Technical Information
To ensure autorun and distribution
Infects the following executable files
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\envelopr.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\mor6int.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\msointl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\msointl.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\omsintl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\onintl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\onintl.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outllibr.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outllibr.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outlwvw.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\ppintl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\grintl32.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\mapir.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\ppintl.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pubwzint.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\sgres.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\stintl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\visbrres.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\visintl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\wwintl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\wwintl.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlintl32.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlintl32.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlslicer.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pub6intl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pub6intl.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\grintl32.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\envelopr.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlslicer.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\grintl32.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\mapir.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\mor6int.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\msointl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\msointl.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\omsintl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\onintl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\onintl.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outllibr.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outllibr.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outlwvw.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\grintl32.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\ppintl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pub6intl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pub6intl.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pubwzint.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\sgres.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\stintl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\visbrres.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\visintl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\wwintl.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\wwintl.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlintl32.dll.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlintl32.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\ppintl.rest.trx_dll.nokoyawa
- %ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm.nokoyawa
- %ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasdlta.vdm.nokoyawa
Creates the following files on removable media
- <Drive name for removable media>:\nokoyawa_readme.txt
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- C:\nokoyawa_readme.txt
- C:\users\default\nokoyawa_readme.txt
- C:\users\default\application data\nokoyawa_readme.txt
- C:\users\default\cookies\nokoyawa_readme.txt
- C:\users\default\desktop\nokoyawa_readme.txt
- C:\users\default\documents\nokoyawa_readme.txt
- C:\users\default\documents\my music\nokoyawa_readme.txt
- C:\users\default\documents\my pictures\nokoyawa_readme.txt
- C:\users\default\documents\my videos\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\msscan\nokoyawa_readme.txt
- C:\users\default\downloads\nokoyawa_readme.txt
- C:\users\default\links\nokoyawa_readme.txt
- C:\users\default\local settings\nokoyawa_readme.txt
- C:\users\default\music\nokoyawa_readme.txt
- C:\users\default\my documents\nokoyawa_readme.txt
- C:\users\default\nethood\nokoyawa_readme.txt
- C:\users\default\pictures\nokoyawa_readme.txt
- C:\users\default\printhood\nokoyawa_readme.txt
- C:\users\default\recent\nokoyawa_readme.txt
- C:\users\default\saved games\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\sun\java\nokoyawa_readme.txt
- C:\users\default\favorites\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\templates\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\sun\java\java update\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\sun\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\start menu\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\nokoyawa_readme.txt
- C:\users\default\sendto\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\wpd\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\mozilla\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\mozilla\updates\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\mozilla\updates\e7cf176e110c211b\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\oracle\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\oracle\java\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\support\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\oracle\java\javapath\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft help\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\nokoyawa_readme.txt
- C:\users\default\start menu\nokoyawa_readme.txt
- C:\users\public\nokoyawa_readme.txt
- %HOMEPATH%\downloads\nokoyawa_readme.txt
- %HOMEPATH%\favorites\nokoyawa_readme.txt
- %HOMEPATH%\favorites\links\nokoyawa_readme.txt
- %HOMEPATH%\favorites\links for united states\nokoyawa_readme.txt
- %HOMEPATH%\favorites\microsoft websites\nokoyawa_readme.txt
- %HOMEPATH%\favorites\msn websites\nokoyawa_readme.txt
- %HOMEPATH%\favorites\windows live\nokoyawa_readme.txt
- %HOMEPATH%\links\nokoyawa_readme.txt
- %HOMEPATH%\local settings\nokoyawa_readme.txt
- %HOMEPATH%\documents\nokoyawa_readme.txt
- %HOMEPATH%\music\nokoyawa_readme.txt
- %HOMEPATH%\nethood\nokoyawa_readme.txt
- %HOMEPATH%\pictures\nokoyawa_readme.txt
- %HOMEPATH%\printhood\nokoyawa_readme.txt
- %HOMEPATH%\recent\nokoyawa_readme.txt
- %HOMEPATH%\saved games\nokoyawa_readme.txt
- %HOMEPATH%\searches\nokoyawa_readme.txt
- %HOMEPATH%\sendto\nokoyawa_readme.txt
- %HOMEPATH%\start menu\nokoyawa_readme.txt
- %HOMEPATH%\templates\nokoyawa_readme.txt
- %HOMEPATH%\documents\my pictures\nokoyawa_readme.txt
- %HOMEPATH%\documents\my videos\nokoyawa_readme.txt
- %HOMEPATH%\documents\my music\nokoyawa_readme.txt
- %HOMEPATH%\desktop\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\drm\server\nokoyawa_readme.txt
- C:\users\public\desktop\nokoyawa_readme.txt
- C:\users\public\documents\nokoyawa_readme.txt
- C:\users\public\documents\my music\nokoyawa_readme.txt
- C:\users\public\documents\my pictures\nokoyawa_readme.txt
- C:\users\public\documents\my videos\nokoyawa_readme.txt
- C:\users\public\downloads\nokoyawa_readme.txt
- C:\users\public\favorites\nokoyawa_readme.txt
- C:\users\public\libraries\nokoyawa_readme.txt
- C:\users\default\templates\nokoyawa_readme.txt
- C:\users\default user\nokoyawa_readme.txt
- C:\users\default\videos\nokoyawa_readme.txt
- C:\users\public\music\nokoyawa_readme.txt
- C:\users\public\recorded tv\nokoyawa_readme.txt
- C:\users\public\recorded tv\sample media\nokoyawa_readme.txt
- C:\users\public\videos\nokoyawa_readme.txt
- C:\users\public\videos\sample videos\nokoyawa_readme.txt
- %HOMEPATH%\nokoyawa_readme.txt
- %HOMEPATH%\application data\nokoyawa_readme.txt
- %HOMEPATH%\contacts\nokoyawa_readme.txt
- %HOMEPATH%\cookies\nokoyawa_readme.txt
- C:\users\public\music\sample music\nokoyawa_readme.txt
- C:\users\public\pictures\nokoyawa_readme.txt
- C:\users\public\pictures\sample pictures\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\adobe\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\adobe\arm\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\adobe\arm\s\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\adobe\setup\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\application data\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\desktop\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\documents\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\assistance\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\assistance\client\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\crypto\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\crypto\dss\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\nokoyawa_readme.txt
- C:\recovery\nokoyawa_readme.txt
- <Current directory>\nokoyawa_readme.txt
- C:\users\nokoyawa_readme.txt
- C:\perflogs\admin\nokoyawa_readme.txt
- C:\perflogs\nokoyawa_readme.txt
- C:\documents and settings\nokoyawa_readme.txt
- C:\msocache\nokoyawa_readme.txt
- C:\msocache\all users\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\crypto\keys\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\favorites\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\nokoyawa_readme.txt
- C:\kms\nokoyawa_readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\nokoyawa_readme.txt
- C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\rac\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\rac\outbound\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\rac\statedata\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\rac\temp\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\search\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\search\data\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\search\data\applications\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\search\data\temp\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\definition updates\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\localcopy\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\quarantine\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\scans\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\scans\history\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\vault\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows defender\nokoyawa_readme.txt
- %HOMEPATH%\my documents\nokoyawa_readme.txt
- %HOMEPATH%\videos\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\office\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\device stage\device\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\devicesync\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\drm\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\ehome\logs\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\identitycrl\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\media player\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\mf\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\msdn\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\msdn\8.0\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\network\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\network\connections\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\network\downloader\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\device stage\nokoyawa_readme.txt
- %ALLUSERSPROFILE%\microsoft\ehome\nokoyawa_readme.txt
- D:\nokoyawa_readme.txt
Modifies the following files
- C:\kms\kms_vl_all_aio.cmd.nokoyawa
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.nokoyawa
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.nokoyawa
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.nokoyawa
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.msi.nokoyawa
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab.nokoyawa
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.nokoyawa
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab.nokoyawa
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.nokoyawa
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi.nokoyawa
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.nokoyawa
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab.nokoyawa
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.nokoyawa
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi.nokoyawa
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.nokoyawa
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.nokoyawa
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi.nokoyawa
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab.nokoyawa
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.nokoyawa
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab.nokoyawa
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab.nokoyawa
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.nokoyawa
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi.nokoyawa
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.nokoyawa
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab.nokoyawa
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.nokoyawa
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi.nokoyawa
- C:\kms\kms_vl_all_aio_debug.log.nokoyawa
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordlr.cab.nokoyawa
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.msi.nokoyawa
Modifies multiple files.
Changes user data files extensions (Trojan.Encoder).
