Technical Information
Modifies file system
Creates the following files
- %WINDIR%\ah.exe
Modifies the following files
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\coffee.bmp
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
- C:\kms\kms_vl_all_aio_debug.log
- C:\kms\kms_vl_all_aio.cmd
- C:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- D:\install.log
- D:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\contosoroot_1.cer
Modifies multiple files.
Substitutes the following executable files
- C:\msocache\all users\{90140000-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa
- C:\msocache\all users\{90140000-dddddddddddddddddddddddddddddddddddd.ddd
- C:\msocache\all users\{90140000-eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee
- C:\msocache\all users\{90140000-ffffffffffffffffffffffffffffffffffff.fff
- C:\msocache\all users\{90140000-gggggggggggggggggggggggggggggggggggg.ggg
- C:\msocache\all users\{90140000-hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh
- C:\msocache\all users\{90140000-iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii
- C:\msocache\all users\{90140000-jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj
- C:\msocache\all users\{90140000-kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk
- C:\msocache\all users\{90140000-llllllllllllllllllllllllllllllllllll.lll
- C:\msocache\all users\{90140000-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb
- C:\msocache\all users\{90140000-cccccccccccccccccccccccccccccccccccc.ccc
- C:\msocache\all users\{90140000-mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm
- C:\msocache\all users\{90140000-pppppppppppppppppppppppppppppppppppp.ppp
- C:\msocache\all users\{90140000-qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq
- C:\msocache\all users\{90140000-rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr
- C:\msocache\all users\{90140000-ssssssssssssssssssssssssssssssssssss.sss
- C:\msocache\all users\{90140000-tttttttttttttttttttttttttttttttttttt.ttt
- C:\msocache\all users\{90140000-uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu
- C:\msocache\all users\{90140000-vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv
- C:\msocache\all users\{90140000-wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www
- C:\msocache\all users\{90140000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx
- C:\msocache\all users\{90140000-nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn
- C:\msocache\all users\{90140000-oooooooooooooooooooooooooooooooooooo.ooo
- C:\msocache\all users\{90140000-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa
- C:\msocache\all users\{90140000-zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
- C:\msocache\all users\{90140000-yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy
- C:\msocache\all users\{90140000-cccccccccccccccccccccccccccccccccccccc.ccc
- C:\msocache\all users\{90140000-dddddddddddddddddddddddddddddddddddddd.ddd
- C:\msocache\all users\{90140000-eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee
- C:\msocache\all users\{90140000-ffffffffffffffffffffffffffffffffffffff.fff
- C:\msocache\all users\{90140000-gggggggggggggggggggggggggggggggggggggg.ggg
- C:\msocache\all users\{90140000-hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh
- C:\msocache\all users\{90140000-iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii
- C:\msocache\all users\{90140000-jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj
- C:\msocache\all users\{90140000-kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk
- C:\msocache\all users\{90140000-llllllllllllllllllllllllllllllllllllll.lll
- C:\msocache\all users\{90140000-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb
- C:\msocache\all users\{90140000-mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm
- C:\msocache\all users\{90140000-oooooooooooooooooooooooooooooooooooooo.ooo
- C:\msocache\all users\{90140000-pppppppppppppppppppppppppppppppppppppp.ppp
- C:\msocache\all users\{90140000-qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq
- C:\msocache\all users\{90140000-rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr
- C:\msocache\all users\{90140000-ssssssssssssssssssssssssssssssssssssss.sss
- C:\msocache\all users\{90140000-tttttttttttttttttttttttttttttttttttttt.ttt
- C:\msocache\all users\{90140000-uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu
- C:\msocache\all users\{90140000-vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv
- C:\msocache\all users\{90140000-wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www
- C:\msocache\all users\{90140000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx
- C:\msocache\all users\{90140000-nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn
- C:\msocache\all users\{90140000-yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy
- C:\msocache\all users\{90140000-zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
Substitutes the following files
- C:\msocache\all users\{90140000-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa
- C:\msocache\all users\{90140000-nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn
- C:\msocache\all users\{90140000-oooooooooooooooooooooooooooooooooooo.ooo
- C:\msocache\all users\{90140000-pppppppppppppppppppppppppppppppppppp.ppp
- C:\msocache\all users\{90140000-qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq
- C:\msocache\all users\{90140000-rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr
- C:\msocache\all users\{90140000-ssssssssssssssssssssssssssssssssssss.sss
- C:\msocache\all users\{90140000-tttttttttttttttttttttttttttttttttttt.ttt
- C:\msocache\all users\{90140000-llllllllllllllllllllllllllllllllllll.lll
- C:\msocache\all users\{90140000-mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm
- C:\msocache\all users\{90140000-uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu
- C:\msocache\all users\{90140000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx
- C:\msocache\all users\{90140000-yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy
- C:\msocache\all users\{90140000-zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
- C:\msocache\all users\{90140000-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa
- C:\msocache\all users\{90140000-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb
- C:\msocache\all users\{90140000-cccccccccccccccccccccccccccccccccccccccccccc.ccc
- C:\msocache\all users\{90140000-dddddddddddddddddddddddddddddddddddddddddddd.ddd
- C:\msocache\all users\{90140000-vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv
- C:\msocache\all users\{90140000-wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www
- C:\msocache\all users\{90140000-kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk
- C:\msocache\all users\{90140000-iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii
- C:\msocache\all users\{90140000-ffffffffffffffffffffffffffffffffffffffffffff.fff
- C:\msocache\all users\{90140000-rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr
- C:\msocache\all users\{90140000-ssssssssssssssssssssssssssssssssssssss.sss
- C:\msocache\all users\{90140000-tttttttttttttttttttttttttttttttttttttt.ttt
- C:\msocache\all users\{90140000-uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu
- C:\msocache\all users\{90140000-vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv
- C:\msocache\all users\{90140000-wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www
- C:\msocache\all users\{90140000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx
- C:\msocache\all users\{90140000-yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy
- C:\msocache\all users\{90140000-zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
- C:\msocache\all users\{90140000-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa
- C:\msocache\all users\{90140000-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb
- C:\msocache\all users\{90140000-cccccccccccccccccccccccccccccccccccc.ccc
- C:\msocache\all users\{90140000-dddddddddddddddddddddddddddddddddddd.ddd
- C:\msocache\all users\{90140000-eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee
- C:\msocache\all users\{90140000-ffffffffffffffffffffffffffffffffffff.fff
- C:\msocache\all users\{90140000-gggggggggggggggggggggggggggggggggggg.ggg
- C:\msocache\all users\{90140000-hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh
- C:\msocache\all users\{90140000-eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee
- C:\msocache\all users\{90140000-pppppppppppppppppppppppppppppppppppppp.ppp
- C:\msocache\all users\{90140000-jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj
- C:\msocache\all users\{90140000-ppppppppppppppppppppppppppppppppppppppp.ppp
- C:\msocache\all users\{90140000-gggggggggggggggggggggggggggggggggggggggggggg.ggg
- C:\msocache\all users\{90140000-fffffffffffffffffffffffffffffffffffffffffff.fff
- C:\msocache\all users\{90140000-ggggggggggggggggggggggggggggggggggggggggggg.ggg
- C:\msocache\all users\{90140000-hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh
- C:\msocache\all users\{90140000-iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii
- C:\msocache\all users\{90140000-jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj
- C:\msocache\all users\{90140000-kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk
- C:\msocache\all users\{90140000-lllllllllllllllllllllllllllllllllllllllllll.lll
- C:\msocache\all users\{90140000-mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm
- C:\msocache\all users\{90140000-nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn
- C:\msocache\all users\{90140000-ooooooooooooooooooooooooooooooooooooooooooo.ooo
- C:\msocache\all users\{90140000-ppppppppppppppppppppppppppppppppppppppppppp.ppp
- C:\msocache\all users\{90140000-qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq
- C:\msocache\all users\{90140000-rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr
- C:\msocache\all users\{90140000-sssssssssssssssssssssssssssssssssssssssssss.sss
- C:\msocache\all users\{90140000-ttttttttttttttttttttttttttttttttttttttttttt.ttt
- C:\msocache\all users\{90140000-uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu
- C:\msocache\all users\{90140000-vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv
- C:\msocache\all users\{90140000-wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www
- C:\msocache\all users\{90140000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx
- C:\msocache\all users\{90140000-eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee
- C:\msocache\all users\{90140000-oooooooooooooooooooooooooooooooooooooo.ooo
- C:\msocache\all users\{90140000-qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq
- C:\msocache\all users\{90140000-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb
- C:\msocache\all users\{90140000-iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii
- C:\msocache\all users\{90140000-jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj
- C:\msocache\all users\{90140000-kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk
- C:\msocache\all users\{90140000-llllllllllllllllllllllllllllllllllllllllllll.lll
- C:\msocache\all users\{90140000-mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm
- C:\msocache\all users\{90140000-nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn
- C:\msocache\all users\{90140000-oooooooooooooooooooooooooooooooooooooooooooo.ooo
- C:\msocache\all users\{90140000-pppppppppppppppppppppppppppppppppppppppppppp.ppp
- C:\msocache\all users\{90140000-qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq
- C:\msocache\all users\{90140000-rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr
- C:\msocache\all users\{90140000-ssssssssssssssssssssssssssssssssssssssssssss.sss
- C:\msocache\all users\{90140000-tttttttttttttttttttttttttttttttttttttttttttt.ttt
- C:\msocache\all users\{90140000-uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu
- C:\msocache\all users\{90140000-vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv
- C:\msocache\all users\{90140000-wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www
- C:\msocache\all users\{90140000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx
- C:\msocache\all users\{90140000-yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy
- C:\msocache\all users\{90140000-zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
- C:\msocache\all users\{90140000-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa
- C:\msocache\all users\{90140000-ccccccccccccccccccccccccccccccccccccccccccc.ccc
- C:\msocache\all users\{90140000-hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh
- C:\msocache\all users\{90140000-nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn
- C:\msocache\all users\{90140000-mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm
- C:\msocache\all users\{90140000-llllllllllllllllllllllllllllllllllllll.lll
- C:\msocache\all users\{90140000-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa
- C:\msocache\all users\{90140000-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb
- C:\msocache\all users\{90140000-cccccccccccccccccccccccccccccccccccccccc.ccc
- C:\msocache\all users\{90140000-dddddddddddddddddddddddddddddddddddddddd.ddd
- C:\msocache\all users\{90140000-eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee
- C:\msocache\all users\{90140000-ffffffffffffffffffffffffffffffffffffffff.fff
- C:\msocache\all users\{90140000-gggggggggggggggggggggggggggggggggggggggg.ggg
- C:\msocache\all users\{90140000-hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh
- C:\msocache\all users\{90140000-iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii
- C:\msocache\all users\{90140000-jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj
- C:\msocache\all users\{90140000-kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk
- C:\msocache\all users\{90140000-llllllllllllllllllllllllllllllllllllllll.lll
- C:\msocache\all users\{90140000-mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm
- C:\msocache\all users\{90140000-nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn
- C:\msocache\all users\{90140000-oooooooooooooooooooooooooooooooooooooooo.ooo
- C:\msocache\all users\{90140000-pppppppppppppppppppppppppppppppppppppppp.ppp
- C:\msocache\all users\{90140000-qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq
- C:\msocache\all users\{90140000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx
- C:\msocache\all users\{90140000-vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv
- C:\msocache\all users\{90140000-zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
- C:\msocache\all users\{90140000-yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy
- C:\msocache\all users\{90140000-rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr
- C:\msocache\all users\{90140000-uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu
- C:\msocache\all users\{90140000-ccccccccccccccccccccccccccccccccccccccccc.ccc
- C:\msocache\all users\{90140000-ddddddddddddddddddddddddddddddddddddddddd.ddd
- C:\msocache\all users\{90140000-eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee
- C:\msocache\all users\{90140000-fffffffffffffffffffffffffffffffffffffffff.fff
- C:\msocache\all users\{90140000-ggggggggggggggggggggggggggggggggggggggggg.ggg
- C:\msocache\all users\{90140000-hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh
- C:\msocache\all users\{90140000-iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii
- C:\msocache\all users\{90140000-jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj
- C:\msocache\all users\{90140000-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb
- C:\msocache\all users\{90140000-kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk
- C:\msocache\all users\{90140000-mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm
- C:\msocache\all users\{90140000-nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn
- C:\msocache\all users\{90140000-ooooooooooooooooooooooooooooooooooooooooo.ooo
- C:\msocache\all users\{90140000-ppppppppppppppppppppppppppppppppppppppppp.ppp
- C:\msocache\all users\{90140000-qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq
- C:\msocache\all users\{90140000-rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr
- C:\msocache\all users\{90140000-sssssssssssssssssssssssssssssssssssssssss.sss
- C:\msocache\all users\{90140000-ttttttttttttttttttttttttttttttttttttttttt.ttt
- C:\msocache\all users\{90140000-lllllllllllllllllllllllllllllllllllllllll.lll
- C:\msocache\all users\{90140000-wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www
- C:\msocache\all users\{90140000-ddddddddddddddddddddddddddddddddddddddddddd.ddd
- C:\msocache\all users\{90140000-ssssssssssssssssssssssssssssssssssssssss.sss
- C:\msocache\all users\{90140000-vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv
- C:\msocache\all users\{90140000-ttttttttttttttttttttttttttttttttttttttt.ttt
- C:\msocache\all users\{90140000-uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu
- C:\msocache\all users\{90140000-vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv
- C:\msocache\all users\{90140000-wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www
- C:\msocache\all users\{90140000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx
- C:\msocache\all users\{90140000-yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy
- C:\msocache\all users\{90140000-zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
- C:\msocache\all users\{90140000-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa
- C:\msocache\all users\{90140000-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb
- C:\msocache\all users\{90140000-cccccccccccccccccccccccccccccccccccccc.ccc
- C:\msocache\all users\{90140000-dddddddddddddddddddddddddddddddddddddd.ddd
- C:\msocache\all users\{90140000-eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee
- C:\msocache\all users\{90140000-ffffffffffffffffffffffffffffffffffffff.fff
- C:\msocache\all users\{90140000-gggggggggggggggggggggggggggggggggggggg.ggg
- C:\msocache\all users\{90140000-hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh
- C:\msocache\all users\{90140000-iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii
- C:\msocache\all users\{90140000-jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj
- C:\msocache\all users\{90140000-kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk
- C:\msocache\all users\{90140000-tttttttttttttttttttttttttttttttttttttttt.ttt
- C:\msocache\all users\{90140000-sssssssssssssssssssssssssssssssssssssss.sss
- C:\msocache\all users\{90140000-uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu
- C:\msocache\all users\{90140000-rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr
- C:\msocache\all users\{90140000-yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy
- C:\msocache\all users\{90140000-wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www
- C:\msocache\all users\{90140000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx
- C:\msocache\all users\{90140000-yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy
- C:\msocache\all users\{90140000-zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
- C:\msocache\all users\{90140000-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa
- C:\msocache\all users\{90140000-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb
- C:\msocache\all users\{90140000-ccccccccccccccccccccccccccccccccccccccc.ccc
- C:\msocache\all users\{90140000-ddddddddddddddddddddddddddddddddddddddd.ddd
- C:\msocache\all users\{90140000-eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee
- C:\msocache\all users\{90140000-fffffffffffffffffffffffffffffffffffffff.fff
- C:\msocache\all users\{90140000-ggggggggggggggggggggggggggggggggggggggg.ggg
- C:\msocache\all users\{90140000-hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh
- C:\msocache\all users\{90140000-iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii
- C:\msocache\all users\{90140000-jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj
- C:\msocache\all users\{90140000-kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk
- C:\msocache\all users\{90140000-lllllllllllllllllllllllllllllllllllllll.lll
- C:\msocache\all users\{90140000-mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm
- C:\msocache\all users\{90140000-nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn
- C:\msocache\all users\{90140000-ooooooooooooooooooooooooooooooooooooooo.ooo
- C:\msocache\all users\{90140000-qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq
- C:\msocache\all users\{90140000-zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
Moves itself
- from <Full path to file> to C:\aqxaaaaaaaaaaaaa.aaa
- from C:\aqxwwwwwwwwwwwww.www to C:\aqxxxxxxxxxxxxxx.xxx
- from C:\aqxvvvvvvvvvvvvv.vvv to C:\aqxwwwwwwwwwwwww.www
- from C:\aqxuuuuuuuuuuuuu.uuu to C:\aqxvvvvvvvvvvvvv.vvv
- from C:\aqxttttttttttttt.ttt to C:\aqxuuuuuuuuuuuuu.uuu
- from C:\aqxsssssssssssss.sss to C:\aqxttttttttttttt.ttt
- from C:\aqxrrrrrrrrrrrrr.rrr to C:\aqxsssssssssssss.sss
- from C:\aqxqqqqqqqqqqqqq.qqq to C:\aqxrrrrrrrrrrrrr.rrr
- from C:\aqxppppppppppppp.ppp to C:\aqxqqqqqqqqqqqqq.qqq
- from C:\aqxooooooooooooo.ooo to C:\aqxppppppppppppp.ppp
- from C:\aqxnnnnnnnnnnnnn.nnn to C:\aqxooooooooooooo.ooo
- from C:\aqxmmmmmmmmmmmmm.mmm to C:\aqxnnnnnnnnnnnnn.nnn
- from C:\aqxlllllllllllll.lll to C:\aqxmmmmmmmmmmmmm.mmm
- from C:\aqxkkkkkkkkkkkkk.kkk to C:\aqxlllllllllllll.lll
- from C:\aqxjjjjjjjjjjjjj.jjj to C:\aqxkkkkkkkkkkkkk.kkk
- from C:\aqxiiiiiiiiiiiii.iii to C:\aqxjjjjjjjjjjjjj.jjj
- from C:\aqxhhhhhhhhhhhhh.hhh to C:\aqxiiiiiiiiiiiii.iii
- from C:\aqxggggggggggggg.ggg to C:\aqxhhhhhhhhhhhhh.hhh
- from C:\aqxfffffffffffff.fff to C:\aqxggggggggggggg.ggg
- from C:\aqxeeeeeeeeeeeee.eee to C:\aqxfffffffffffff.fff
- from C:\aqxddddddddddddd.ddd to C:\aqxeeeeeeeeeeeee.eee
- from C:\aqxccccccccccccc.ccc to C:\aqxddddddddddddd.ddd
- from C:\aqxbbbbbbbbbbbbb.bbb to C:\aqxccccccccccccc.ccc
- from C:\aqxaaaaaaaaaaaaa.aaa to C:\aqxbbbbbbbbbbbbb.bbb
- from C:\aqxxxxxxxxxxxxxx.xxx to C:\aqxyyyyyyyyyyyyy.yyy
- from C:\aqxyyyyyyyyyyyyy.yyy to C:\aqxzzzzzzzzzzzzz.zzz
Deletes itself.
Modifies user data files (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\ah.exe' -accepteula -r -s -q c:\*
- '%WINDIR%\ah.exe' -accepteula -r -s -q z:\*
- '%WINDIR%\ah.exe' -accepteula -r -s -q e:\*
- '%WINDIR%\ah.exe' -accepteula -r -s -q d:\*
- '%WINDIR%\ah.exe' -accepteula -r -s -q i:\*
- '%WINDIR%\ah.exe' -accepteula -r -s -q <Drive name for removable media>:\*
- '%WINDIR%\ah.exe' -accepteula -r -s -q g:\*
- '%WINDIR%\ah.exe' -accepteula -r -s -q h:\*
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q c:\* & taskkill /f /im exp* "' (with hidden window)
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q z:\* "' (with hidden window)
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q i:\* "' (with hidden window)
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q h:\* "' (with hidden window)
- '<SYSTEM32>\cmd.exe' "<SYSTEM32>\takeown.exe /F <SYSTEM32>\*skm*.exe & <SYSTEM32>\icacls.exe <SYSTEM32>\*skm*.exe /deny *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q d:\* "' (with hidden window)
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q e:\* "' (with hidden window)
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q <Drive name for removable media>:\* "' (with hidden window)
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q g:\* "' (with hidden window)
- '<SYSTEM32>\cmd.exe' "<SYSTEM32>\takeown.exe /F <SYSTEM32>\*log*exe & <SYSTEM32>\icacls.exe <SYSTEM32>\*log*exe /deny *S-1-1-0:F & <SYSTEM32>\takeown.exe /F <SYSTEM32>\*log*exe /A"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' "<SYSTEM32>\takeown.exe /F <SYSTEM32>\*log*exe & <SYSTEM32>\icacls.exe <SYSTEM32>\*log*exe /deny *S-1-1-0:F & <SYSTEM32>\takeown.exe /F <SYSTEM32>\*log*exe /A"
- '<SYSTEM32>\cmd.exe' "<SYSTEM32>\takeown.exe /F <SYSTEM32>\*skm*.exe & <SYSTEM32>\icacls.exe <SYSTEM32>\*skm*.exe /deny *S-1-1-0:F"
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q e:\* "
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q d:\* "
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q g:\* "
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q <Drive name for removable media>:\* "
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q i:\* "
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q z:\* "
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q h:\* "
- '<SYSTEM32>\takeown.exe' /F <SYSTEM32>\*log*exe
- '<SYSTEM32>\takeown.exe' /F <SYSTEM32>\*skm*.exe
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\*skm*.exe /deny *S-1-1-0:F
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\*log*exe /deny *S-1-1-0:F
- '<SYSTEM32>\takeown.exe' /F <SYSTEM32>\*log*exe /A
- '<SYSTEM32>\cmd.exe' "%WINDIR%\ah.exe -accepteula -r -s -q c:\* & taskkill /f /im exp* "