Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\readme_wdbmw6kx3i71.txt
Modifies file system
Creates the following files
- %TEMP%\readme_wdbmw6kx3i71.txt
- C:\users\all users\microsoft help\ms.winword.14.1033.hxn
- C:\users\all users\microsoft help\ms.setlang.14.1033.hxn
- C:\users\all users\microsoft help\ms.powerpnt.dev.14.1033.hxn
- C:\users\all users\microsoft help\ms.powerpnt.14.1033.hxn
- C:\users\all users\microsoft help\ms.outlook.dev.14.1033.hxn
- C:\users\all users\microsoft help\ms.outlook.14.1033.hxn
- C:\users\all users\microsoft help\ms.onenote.14.1033.hxn
- C:\users\all users\microsoft help\ms.ois.14.1033.hxn
- C:\users\all users\microsoft\msdn\7.0\1041\dexplore.ctm
- C:\users\all users\microsoft\search\data\applications\windows\mss00002.log
- C:\users\all users\microsoft\network\downloader\qmgr0.dat
- C:\users\all users\microsoft\msdn\7.0\3082\dexplore.ctm
- C:\users\all users\microsoft\msdn\7.0\2052\dexplore.ctm
- C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.hxd
- C:\users\all users\microsoft\msdn\7.0\1050\dexplore.ctm
- C:\users\all users\microsoft\search\data\applications\windows\mss.log
- C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasdlta.vdm
- C:\users\all users\microsoft\search\data\applications\windows\mss.chk
- C:\users\all users\microsoft\msdn\7.0\1040\dexplore.ctm
- C:\users\all users\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\cab1.cab
- C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\state.rsm
- C:\users\all users\microsoft\msdn\7.0\1036\dexplore.ctm
- C:\users\all users\microsoft\rac\statedata\racwmieventdata.dat
- C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh
- C:\users\all users\microsoft\msdn\7.0\1033\dexplore.ctm
- C:\users\all users\microsoft help\ms.winword.dev.14.1033.hxn
- C:\users\all users\microsoft help\nslist.hxl
- C:\users\all users\microsoft toolkit\settings.xml
- C:\users\all users\mozilla\logs\maintenanceservice-install.log
- C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\state.rsm
- C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm
- C:\users\all users\microsoft\search\data\applications\windows\mssres00001.jrs
- C:\users\all users\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- C:\users\all users\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\cab1.cab
- C:\users\all users\microsoft\office\uicaptions\1036\msointl.rest.trx_dll
- C:\users\all users\microsoft\office\uicaptions\1036\msointl.dll.trx_dll
- C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab
- C:\users\all users\microsoft\office\uicaptions\1036\mor6int.rest.trx_dll
- C:\users\all users\microsoft\office\uicaptions\1036\mapir.dll.trx_dll
- C:\users\all users\microsoft\office\uicaptions\1036\grintl32.rest.trx_dll
- C:\users\all users\microsoft\office\uicaptions\1036\grintl32.dll.trx_dll
- C:\users\all users\microsoft\office\sharepointteamsite.ico
- C:\users\all users\microsoft\office\uicaptions\1036\envelopr.dll.trx_dll
- C:\users\all users\microsoft\office\sharepointportalsite.ico
- C:\users\all users\microsoft\office\mysite.ico
- C:\users\all users\microsoft\office\mysharepoints.ico
- C:\users\all users\microsoft\office\documentrepository.ico
- C:\users\all users\microsoft\office\assetlibrary.ico
- C:\users\all users\microsoft\network\downloader\qmgr1.dat
- C:\users\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\windows6.1-kb2999226-x64.msu
- C:\users\all users\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\cab1.cab
- C:\users\all users\sun\java\java update\jaureglist.xml
- C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm
- C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\state.rsm
- C:\users\all users\mozilla\logs\maintenanceservice-uninstall.log
- C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\state.rsm
- C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1500820082.msp
- C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw
- C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini
- C:\users\all users\microsoft help\ms.msaccess.14.1033.hxn
- C:\users\all users\microsoft help\ms.infopatheditor.14.1033.hxn
- C:\users\all users\microsoft help\ms.infopath.14.1033.hxn
- C:\users\all users\microsoft help\ms.groove.14.1033.hxn
- C:\users\all users\microsoft help\ms.graph.14.1033.hxn
- C:\users\all users\microsoft help\ms.excel.dev.14.1033.hxn
- C:\users\all users\microsoft help\ms.excel.14.1033.hxn
- C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.hxd
- C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw
- C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_k.hxw
- C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_f.hxw
- C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_a.hxw
- C:\users\all users\microsoft help\ms.dexplore.hxn
- C:\users\all users\microsoft help\hx_1033_mvalidator.hxd
- C:\users\all users\microsoft help\hx_1033_mtoc_hx.hxh
- C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw
- C:\users\all users\microsoft help\hx_1033_mkwd_k.hxw
- C:\users\all users\microsoft help\hx.hxn
- C:\users\all users\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\cab1.cab
- C:\users\all users\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- C:\users\all users\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- C:\users\all users\adobe\arm\reader_15.007.20033\acrordrdcupd1500920077.msp
- C:\users\all users\microsoft\rac\publisheddata\racwmidatabase.sdf
- %LOCALAPPDATA%\readme_wdbmw6kx3i71.txt
- %APPDATA%\readme_wdbmw6kx3i71.txt
- C:\users\all users\microsoft help\ms.msaccess.dev.14.1033.hxn
- C:\users\all users\microsoft help\ms.msouc.14.1033.hxn
- C:\users\all users\microsoft help\ms.mspub.14.1033.hxn
- C:\users\all users\microsoft help\ms.mspub.dev.14.1033.hxn
- C:\users\all users\microsoft\msdn\7.0\1049\dexplore.ctm
- C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw
- C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw
- C:\users\all users\microsoft\msdn\7.0\1031\dexplore.ctm
- C:\users\all users\microsoft\msdn\7.0\1046\dexplore.ctm
- C:\users\all users\microsoft\msdn\7.0\1042\dexplore.ctm
- C:\users\all users\microsoft\rac\statedata\racwmidatabookmarks.dat
- C:\users\all users\microsoft\msdn\7.0\1028\dexplore.ctm
- C:\users\all users\microsoft\mf\pending.grl
- C:\users\all users\microsoft\mf\active.grl
- C:\users\all users\microsoft\ilscache\imcrcache.xml
- C:\users\all users\microsoft\dbgclr\7.1\1033\dbgclr.ctm
- C:\users\all users\microsoft\ilscache\ilrcache.xml
- C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm
- C:\users\all users\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- C:\users\all users\microsoft\rac\statedata\racdatabase.sdf
- C:\users\all users\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q
- C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d
- C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h
- C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w
- C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w
- C:\users\all users\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d
- C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw
- C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd
- C:\users\all users\microsoft help\ms.netframeworksdkv1.1.hxn
- C:\users\all users\microsoft help\ms.mstore.14.1033.hxn
- C:\users\all users\oracle\java\installcache_x64\baseimagefam8
- C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\state.rsm
Modifies user data files (Trojan.Encoder).
Network activity
TCP
- 'bi#.ly':443
UDP
- DNS ASK bi#.ly