP%\autb8a9.tmp
%TEMP%\autb8a8.tmp
%TEMP%\autb896.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autb6e0.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autb6e0.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autb6e0.tmp.tok
%TEMP%\autb704.tmp
%TEMP%\autb703.tmp
%TEMP%\autb6f1.tmp
%APPDATA%\zinmkzhld\exoejnqte.au3
%LOCALAPPDATA%\autoit v3\aut2exe\autb885.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\autbcaa.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autbb81.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autbcaa.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autc6e7.tmp.exe
%TEMP%\autc38f.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autc6e7.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autc6e7.tmp.tok
%TEMP%\autc6fb.tmp
%TEMP%\autc6fa.tmp
%TEMP%\autc6e9.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autc38d.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autc38d.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autc38d.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\autc254.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autc254.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autc254.tmp.tok
%TEMP%\autc3b1.tmp
%TEMP%\autc3a0.tmp
%TEMP%\autc259.tmp
%TEMP%\autbfe6.tmp
%TEMP%\autc258.tmp
%TEMP%\autc256.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autbfd6.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autbfd6.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autbfd6.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\autbfd5.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\autbfd5.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autbfd5.tmp.tok
%TEMP%\autc009.tmp
%TEMP%\autc008.tmp
%TEMP%\autbff6.tmp
%TEMP%\autbff9.tmp
%TEMP%\autbff8.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\autd77a.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\autd77a.tmp.exe

Moves the following files

from %LOCALAPPDATA%\autoit v3\aut2exe\rcxb743.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autb6e0.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxcc59.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autcb98.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxcdc0.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autccff.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxcd54.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autcb98.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxce1e.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autccff.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxcfe2.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autcf7e.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd031.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autcf7e.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd252.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autd152.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxc038.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autbfd5.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd2d0.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autd152.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd4e1.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autd420.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd494.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autd355.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd520.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autd420.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd780.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autd690.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd7cf.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autd690.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd82b.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autd77a.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd8f7.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autd77a.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxcae3.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autc957.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxcb22.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autc957.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxca67.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autc976.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxca08.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autc976.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxc845.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autc6e7.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxb917.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autb885.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxb9d2.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autb97e.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxb9b4.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autb885.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxba31.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autb97e.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxbc23.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autbb81.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxbc91.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autbb81.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxbcee.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autbcaa.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd973.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autd92f.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd445.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autd355.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxbd9b.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autbcaa.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxc097.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autbfd5.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxc114.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autbfd6.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxc306.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autc254.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxc384.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autc254.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxc40f.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autc38d.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxc4bc.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autc38d.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxc7e6.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autc6e7.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxb792.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autb6e0.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxc096.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autbfd6.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcxd9b2.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\autd92f.tmp.exe

Substitutes the following files

%APPDATA%\zinmkzhld\exoejnqte.au3

Changes user data files extensions (Trojan.Encoder).

Network activity

UDP

DNS ASK wi#####osoft.sytes.net

Miscellaneous

Creates and executes the following

'%APPDATA%\microossfttss.exe' <Full path to file>
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\thlps_keeper_mayer_1965.docx.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\thlps_keeper_mayer_1965.docx.ico" /x86 /comp...
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\holycrosschurchinstructions.docx.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\holycrosschurchinstructions.docx.ico" /x...
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\adhd_and_obesity.docx.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\adhd_and_obesity.docx.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\nwfieldnotes1966.docx.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\nwfieldnotes1966.docx.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\weeklysheet1215.doc.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\weeklysheet1215.doc.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\ovp25012015.doc.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\ovp25012015.doc.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\lisp_success.doc.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\lisp_success.doc.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\cveuropeo.doc.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\cveuropeo.doc.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\fi51.doc.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\fi51.doc.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\sdszfo.docx.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\sdszfo.docx.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\february_catalogue__2015.doc.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\february_catalogue__2015.doc.ico" /x86 /comp...
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\TestCertificate.cer.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\TestCertificate.cer.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\SDKSamplePrivDeveloper.cer.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\SDKSamplePrivDeveloper.cer.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\SDKSampleUnprivDeveloper.cer.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\SDKSampleUnprivDeveloper.cer.ico" /x86 /comp...
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\pmd.cer.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\pmd.cer.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\dashBorder_144.bmp.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\dashBorder_144.bmp.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\dialmap.bmp.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\dialmap.bmp.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\dashBorder_96.bmp.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\dashBorder_96.bmp.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\000814251_video_01.avi.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\000814251_video_01.avi.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\delete.avi.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\delete.avi.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\contosoroot_1.cer.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\contosoroot_1.cer.ico" /x86 /comp [4]
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\hadac_newsletter_july_2010_final.do...

Executes the following

'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\delete.avi.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\delete.avi.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\thlps_keeper_mayer_1965.docx.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\thlps_keeper_mayer_1965.docx.ico" /x86 /comp...' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\holycrosschurchinstructions.docx.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\holycrosschurchinstructions.docx.ico" /x...' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\adhd_and_obesity.docx.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\adhd_and_obesity.docx.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\nwfieldnotes1966.docx.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\nwfieldnotes1966.docx.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\weeklysheet1215.doc.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\weeklysheet1215.doc.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\ovp25012015.doc.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\ovp25012015.doc.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\lisp_success.doc.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\lisp_success.doc.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\cveuropeo.doc.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\cveuropeo.doc.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\fi51.doc.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\fi51.doc.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\february_catalogue__2015.doc.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\february_catalogue__2015.doc.ico" /x86 /comp...' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\contosoroot_1.cer.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\contosoroot_1.cer.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\TestCertificate.cer.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\TestCertificate.cer.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\SDKSamplePrivDeveloper.cer.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\SDKSamplePrivDeveloper.cer.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\SDKSampleUnprivDeveloper.cer.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\SDKSampleUnprivDeveloper.cer.ico" /x86 /comp...' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\pmd.cer.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\pmd.cer.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\dashBorder_144.bmp.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\dashBorder_144.bmp.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\dialmap.bmp.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\dialmap.bmp.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\dashBorder_96.bmp.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\dashBorder_96.bmp.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\000814251_video_01.avi.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\000814251_video_01.avi.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\sdszfo.docx.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\sdszfo.docx.ico" /x86 /comp [4]' (with hidden window)
'%APPDATA%\zinmkzhld\zwqbgqczt.exe' /in "%APPDATA%\ziNmkZhlD\exOejnQTe.au3" /out "<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx.exe" /icon "%ALLUSERSPROFILE%\CjDYZMqBe\hadac_newsletter_july_2010_final.do...' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial