Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\howto-index.html
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\browse.htm
Modifies file system
Creates the following files
- C:\decryption instructions.txt
- C:\users\default\appdata\decryption instructions.txt
- C:\users\default\desktop\decryption instructions.txt
- C:\users\default\documents\decryption instructions.txt
- C:\users\default\downloads\decryption instructions.txt
- C:\users\default\favorites\decryption instructions.txt
- C:\users\default\links\decryption instructions.txt
- C:\users\default\music\decryption instructions.txt
- C:\users\default\pictures\decryption instructions.txt
- C:\users\default\saved games\decryption instructions.txt
- C:\users\default\videos\decryption instructions.txt
- C:\users\public\decryption instructions.txt
- %HOMEPATH%\decryption instructions.txt
- %HOMEPATH%\.oracle_jre_usage\decryption instructions.txt
- %HOMEPATH%\3d objects\decryption instructions.txt
- %HOMEPATH%\appdata\decryption instructions.txt
- %HOMEPATH%\contacts\decryption instructions.txt
- %HOMEPATH%\desktop\decryption instructions.txt
- %HOMEPATH%\documents\decryption instructions.txt
- %HOMEPATH%\downloads\decryption instructions.txt
- %HOMEPATH%\favorites\decryption instructions.txt
- %HOMEPATH%\favorites\links\decryption instructions.txt
- %HOMEPATH%\links\decryption instructions.txt
- %HOMEPATH%\music\decryption instructions.txt
- %HOMEPATH%\onedrive\decryption instructions.txt
- %HOMEPATH%\pictures\decryption instructions.txt
- %HOMEPATH%\pictures\camera roll\decryption instructions.txt
- %HOMEPATH%\saved games\decryption instructions.txt
- %HOMEPATH%\searches\decryption instructions.txt
- %HOMEPATH%\videos\decryption instructions.txt
- C:\users\default\decryption instructions.txt
- <Current directory>\decryption instructions.txt
- C:\users\decryption instructions.txt
- C:\recovery\decryption instructions.txt
- C:\$recycle.bin\decryption instructions.txt
- C:\$recycle.bin\s-1-5-21-2377844457-1847597103-2569463324-1000\decryption instructions.txt
- C:\msocache\decryption instructions.txt
- C:\msocache\all users\decryption instructions.txt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\decryption instructions.txt
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\decryption instructions.txt
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\decryption instructions.txt
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\decryption instructions.txt
- C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\decryption instructions.txt
- C:\perflogs\decryption instructions.txt
- %ProgramFiles%\decryption instructions.txt
- %ProgramFiles(x86)%\decryption instructions.txt
- %ALLUSERSPROFILE%\decryption instructions.txt
- C:\recovery\windowsre\decryption instructions.txt
- C:\kms\decryption instructions.txt
Modifies the following files
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.xml
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.xml
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.xml
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.xml
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.xml
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.xml
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.xml
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.xml
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\setup.xml
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
UDP
- DNS ASK di##ord.com
