1. The executable checks if "C:\\bd_training.txt" and "C:\\ceva.txt" exist

2. The executable traverses the whole "C:\" partition and: 

    i. creates files with the name "X.txt" in every directory

    ii. creates files having as their name a letter from the password every 5 directories entered

    iii. makes a copy of dll's encountered switching their extension to ".exe"

    iiii. makes a copy of bmp's encountered switching their extension to ".locked"

The password is:

    "prima parte din parola pentru primul lot de email-uri este \"infected\""

1. The executable checks if "C:\\bd_training.txt" exists

2. The executable traverses the whole "C:\" partition and: 

    i. creates files with the name "dummy.txt" in every third directory encountered

    ii. creates folders with the names of the files that have these extensions: .wav .hlp .wma

    iii. it copies itself in these newly created folders using a letter from the password for its name 

The password is:

    "the second part of the password for the first email lot is \"emails\""

1. The executable checks if "C:\\bd_training.txt" exists

2. poc3.exe: 

    i. copies itself in "C:\\same_process_different_name.exe"

    ii. runs this newly created file with the parameter "parametru"

3. C:\\same_process_different_name.exe ran with the parameter traverses the whole "C:\" partition and:

    i. creates files with the name "parametru" in every third directory encountered

    ii. creates folders with the names of the files that have these extensions: .wav .hlp .wma

    iii. it copies itself in these newly created folders using a letter from the password for its name 

The password is:

    "the first part of the password for the second email lot is \"malicious\""

1. The executable checks if the path "C:\\bd_training.txt" exists

2. Ran without parameters:

    - recursively  traverses C:\\ and creates files named "test" in random folders

    - recursively  traverses C:\\ and when it find files with the extensions ".wav", ".mp3" ".wma", it creates a folder with these files name +".directory" and inside it creates a file with the name made out of a letter from the first quarter of the password

    - it copies itself  into the file "same_process_different_name.exe" and it executes it with the parameter "first"

3. Ran with parameter "first":

    - recursively  traverses C:\\ and creates files named "first" in random folders

    - recursively  traverses C:\\ and when it find files with the extensions ".wav", ".mp3" ".wma", it creates a folder with these files name +".directory" and inside it creates a file with the name made out of a letter from the second quarter of the password

    - it copies itself  into the file "different_process.exe" and it executes it with the parameter "second"

4. Ran with parameter "second":

    - recursively  traverses C:\\ and creates files named "second" in random folders

    - recursively  traverses C:\\ and when it find files with the extensions ".wav", ".mp3" ".wma", it creates a folder with these files name +".directory" and inside it creates a file with the name made out of a letter from the third quarter of the password

    - it copies itself  into the file "alternate_process.exe" and it executes it with the parameter "third"

5. Ran with parameter "third":

    - it opens iexplore.exe to a web page, the web page's name is the last part of the password.

    - sleeps

    - runs taskkill on iexplore.exe which closes all opened iexplore processes

The password:

    "the second part of the password for the second email lot is \"letters\""