Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\howto-index.html
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Modifies file system
Modifies the following files
- %ProgramFiles%\java\jre1.8.0_77\bin\server\xusage.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\deploy\ffjcext.zip
- %ProgramFiles%\java\jre1.8.0_77\lib\jvm.hprof.txt
- %ProgramFiles%\java\jre1.8.0_77\readme.txt
- %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme-javafx.txt
- %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme.txt
- %ProgramFiles%\java\jre1.8.0_77\welcome.html
- %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file a.txt
- %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file b.txt
- %ProgramFiles%\microsoft office\office16\mso example setup file a.txt
- %ProgramFiles%\mozilla firefox\browser\visualelements\visualelements_150.png
- %ProgramFiles%\mozilla firefox\browser\visualelements\visualelements_70.png
- %ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js
- %ProgramFiles%\mozilla firefox\distibution\policies.json
- %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\manifest.json
- %ProgramFiles%\mozilla firefox\installation_telemetry.json
- %ProgramFiles%\mozilla thunderbird\defaults\pref\channel-prefs.js
- %ProgramFiles%\mozilla thunderbird\visualelements\visualelements_150.png
- %ProgramFiles%\mozilla thunderbird\visualelements\visualelements_70.png
- %ProgramFiles%\winrar\license.txt
- %ProgramFiles%\winrar\rar.txt
- %ProgramFiles%\winrar\readme.txt
- %ProgramFiles%\winrar\whatsnew.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\adobeid.pdf
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\defaultid.pdf
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\license.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\dynamic.pdf
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\signhere.pdf
Modifies multiple files.
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_idx.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_16.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_32.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_48.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_96.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_256.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_768.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_1280.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_1920.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_2560.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_sr.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_wide.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_exif.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_custom_stream.db
Modifies user data files (Trojan.Encoder).
