Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\sysupdate.setup0f4d5bf70333.lnk
Modifies file system
Creates the following files
- C:\users\public\libraries\auid.log
Miscellaneous
Searches for the following windows
- ClassName: 'TgoldwildsaA' WindowName: ''
- ClassName: 'TsanthresithandsionA' WindowName: ''
- ClassName: 'TrasfeshmalibahugoA' WindowName: ''
- ClassName: 'TmebramobadpolasA' WindowName: ''
- ClassName: 'TgrargganorgashsehA' WindowName: ''
- ClassName: 'TfiosheimomasobubmA' WindowName: ''
- ClassName: 'TrethdainexganorjaA' WindowName: ''
- ClassName: 'TlithganorrorrirelA' WindowName: ''
- ClassName: 'TmorvallcthoriaxmoA' WindowName: ''
- ClassName: 'TsabgaulfanmygothhA' WindowName: ''
- ClassName: 'TmorthinglaganorbaA' WindowName: ''
- ClassName: 'TarmoupieelxwA' WindowName: ''
- ClassName: 'TmyrymcarorzararotA' WindowName: ''
- ClassName: 'TrondoomdoommalA' WindowName: ''
- ClassName: 'TthimamsoinmaA' WindowName: ''
- ClassName: 'TbhootsysvtA' WindowName: ''
- ClassName: 'TvapulavassagoA' WindowName: ''
- ClassName: 'TkalilaxoumbrxA' WindowName: ''
- ClassName: 'TbeballbullA' WindowName: ''
- ClassName: 'TgordsgordsA' WindowName: ''
- ClassName: 'TamaymonrakA' WindowName: ''
- ClassName: 'TathothasuraxA' WindowName: ''
- ClassName: 'TpazuzupaimomA' WindowName: ''
- ClassName: 'TvabedaiermellA' WindowName: ''
- ClassName: 'TjikininkikillA' WindowName: ''
- ClassName: 'TtulmamiaandrornreA' WindowName: ''
- ClassName: 'TguoverbelagormilA' WindowName: ''
- ClassName: 'TthanstkasesarieltA' WindowName: ''
- ClassName: 'TvarorzergsiasuzurA' WindowName: ''
- ClassName: 'TulaorgrargnasamaA' WindowName: ''
- ClassName: 'TushganargmilkrulbA' WindowName: ''
- ClassName: 'TblisrendbasrantagA' WindowName: ''
- ClassName: 'TasmoranlasrudcugoA' WindowName: ''
- ClassName: 'TfenthadryranenybzA' WindowName: ''
- ClassName: 'TballbaeljesucbesoA' WindowName: ''
- ClassName: 'TimgashgrimthandgrA' WindowName: ''
- ClassName: 'TlaboburakpeslisauA' WindowName: ''
- ClassName: 'TaphanriulfanresmaA' WindowName: ''
- ClassName: 'TbironmathinlochmiA' WindowName: ''
- ClassName: 'TberornfurathpasshA' WindowName: ''
- ClassName: 'TlachanrontogashmaA' WindowName: ''
- ClassName: 'TmalionpeballthadgA' WindowName: ''
- ClassName: 'TulfgrornracroreshA' WindowName: ''
- ClassName: 'TzetakhidrorncthemA' WindowName: ''
- ClassName: 'TmonmarushurakrakkA' WindowName: ''
- ClassName: 'TruulsorthphuslethA' WindowName: ''
- ClassName: 'TcaveranbachapaiusA' WindowName: ''
- ClassName: 'TmosaucrolabahaumaA' WindowName: ''
- ClassName: 'TritgorpharurielthA' WindowName: ''
- ClassName: 'TlisaumekahantegorA' WindowName: ''
- ClassName: 'TabezethibouA' WindowName: ''
- ClassName: 'TclassyalabolasA' WindowName: ''
- ClassName: 'TdantalionA' WindowName: ''
- ClassName: 'TfocalorforasforcasforrasA' WindowName: ''
- ClassName: 'TalusamaymonamdusiasA' WindowName: ''
- ClassName: 'TbelethbelphegorberithA' WindowName: ''
- ClassName: 'TyaoyeqonyeterelA' WindowName: ''
- ClassName: 'TrahabraumronoveA' WindowName: ''
- ClassName: 'TmolochmurmurA' WindowName: ''
- ClassName: 'TuitoolssystemA' WindowName: ''
- ClassName: 'TWindowsForms10appA' WindowName: ''
- ClassName: 'TratanabaA' WindowName: ''
- ClassName: 'TrecifulrothA' WindowName: ''
- ClassName: 'TrahabraumA' WindowName: ''
- ClassName: 'TciferlilithA' WindowName: ''
- ClassName: 'TlilithciferA' WindowName: ''
- ClassName: 'TziminiarzulubanguA' WindowName: ''
- ClassName: 'TzaganzeparzozoA' WindowName: ''
- ClassName: 'TgrigorigualichuA' WindowName: ''
- ClassName: 'TastslucixA' WindowName: ''
- ClassName: 'TfendygrridsA' WindowName: ''
- ClassName: 'TmitrusdinamusA' WindowName: ''
- ClassName: 'TblueskinisA' WindowName: ''
- ClassName: 'TskylabswtzA' WindowName: ''
- ClassName: 'TchemoshchoronzonA' WindowName: ''
- ClassName: 'TrangdaravanA' WindowName: ''
- ClassName: 'TmalphasmammonmaraA' WindowName: ''
- ClassName: 'TbaalbaelbalamA' WindowName: ''
- ClassName: 'TasthaphaiosA' WindowName: ''
- ClassName: 'TeligoseloaiouequidnaA' WindowName: ''
- ClassName: 'TdemodemogorgonA' WindowName: ''
- ClassName: 'TlechiesleyaklempoA' WindowName: ''
- ClassName: 'TncuboiblisimpiposipesA' WindowName: ''
- ClassName: 'TdrekavacA' WindowName: ''
- ClassName: 'TdaevadagondajjalA' WindowName: ''
- ClassName: 'TbelethybelphegorA' WindowName: ''
- ClassName: 'TbotisbuerbukavacA' WindowName: ''
- ClassName: 'TmaraxmoraxforaiisysA' WindowName: ''
- ClassName: 'TbansheebaphometbarbasbalamA' WindowName: ''
- ClassName: 'TgusiongusoingusoynA' WindowName: ''
- ClassName: 'TgrigorigualichuguayotaA' WindowName: ''
- ClassName: 'TshaxshedimsithisA' WindowName: ''
- ClassName: 'TtannintoyolbikA' WindowName: ''
- ClassName: 'TmasihaddajjalxA' WindowName: ''
- ClassName: 'TgosfegaderelgakiA' WindowName: ''
- ClassName: 'TcorsoncrocellculsuA' WindowName: ''
- ClassName: 'TasagueasacuasbelA' WindowName: ''
- ClassName: 'TbuerbukavacbuneA' WindowName: ''
- ClassName: 'TmorfeumerihemA' WindowName: ''
- ClassName: 'TsabnocksaclassaleosA' WindowName: ''
- ClassName: 'TpaimonpazuzupelesitA' WindowName: ''
- ClassName: 'TmaraxforaiimarchosiaA' WindowName: ''
- ClassName: 'TshandanfurdragushA' WindowName: ''
- ClassName: 'TqualithgaganorseiA' WindowName: ''
