Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\nemty_nibc1pl-decrypt.txt
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\archer.avi
Modifies file system
Creates the following files
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0433e70ca73f50d19c8146e911b405ad_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- C:\far2\plugins\autowrap\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\brackets\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\compare\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\drawline\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\editcase\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\emenu\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\farcmds\nemty_nibc1pl-decrypt.txt
- C:\far2\addons\setup\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\filecase\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\ftp\lib\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\hlfviewer\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\macroview\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\network\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\proclist\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\tmppanel\nemty_nibc1pl-decrypt.txt
- C:\far2\pluginsdk\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\align\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\arclite\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\nemty_nibc1pl-decrypt.txt
- C:\far2\fexcept\nemty_nibc1pl-decrypt.txt
- C:\far2\encyclopedia\tap\nemty_nibc1pl-decrypt.txt
- C:\nemty_nibc1pl-decrypt.txt
- C:\documents and settings\nemty_nibc1pl-decrypt.txt
- C:\far2\nemty_nibc1pl-decrypt.txt
- C:\far2\addons\nemty_nibc1pl-decrypt.txt
- C:\far2\addons\colors\nemty_nibc1pl-decrypt.txt
- C:\far2\addons\colors\custom_highlighting\nemty_nibc1pl-decrypt.txt
- C:\far2\addons\colors\default_highlighting\nemty_nibc1pl-decrypt.txt
- C:\far2\pluginsdk\headers.c\nemty_nibc1pl-decrypt.txt
- C:\far2\plugins\ftp\nemty_nibc1pl-decrypt.txt
- C:\far2\addons\macros\nemty_nibc1pl-decrypt.txt
- C:\far2\addons\xlat\nemty_nibc1pl-decrypt.txt
- C:\far2\addons\xlat\russian\nemty_nibc1pl-decrypt.txt
- C:\far2\documentation\nemty_nibc1pl-decrypt.txt
- C:\far2\documentation\eng\nemty_nibc1pl-decrypt.txt
- C:\far2\documentation\rus\nemty_nibc1pl-decrypt.txt
- D:\nemty_nibc1pl-decrypt.txt
- C:\far2\encyclopedia\nemty_nibc1pl-decrypt.txt
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b08e707ffa00f4471d53889cd151c905_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- C:\far2\addons\shell\nemty_nibc1pl-decrypt.txt
- C:\far2\pluginsdk\headers.pas\nemty_nibc1pl-decrypt.txt
Network activity
TCP
- 'my####rnalip.com':443
UDP
- DNS ASK my####rnalip.com
