These dropped files bundle functionality for both 64bit and 32bit Windows systems and are all located within one directory: C:\Documents and Settings\user\Application Data\ATI_Subsystem\ 6761106f816313394a653db5172dc487,amdhcp32.dll,54kb  ← 32bit dll,CompiledOn:2014.07.02 21:13:24 d596827d48a3ff836545b3a999f2c3e3,aticaldd.dll,60kb  ← 64bit dll,CompiledOn:2014.07.02 21:13:26 bc626c8f11ed753f33ad1c0fe848d898,atiumdag.dll,285kb ← 32bit dll, Trojan.Win32.CozyDuke.a, CompiledOn:2014.07.02 21:13:26 4152e79e3dbde55dcf3fc2014700a022,6kb,racss.dat The code copies rundll32.exe from windows\system32 to its newly created %appdata%\ATI_Subsystem subdirectory as “amdocl_as32.exe” alongside the three dll’s listed above