Trojan.Encoder.41975

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\@d0glun@.exe

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dial.bmp

Searches for windows to

detect analytical utilities:

ClassName: 'Regmonclass', WindowName: ''
ClassName: 'Filemonclass', WindowName: ''

Modifies file system

Creates the following files

%HOMEPATH%\desktop\cve.dll
%CommonProgramFiles%\microsoft shared\ink\ru-ru\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\ru-ru\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\ru-ru\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\ro-ro\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\ro-ro\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\ro-ro\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\pt-pt\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\pt-pt\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\pt-pt\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\pt-br\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\pt-br\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\pt-br\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\pl-pl\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\pl-pl\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\pl-pl\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\nl-nl\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\nl-nl\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\nl-nl\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\nb-no\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\sk-sk\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\sk-sk\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\sk-sk\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\sl-si\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\zh-cn\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\zh-cn\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\zh-cn\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\uk-ua\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\uk-ua\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\uk-ua\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\tr-tr\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\tr-tr\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\tr-tr\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\th-th\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\th-th\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\th-th\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\sv-se\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\sv-se\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\sv-se\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\sl-si\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\sl-si\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\zh-tw\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\nb-no\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\nb-no\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\lv-lv\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\he-il\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\he-il\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\he-il\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\hr-hr\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\lv-lv\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\lt-lt\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\lt-lt\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\lt-lt\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\ko-kr\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\ko-kr\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\ko-kr\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\ja-jp\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\ja-jp\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\it-it\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\ja-jp\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\it-it\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\it-it\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\hu-hu\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\hu-hu\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\hu-hu\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\lv-lv\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\zh-tw\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\zh-tw\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\msclientdatamgr\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\source engine\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\source engine\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\source engine\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\smart tag\lists\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\smart tag\lists\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\smart tag\1033\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\smart tag\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\smart tag\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\smart tag\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\proof\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\proof\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\proof\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\smart tag\1033\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\cultures\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\cultures\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\cultures\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\1033\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\1033\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\1033\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\msinfo\en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\msinfo\en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\msinfo\en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\msinfo\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\msinfo\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\msinfo\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\msclientdatamgr\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\msclientdatamgr\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\smart tag\1033\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fr-fr\~@d0glun background@.bmp
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\~@please opeen me@.docx
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\~@please opeen me.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\~@please opeen me@.docx
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\~@d0glun background@.bmp
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\~@please opeen me.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\~@please opeen me@.docx
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\~@d0glun background@.bmp
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\~@please opeen me.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\~@please opeen me@.docx
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\~@d0glun background@.bmp
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\~@d0glun background@.bmp
C:\msocache\all users\~@please opeen me.txt
C:\msocache\~@please opeen me@.docx
%HOMEPATH%\desktop\~@please opeen me.txt
%HOMEPATH%\desktop\000000000000n@d0glun&.txt
%HOMEPATH%\desktop\@d0glun@.key.vbs
D:\$recycle.bin\~@please opeen me.txt
%HOMEPATH%\desktop\lnk.0nion@d0glun&
%HOMEPATH%\desktop\1.rar.0nion@d0glun&
%HOMEPATH%\desktop\3.zip.0nion@d0glun&
%HOMEPATH%\desktop\00000000000000000000000000.@d0glun@.key
%HOMEPATH%\desktop\00000000000000000000000000000000000000000.@d0glun@.key
%HOMEPATH%\desktop\1000000000000.d0glun
%HOMEPATH%\desktop\4.d0glun
%HOMEPATH%\desktop\000000000000000000000000000000000000000.d0glun
%HOMEPATH%\desktop\00000000000000000000000000000000000.key
%HOMEPATH%\desktop\0000000000000000000000000000000000000.key
%HOMEPATH%\desktop\!@#$%^run!!!!@#!$
%HOMEPATH%\desktop\!@#$%^&^%&^%$%$%
%HOMEPATH%\desktop\run!!@d0glun@
D:\@d0glun@.exe
C:\@d0glun@.exe
D:\$recycle.bin\~@d0glun background@.bmp
D:\$recycle.bin\~@please opeen me@.docx
D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@please opeen me.txt
%HOMEPATH%\desktop\~@d0glun background@.bmp
C:\msocache\~@please opeen me.txt
C:\kms\~@please opeen me@.docx
C:\kms\~@d0glun background@.bmp
C:\kms\~@please opeen me.txt
C:\~@please opeen me@.docx
C:\~@d0glun background@.bmp
C:\~@please opeen me.txt
C:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@please opeen me@.docx
C:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@d0glun background@.bmp
C:\$recycle.bin\~@please opeen me@.docx
C:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@please opeen me.txt
C:\$recycle.bin\~@d0glun background@.bmp
C:\$recycle.bin\~@please opeen me.txt
D:\~@please opeen me@.docx
D:\~@d0glun background@.bmp
D:\~@please opeen me.txt
D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@please opeen me@.docx
D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@d0glun background@.bmp
C:\@main wallpaper.bmp
%HOMEPATH%\desktop\~@please opeen me@.docx
C:\msocache\~@d0glun background@.bmp
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\el-gr\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\el-gr\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\de-de\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\de-de\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\de-de\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\da-dk\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\da-dk\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\da-dk\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\cs-cz\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\cs-cz\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\en-us\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\bg-bg\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\bg-bg\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\bg-bg\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\ar-sa\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\ar-sa\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\ar-sa\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\cs-cz\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\en-us\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\fr-fr\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\el-gr\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\fi-fi\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\fi-fi\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\fi-fi\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\et-ee\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\et-ee\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\et-ee\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\es-es\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\ink\es-es\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\ink\es-es\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\fr-fr\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\en-us\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\help\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\help\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\help\~@please opeen me.txt
C:\perflogs\~@d0glun background@.bmp
%CommonProgramFiles%\~@d0glun background@.bmp
%CommonProgramFiles%\~@please opeen me.txt
%ProgramFiles%\~@please opeen me@.docx
%ProgramFiles%\~@d0glun background@.bmp
%ProgramFiles%\~@please opeen me.txt
C:\perflogs\admin\~@please opeen me@.docx
C:\perflogs\admin\~@d0glun background@.bmp
C:\perflogs\admin\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\~@please opeen me.txt
%CommonProgramFiles%\designer\~@please opeen me.txt
C:\perflogs\~@please opeen me.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\~@please opeen me@.docx
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\~@d0glun background@.bmp
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\~@please opeen me.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\~@please opeen me@.docx
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\~@d0glun background@.bmp
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\~@please opeen me.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\~@please opeen me@.docx
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\~@d0glun background@.bmp
C:\perflogs\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\equation\1033\~@d0glun background@.bmp
%CommonProgramFiles%\designer\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\~@d0glun background@.bmp
%CommonProgramFiles%\designer\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\grphflt\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\grphflt\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\grphflt\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\filters\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\filters\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\filters\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\euro\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\euro\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\euro\~@please opeen me.txt
%CommonProgramFiles%\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\equation\1033\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\equation\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\equation\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\equation\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\dw\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\dw\~@d0glun background@.bmp
%CommonProgramFiles%\microsoft shared\dw\~@please opeen me.txt
%CommonProgramFiles%\microsoft shared\~@please opeen me@.docx
%CommonProgramFiles%\microsoft shared\equation\1033\~@please opeen me@.docx
C:\@d0glun2@.bmp

Sets the 'hidden' attribute to the following files

%HOMEPATH%\desktop\cve.dll

Moves the following files

from %HOMEPATH%\desktop\000000000000n@d0glun&.txt to %HOMEPATH%\desktop\000000000000n@d0glun&.txt.@d0glun@txt
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt to %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt.@d0glun@txt
from %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt to %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.@d0glun@txt
from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.@d0glun@txt
from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.@d0glun@txt
from %ProgramFiles%\java\jre1.8.0_45\readme.txt to %ProgramFiles%\java\jre1.8.0_45\readme.txt.@d0glun@txt
from D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@d0glun background@.bmp to D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@d0glun background@.bmp.@d0glun@bmp
from D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@please opeen me@.docx to D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@please opeen me@.docx.@d0glun@doc
from D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@please opeen me.txt to D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@please opeen me.txt.@d0glun@txt
from D:\$recycle.bin\~@d0glun background@.bmp to D:\$recycle.bin\~@d0glun background@.bmp.@d0glun@bmp
from D:\$recycle.bin\~@please opeen me.txt to D:\$recycle.bin\~@please opeen me.txt.@d0glun@txt
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif.@d0glun@gif

Modifies the following files

%HOMEPATH%\desktop\cveuropeo.doc
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\fi51.doc
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml

Modifies multiple files.

Substitutes the following files

D:\$recycle.bin\~@please opeen me.txt
D:\$recycle.bin\~@d0glun background@.bmp
D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@please opeen me.txt
D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@d0glun background@.bmp
D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\~@please opeen me@.docx

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: '4823-00000029' WindowName: ''
ClassName: '18467-41' WindowName: ''
ClassName: '' WindowName: 'Taskmgr.exe'
ClassName: '' WindowName: 'cmd.exe'
ClassName: '' WindowName: 'powershell.exe'

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial