Trojan.Encoder.44502

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\explorer
%APPDATA%\microsoft\windows\start menu\programs\startup\explorer.lnk

Creates the following files on removable media

<Drive name for removable media>:\explorer\explorer.exe
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\join.avi.exe
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dialmap.bmp.exe
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\tileimage.bmp.exe
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dashborder_192.bmp.exe
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\dial.bmp.exe
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\coffee.bmp.exe
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\default.bmp.exe
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\dashborder_144.bmp.exe
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer.exe
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\contoso_1.cer.exe
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\contoso.cer.exe
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\testcertificate.cer.exe
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\sdszfo.docx
<Drive name for removable media>:\issi2013_template_for_posters.docx
<Drive name for removable media>:\file_p_00000000_1371597592.docx
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\wrar520.exe
<Drive name for removable media>:\notepad.exe
<Drive name for removable media>:\chromesetup.exe
<Drive name for removable media>:\dotnetfx45_full_setup.exe
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
<Drive name for removable media>:\skypesetup.exe
<Drive name for removable media>:\calc.exe
<Drive name for removable media>:\winmine.exe
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\about.htm
<Drive name for removable media>:\trivial-merge.htm
<Drive name for removable media>:\api-hashmap.html
<Drive name for removable media>:\ituneshelpunavailable.html
<Drive name for removable media>:\trivial-merge.html
<Drive name for removable media>:\howto-index.html
<Drive name for removable media>:\tree_view.html
<Drive name for removable media>:\168.jpeg
<Drive name for removable media>:\13.jpeg
<Drive name for removable media>:\210252809.jpeg
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\parnas_01.jpeg
<Drive name for removable media>:\pushkin.jpeg
<Drive name for removable media>:\2.jpeg
<Drive name for removable media>:\13.jpg
<Drive name for removable media>:\2.jpg
<Drive name for removable media>:\1189.jpg
<Drive name for removable media>:\region-north-karelia.jpg

Malicious functions

Launches a large number of processes

Modifies file system

Creates the following files

%APPDATA%\explorer.exe
%ALLUSERSPROFILE%\explorer\explorer.ico
%ALLUSERSPROFILE%\explorer\join.avi.ico
%TEMP%\aut3678.tmp
%APPDATA%\explorer\explorer.exe
%APPDATA%\explorer\explorer.au3
%LOCALAPPDATA%\autoit v3\aut2exe\aut3937.tmp.tok
%TEMP%\aut3939.tmp
%TEMP%\aut394b.tmp
%TEMP%\aut394c.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut3937.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut3937.tmp.exe
%ALLUSERSPROFILE%\explorer\dialmap.bmp.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx396c.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcx399c.tmp
%ALLUSERSPROFILE%\explorer\tileimage.bmp.ico
%LOCALAPPDATA%\autoit v3\aut2exe\aut3b0c.tmp.tok
%TEMP%\aut3b0e.tmp
%TEMP%\aut3b2f.tmp
%TEMP%\aut3b30.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut3b0c.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut3b0c.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx3b7f.tmp
%ALLUSERSPROFILE%\explorer\dashborder_192.bmp.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx3c2c.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut3c35.tmp.tok
%TEMP%\aut3c46.tmp
%TEMP%\aut3c48.tmp
%TEMP%\aut3c49.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut3c35.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut3c35.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx3c89.tmp
%ALLUSERSPROFILE%\explorer\dial.bmp.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx3da3.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut3dbb.tmp.tok
%TEMP%\aut3dcd.tmp
%TEMP%\aut3dfe.tmp
%TEMP%\aut3dff.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut3dbb.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut3dbb.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx3e3e.tmp
%ALLUSERSPROFILE%\explorer\coffee.bmp.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx3f2a.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut3f32.tmp.tok
%TEMP%\aut3f44.tmp
%TEMP%\aut3f56.tmp
%TEMP%\aut3f57.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut3f32.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut3f32.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx3fb5.tmp
%ALLUSERSPROFILE%\explorer\default.bmp.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx40d0.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut40e8.tmp.tok
%TEMP%\aut40ea.tmp
%TEMP%\aut411b.tmp
%TEMP%\aut411c.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut40e8.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut40e8.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx415b.tmp
%ALLUSERSPROFILE%\explorer\dashborder_144.bmp.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4295.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut42bd.tmp.tok
%TEMP%\aut42bf.tmp
%TEMP%\aut42ef.tmp
%TEMP%\aut42f0.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut42bd.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut42bd.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4340.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcx442b.tmp
%ALLUSERSPROFILE%\explorer\sdksampleunprivdeveloper.cer.ico
%LOCALAPPDATA%\autoit v3\aut2exe\aut4443.tmp.tok
%TEMP%\aut4455.tmp
%TEMP%\aut4466.tmp
%TEMP%\aut4467.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4443.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4443.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4488.tmp
%ALLUSERSPROFILE%\explorer\contoso_1.cer.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx45a2.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4608.tmp.tok
%TEMP%\aut460a.tmp
%TEMP%\aut463b.tmp
%TEMP%\aut463c.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4608.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4608.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx468b.tmp
%ALLUSERSPROFILE%\explorer\contoso.cer.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4757.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4770.tmp.tok
%TEMP%\aut4781.tmp
%TEMP%\aut47b2.tmp
%TEMP%\aut47b3.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4770.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4770.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx47f3.tmp
%ALLUSERSPROFILE%\explorer\testcertificate.cer.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx48ee.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut48f6.tmp.tok
%TEMP%\aut4908.tmp
%TEMP%\aut4929.tmp
%TEMP%\aut492a.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut48f6.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut48f6.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4979.tmp
%ALLUSERSPROFILE%\explorer\lisp_success.doc.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4a84.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4a9c.tmp.tok
%TEMP%\aut4a9e.tmp
%TEMP%\aut4ab0.tmp
%TEMP%\aut4ab1.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4a9c.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4a9c.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4b00.tmp
%ALLUSERSPROFILE%\explorer\uep_form_786_bulletin_1726i602.doc.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4c1a.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4c61.tmp.tok
%TEMP%\aut4c63.tmp
%TEMP%\aut4ca4.tmp
%TEMP%\aut4ca5.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4c61.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4c61.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4ce4.tmp
%ALLUSERSPROFILE%\explorer\cveuropeo.doc.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4ddf.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4de8.tmp.tok
%TEMP%\aut4dfa.tmp
%TEMP%\aut4dfc.tmp
%TEMP%\aut4dfd.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4de8.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4de8.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4e4c.tmp
%ALLUSERSPROFILE%\explorer\february_catalogue__2015.doc.ico
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4f47.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4f6f.tmp.tok
%TEMP%\aut4f80.tmp
%TEMP%\aut4fb1.tmp
%TEMP%\aut4fb2.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4f6f.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4f6f.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx4ff2.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\rcx50cd.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut50e6.tmp.tok
%TEMP%\aut50e8.tmp
%TEMP%\aut50f9.tmp
%TEMP%\aut50fa.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut50e6.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut50e6.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\rcx511a.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut5ed0.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6018.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6180.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut62b8.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut63f1.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6519.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6662.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6a2a.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6bc1.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut678a.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6d47.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6ebe.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7006.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut714e.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut72b6.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut73fe.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7575.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut76bd.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7805.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut795d.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7aa5.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7bde.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7d26.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7e4f.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7fa6.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut80df.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut8217.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut835f.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut8498.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut85f0.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut8738.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut8890.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut89b8.tmp.exe

Sets the 'hidden' attribute to the following files

<Drive name for removable media>:\explorer\explorer.exe

Deletes following files that it created itself

%TEMP%\aut3678.tmp
%TEMP%\aut3939.tmp
%TEMP%\aut394b.tmp
%TEMP%\aut394c.tmp
%APPDATA%\explorer\explorer.au3
%LOCALAPPDATA%\autoit v3\aut2exe\aut3937.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut3937.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut3937.tmp.exe
%TEMP%\aut3b0e.tmp
%TEMP%\aut3b2f.tmp
%TEMP%\aut3b30.tmp
%TEMP%\aut3c46.tmp
%TEMP%\aut3c48.tmp
%TEMP%\aut3c49.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut3b0c.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut3b0c.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut3b0c.tmp.exe
%TEMP%\aut3dcd.tmp
%TEMP%\aut3dfe.tmp
%TEMP%\aut3dff.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut3c35.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut3c35.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut3c35.tmp.exe
%TEMP%\aut3f44.tmp
%TEMP%\aut3f56.tmp
%TEMP%\aut3f57.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut3dbb.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut3dbb.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut3dbb.tmp.exe
%TEMP%\aut40ea.tmp
%TEMP%\aut411b.tmp
%TEMP%\aut411c.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut3f32.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut3f32.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut3f32.tmp.exe
%TEMP%\aut42bf.tmp
%TEMP%\aut42ef.tmp
%TEMP%\aut42f0.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut40e8.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut40e8.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut40e8.tmp.exe
%TEMP%\aut4455.tmp
%TEMP%\aut4466.tmp
%TEMP%\aut4467.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut42bd.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut42bd.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut42bd.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut4443.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut4443.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4443.tmp.exe
%TEMP%\aut460a.tmp
%TEMP%\aut463b.tmp
%TEMP%\aut463c.tmp
%TEMP%\aut4781.tmp
%TEMP%\aut47b2.tmp
%TEMP%\aut47b3.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4608.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut4608.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4608.tmp.exe
%TEMP%\aut4908.tmp
%TEMP%\aut4929.tmp
%TEMP%\aut492a.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4770.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut4770.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4770.tmp.exe
%TEMP%\aut4a9e.tmp
%TEMP%\aut4ab0.tmp
%TEMP%\aut4ab1.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut48f6.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut48f6.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut48f6.tmp.exe
%TEMP%\aut4c63.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4a9c.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut4a9c.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4a9c.tmp.exe
%TEMP%\aut4ca4.tmp
%TEMP%\aut4ca5.tmp
%TEMP%\aut4dfa.tmp
%TEMP%\aut4dfc.tmp
%TEMP%\aut4dfd.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4c61.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut4c61.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4c61.tmp.exe
%TEMP%\aut4f80.tmp
%TEMP%\aut4fb1.tmp
%TEMP%\aut4fb2.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4de8.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut4de8.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4de8.tmp.exe
%TEMP%\aut50e8.tmp
%TEMP%\aut50f9.tmp
%TEMP%\aut50fa.tmp
%LOCALAPPDATA%\autoit v3\aut2exe\aut4f6f.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut4f6f.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut4f6f.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut50e6.tmp.tok
%LOCALAPPDATA%\autoit v3\aut2exe\aut50e6.tmp.a3x
%LOCALAPPDATA%\autoit v3\aut2exe\aut50e6.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut5ed0.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6018.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6180.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut62b8.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut63f1.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6519.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6662.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6a2a.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6bc1.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut678a.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6d47.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut6ebe.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7006.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut714e.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut72b6.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut73fe.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7575.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut76bd.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7805.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut795d.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7aa5.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7bde.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7d26.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7e4f.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut7fa6.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut80df.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut8217.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut835f.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut8498.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut85f0.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut8738.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut8890.tmp.exe
%LOCALAPPDATA%\autoit v3\aut2exe\aut89b8.tmp.exe

Moves the following files

from %LOCALAPPDATA%\autoit v3\aut2exe\rcx396c.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut3937.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx399c.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut3937.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx3b7f.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut3b0c.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx3c2c.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut3b0c.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx3c89.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut3c35.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx3da3.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut3c35.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx3e3e.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut3dbb.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx3f2a.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut3dbb.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx3fb5.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut3f32.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx40d0.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut3f32.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx415b.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut40e8.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4295.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut40e8.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4340.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut42bd.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx442b.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut42bd.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4488.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4443.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx45a2.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4443.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx468b.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4608.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4757.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4608.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx47f3.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4770.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx48ee.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4770.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4979.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut48f6.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4a84.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut48f6.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4b00.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4a9c.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4c1a.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4a9c.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4ce4.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4c61.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4ddf.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4c61.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4e4c.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4de8.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4f47.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4de8.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx4ff2.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4f6f.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx511a.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut50e6.tmp.exe
from %LOCALAPPDATA%\autoit v3\aut2exe\rcx50cd.tmp to %LOCALAPPDATA%\autoit v3\aut2exe\aut4f6f.tmp.exe

Substitutes the following files

%APPDATA%\explorer\explorer.au3

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%APPDATA%\explorer.exe'
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\join.avi.exe" /icon "%ALLUSERSPROFILE%\explorer\join.avi.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\dialmap.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\dialmap.bmp.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\tileimage.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\tileimage.bmp.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\dashBorder_192.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\dashBorder_192.bmp.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\dial.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\dial.bmp.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\coffee.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\coffee.bmp.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\default.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\default.bmp.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\dashBorder_144.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\dashBorder_144.bmp.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\SDKSampleUnprivDeveloper.cer.exe" /icon "%ALLUSERSPROFILE%\explorer\SDKSampleUnprivDeveloper.cer.ico" /x86 /comp 4 ...
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\contoso_1.cer.exe" /icon "%ALLUSERSPROFILE%\explorer\contoso_1.cer.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\contoso.cer.exe" /icon "%ALLUSERSPROFILE%\explorer\contoso.cer.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\TestCertificate.cer.exe" /icon "%ALLUSERSPROFILE%\explorer\TestCertificate.cer.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\lisp_success.doc.exe" /icon "%ALLUSERSPROFILE%\explorer\lisp_success.doc.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.exe" /icon "%ALLUSERSPROFILE%\explorer\uep_form_786_bulletin_1726i602.doc.ico" /...
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\cveuropeo.doc.exe" /icon "%ALLUSERSPROFILE%\explorer\cveuropeo.doc.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\february_catalogue__2015.doc.exe" /icon "%ALLUSERSPROFILE%\explorer\february_catalogue__2015.doc.ico" /x86 /comp 4 ...
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\508softwareandos.doc.exe" /icon "%ALLUSERSPROFILE%\explorer\508softwareandos.doc.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\fi51.doc.exe" /icon "%ALLUSERSPROFILE%\explorer\fi51.doc.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\sdszfo.docx.exe" /icon "%ALLUSERSPROFILE%\explorer\sdszfo.docx.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\issi2013_template_for_posters.docx.exe" /icon "%ALLUSERSPROFILE%\explorer\issi2013_template_for_posters.docx.ico" /...
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\file_p_00000000_1371597592.docx.exe" /icon "%ALLUSERSPROFILE%\explorer\file_p_00000000_1371597592.docx.ico" /x86 /c...
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\thlps_keeper_mayer_1965.docx.exe" /icon "%ALLUSERSPROFILE%\explorer\thlps_keeper_mayer_1965.docx.ico" /x86 /comp 4 ...
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx.exe" /icon "%ALLUSERSPROFILE%\explorer\aoc_saq_d_v3_merchant.docx.ico" /x86 /comp 4 /nop...
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\holycrosschurchinstructions.docx.exe" /icon "%ALLUSERSPROFILE%\explorer\holycrosschurchinstructions.docx.ico" /x86 ...
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\wrar520.exe" /icon "%ALLUSERSPROFILE%\explorer\wrar520.exe.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\notepad.exe" /icon "%ALLUSERSPROFILE%\explorer\notepad.exe.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\chromesetup.exe" /icon "%ALLUSERSPROFILE%\explorer\chromesetup.exe.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\dotnetfx45_full_setup.exe" /icon "%ALLUSERSPROFILE%\explorer\dotnetfx45_full_setup.exe.ico" /x86 /comp 4 /nopack /g...
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe" /icon "%ALLUSERSPROFILE%\explorer\jre-7u75-windows-i586-iftw.exe.ico" /x86 /comp 4 ...
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\skypesetup.exe" /icon "%ALLUSERSPROFILE%\explorer\skypesetup.exe.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\calc.exe" /icon "%ALLUSERSPROFILE%\explorer\calc.exe.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\winmine.exe" /icon "%ALLUSERSPROFILE%\explorer\winmine.exe.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\iisstart.htm.exe" /icon "%ALLUSERSPROFILE%\explorer\iisstart.htm.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\about.htm.exe" /icon "%ALLUSERSPROFILE%\explorer\about.htm.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\trivial-merge.htm.exe" /icon "%ALLUSERSPROFILE%\explorer\trivial-merge.htm.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\api-hashmap.html.exe" /icon "%ALLUSERSPROFILE%\explorer\api-hashmap.html.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\iTunesHelpUnavailable.html.exe" /icon "%ALLUSERSPROFILE%\explorer\iTunesHelpUnavailable.html.ico" /x86 /comp 4 /nop...
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\trivial-merge.html.exe" /icon "%ALLUSERSPROFILE%\explorer\trivial-merge.html.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\howto-index.html.exe" /icon "%ALLUSERSPROFILE%\explorer\howto-index.html.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\tree_view.html.exe" /icon "%ALLUSERSPROFILE%\explorer\tree_view.html.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\168.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\168.jpeg.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\13.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\13.jpeg.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\210252809.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\210252809.jpeg.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\3.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\3.jpeg.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\parnas_01.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\parnas_01.jpeg.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\pushkin.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\pushkin.jpeg.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\2.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\2.jpeg.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\13.jpg.exe" /icon "%ALLUSERSPROFILE%\explorer\13.jpg.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\2.jpg.exe" /icon "%ALLUSERSPROFILE%\explorer\2.jpg.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\1189.jpg.exe" /icon "%ALLUSERSPROFILE%\explorer\1189.jpg.ico" /x86 /comp 4 /nopack /gui
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\region-north-karelia.jpg.exe" /icon "%ALLUSERSPROFILE%\explorer\region-north-karelia.jpg.ico" /x86 /comp 4 /nopack ...

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn explorer /tr %APPDATA%\explorer.exe
'%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn explorer /tr %APPDATA%\explorer.exe' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\join.avi.exe" /icon "%ALLUSERSPROFILE%\explorer\join.avi.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\dialmap.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\dialmap.bmp.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\tileimage.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\tileimage.bmp.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\dashBorder_192.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\dashBorder_192.bmp.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\dial.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\dial.bmp.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\coffee.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\coffee.bmp.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\default.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\default.bmp.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\dashBorder_144.bmp.exe" /icon "%ALLUSERSPROFILE%\explorer\dashBorder_144.bmp.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\SDKSampleUnprivDeveloper.cer.exe" /icon "%ALLUSERSPROFILE%\explorer\SDKSampleUnprivDeveloper.cer.ico" /x86 /comp 4 ...' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\contoso_1.cer.exe" /icon "%ALLUSERSPROFILE%\explorer\contoso_1.cer.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\contoso.cer.exe" /icon "%ALLUSERSPROFILE%\explorer\contoso.cer.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\TestCertificate.cer.exe" /icon "%ALLUSERSPROFILE%\explorer\TestCertificate.cer.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\lisp_success.doc.exe" /icon "%ALLUSERSPROFILE%\explorer\lisp_success.doc.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.exe" /icon "%ALLUSERSPROFILE%\explorer\uep_form_786_bulletin_1726i602.doc.ico" /...' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\cveuropeo.doc.exe" /icon "%ALLUSERSPROFILE%\explorer\cveuropeo.doc.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\february_catalogue__2015.doc.exe" /icon "%ALLUSERSPROFILE%\explorer\february_catalogue__2015.doc.ico" /x86 /comp 4 ...' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\508softwareandos.doc.exe" /icon "%ALLUSERSPROFILE%\explorer\508softwareandos.doc.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\fi51.doc.exe" /icon "%ALLUSERSPROFILE%\explorer\fi51.doc.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\sdszfo.docx.exe" /icon "%ALLUSERSPROFILE%\explorer\sdszfo.docx.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\issi2013_template_for_posters.docx.exe" /icon "%ALLUSERSPROFILE%\explorer\issi2013_template_for_posters.docx.ico" /...' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\file_p_00000000_1371597592.docx.exe" /icon "%ALLUSERSPROFILE%\explorer\file_p_00000000_1371597592.docx.ico" /x86 /c...' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\thlps_keeper_mayer_1965.docx.exe" /icon "%ALLUSERSPROFILE%\explorer\thlps_keeper_mayer_1965.docx.ico" /x86 /comp 4 ...' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx.exe" /icon "%ALLUSERSPROFILE%\explorer\aoc_saq_d_v3_merchant.docx.ico" /x86 /comp 4 /nop...' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\holycrosschurchinstructions.docx.exe" /icon "%ALLUSERSPROFILE%\explorer\holycrosschurchinstructions.docx.ico" /x86 ...' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\wrar520.exe" /icon "%ALLUSERSPROFILE%\explorer\wrar520.exe.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\notepad.exe" /icon "%ALLUSERSPROFILE%\explorer\notepad.exe.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\chromesetup.exe" /icon "%ALLUSERSPROFILE%\explorer\chromesetup.exe.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\dotnetfx45_full_setup.exe" /icon "%ALLUSERSPROFILE%\explorer\dotnetfx45_full_setup.exe.ico" /x86 /comp 4 /nopack /g...' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe" /icon "%ALLUSERSPROFILE%\explorer\jre-7u75-windows-i586-iftw.exe.ico" /x86 /comp 4 ...' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\skypesetup.exe" /icon "%ALLUSERSPROFILE%\explorer\skypesetup.exe.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\calc.exe" /icon "%ALLUSERSPROFILE%\explorer\calc.exe.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\winmine.exe" /icon "%ALLUSERSPROFILE%\explorer\winmine.exe.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\iisstart.htm.exe" /icon "%ALLUSERSPROFILE%\explorer\iisstart.htm.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\about.htm.exe" /icon "%ALLUSERSPROFILE%\explorer\about.htm.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\trivial-merge.htm.exe" /icon "%ALLUSERSPROFILE%\explorer\trivial-merge.htm.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\api-hashmap.html.exe" /icon "%ALLUSERSPROFILE%\explorer\api-hashmap.html.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\iTunesHelpUnavailable.html.exe" /icon "%ALLUSERSPROFILE%\explorer\iTunesHelpUnavailable.html.ico" /x86 /comp 4 /nop...' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\trivial-merge.html.exe" /icon "%ALLUSERSPROFILE%\explorer\trivial-merge.html.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\howto-index.html.exe" /icon "%ALLUSERSPROFILE%\explorer\howto-index.html.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\tree_view.html.exe" /icon "%ALLUSERSPROFILE%\explorer\tree_view.html.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\168.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\168.jpeg.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\13.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\13.jpeg.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\210252809.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\210252809.jpeg.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\3.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\3.jpeg.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\parnas_01.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\parnas_01.jpeg.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\pushkin.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\pushkin.jpeg.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\2.jpeg.exe" /icon "%ALLUSERSPROFILE%\explorer\2.jpeg.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\13.jpg.exe" /icon "%ALLUSERSPROFILE%\explorer\13.jpg.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\2.jpg.exe" /icon "%ALLUSERSPROFILE%\explorer\2.jpg.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\1189.jpg.exe" /icon "%ALLUSERSPROFILE%\explorer\1189.jpg.ico" /x86 /comp 4 /nopack /gui' (with hidden window)
'%APPDATA%\explorer\explorer.exe' /in "%APPDATA%\explorer\explorer.au3" /out "<Drive name for removable media>:\region-north-karelia.jpg.exe" /icon "%ALLUSERSPROFILE%\explorer\region-north-karelia.jpg.ico" /x86 /comp 4 /nopack ...' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial