Technical Information
To ensure autorun and distribution
Infects the following executable files
- %ProgramFiles(x86)%\microsoft office\office16\powerpnt.exe
Modifies file system
Creates the following files
- %TEMP%\tcddd06.tmp\architecture.glox
- %TEMP%\tcdebe6.tmp\content.inf
- %TEMP%\tcdedbd.tmp\themepicturealternatingaccent.glox
- %TEMP%\tcdedbd.tmp\content.inf
- %TEMP%\tcdedce.tmp\content.inf
- %TEMP%\tcdedce.tmp\facet.thmx
- %TEMP%\tcdf003.tmp\content.inf
- %TEMP%\tcdf003.tmp\metropolitan.thmx
- %TEMP%\tcdf0b0.tmp\content.inf
- %TEMP%\tcdf0b0.tmp\frame.thmx
- %TEMP%\tcdf268.tmp\basis.thmx
- %TEMP%\tcdf268.tmp\content.inf
- %TEMP%\tcdf383.tmp\content.inf
- %TEMP%\tcdf383.tmp\dividend.thmx
- %TEMP%\tcdea3d.tmp\content.inf
- %TEMP%\tcdebe6.tmp\themepicturegrid.glox
- %TEMP%\tcdf819.tmp\content.inf
- %TEMP%\tcdf819.tmp\parallax.thmx
- %TEMP%\tcd1d05.tmp\mesh.thmx
- %TEMP%\tcd1d05.tmp\content.inf
- %TEMP%\tcd19f7.tmp\wood_type.thmx
- %TEMP%\tcd19f7.tmp\content.inf
- %TEMP%\tcd13cb.tmp\gallery.thmx
- %TEMP%\tcde71b.tmp\content.inf
- %TEMP%\tcd13cb.tmp\content.inf
- %TEMP%\tcdd2f.tmp\content.inf
- %TEMP%\tcdc73.tmp\savon.thmx
- %TEMP%\tcdc73.tmp\content.inf
- %TEMP%\tcd2db.tmp\content.inf
- %TEMP%\tcd2db.tmp\circuit.thmx
- %TEMP%\tcdf9ef.tmp\parcel.thmx
- %TEMP%\tcdf9ef.tmp\content.inf
- %TEMP%\tcdea3d.tmp\rings.glox
- %TEMP%\tcde971.tmp\content.inf
- %TEMP%\tcde971.tmp\banded.thmx
- %TEMP%\tcddf5e.tmp\hexagonradial.glox
- %TEMP%\tcddf5e.tmp\content.inf
- %TEMP%\tcde06a.tmp\pictureorgchart.glox
- %TEMP%\tcde06a.tmp\content.inf
- %TEMP%\tcde09a.tmp\content.inf
- %TEMP%\tcde09a.tmp\wisp.thmx
- %TEMP%\tcddf8e.tmp\circleprocess.glox
- %TEMP%\tcddf8e.tmp\content.inf
- %TEMP%\tcddd75.tmp\themepictureaccent.glox
- %TEMP%\tcddd75.tmp\content.inf
- %TEMP%\tcde09b.tmp\bracketlist.glox
- %TEMP%\tcde09b.tmp\content.inf
- %TEMP%\tcde2bf.tmp\pictureframe.glox
- %TEMP%\tcde2bf.tmp\content.inf
- %TEMP%\tcddd06.tmp\content.inf
- %TEMP%\tcde2ff.tmp\varyingwidthlist.glox
- %TEMP%\tcde875.tmp\content.inf
- %TEMP%\tcde2ff.tmp\content.inf
- %TEMP%\tcde3cb.tmp\tabbedarc.glox
- %TEMP%\tcde3cb.tmp\content.inf
- %TEMP%\tcde3db.tmp\interconnectedblockprocess.glox
- %TEMP%\tcde3db.tmp\content.inf
- %TEMP%\tcde4e6.tmp\radialpicturelist.glox
- %TEMP%\tcdd2f.tmp\quotable.thmx
- %TEMP%\tcde4e6.tmp\content.inf
- %TEMP%\tcd1d35.tmp\content.inf
- %TEMP%\tcde71a.tmp\content.inf
- %TEMP%\tcde71b.tmp\view.thmx
- %TEMP%\tcde74b.tmp\convergingtext.glox
- %TEMP%\tcde74b.tmp\content.inf
- %TEMP%\tcde875.tmp\chevronaccent.glox
- %TEMP%\tcde71a.tmp\tablist.glox
- %TEMP%\tcd1d35.tmp\droplet.thmx
Moves the following files
- from %TEMP%\tcddf5e.tmp\hexagonradial.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328919[[fn=hexagon radial]].glox
- from %TEMP%\tcdebe6.tmp\themepicturegrid.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328986[[fn=theme picture grid]].glox
- from %TEMP%\tcdedbd.tmp\themepicturealternatingaccent.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328983[[fn=theme picture alternating accent]].glox
- from %TEMP%\tcdedce.tmp\facet.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm02900688[[fn=facet]].thmx
- from %TEMP%\tcdf003.tmp\metropolitan.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457491[[fn=metropolitan]].thmx
- from %TEMP%\tcdf0b0.tmp\frame.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457475[[fn=frame]].thmx
- from %TEMP%\tcdf268.tmp\basis.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457444[[fn=basis]].thmx
- from %TEMP%\tcdf819.tmp\parallax.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457496[[fn=parallax]].thmx
- from %TEMP%\tcde2ff.tmp\varyingwidthlist.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328990[[fn=varying width list]].glox
- from %TEMP%\tcdf9ef.tmp\parcel.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001115[[fn=parcel]].thmx
- from %TEMP%\tcd2db.tmp\circuit.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033919[[fn=circuit]].thmx
- from %TEMP%\tcdc73.tmp\savon.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457510[[fn=savon]].thmx
- from %TEMP%\tcdd2f.tmp\quotable.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457503[[fn=quotable]].thmx
- from %TEMP%\tcd13cb.tmp\gallery.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001114[[fn=gallery]].thmx
- from %TEMP%\tcd19f7.tmp\wood_type.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090434[[fn=wood type]].thmx
- from %TEMP%\tcdea3d.tmp\rings.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328998[[fn=rings]].glox
- from %TEMP%\tcde971.tmp\banded.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090430[[fn=banded]].thmx
- from %TEMP%\tcde875.tmp\chevronaccent.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328905[[fn=chevron accent]].glox
- from %TEMP%\tcde71b.tmp\view.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457515[[fn=view]].thmx
- from %TEMP%\tcde74b.tmp\convergingtext.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328916[[fn=converging text]].glox
- from %TEMP%\tcde71a.tmp\tablist.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328972[[fn=tab list]].glox
- from %TEMP%\tcde4e6.tmp\radialpicturelist.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328940[[fn=radial picture list]].glox
- from %TEMP%\tcde3db.tmp\interconnectedblockprocess.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328925[[fn=interconnected block process]].glox
- from %TEMP%\tcde3cb.tmp\tabbedarc.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328951[[fn=tabbed arc]].glox
- from %TEMP%\tcdf383.tmp\dividend.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457464[[fn=dividend]].thmx
- from %TEMP%\tcde2bf.tmp\pictureframe.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328932[[fn=picture frame]].glox
- from %TEMP%\tcde09b.tmp\bracketlist.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328893[[fn=bracketlist]].glox
- from %TEMP%\tcddd06.tmp\architecture.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328884[[fn=architecture]].glox
- from %TEMP%\tcddd75.tmp\themepictureaccent.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328975[[fn=theme picture accent]].glox
- from %TEMP%\tcde09a.tmp\wisp.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm02892315[[fn=wisp]].thmx
- from %TEMP%\tcddf8e.tmp\circleprocess.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328908[[fn=circle process]].glox
- from %TEMP%\tcde06a.tmp\pictureorgchart.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328935[[fn=picture organization chart]].glox
- from %TEMP%\tcd1d35.tmp\droplet.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033925[[fn=droplet]].thmx
- from %TEMP%\tcd1d05.tmp\mesh.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457485[[fn=mesh]].thmx
Network activity
Connects to
- 'me######.#emplates.cdn.office.net':443
- 'bi######.#emplates.cdn.office.net':443
TCP
Other
- 'me######.#emplates.cdn.office.net':443
- 'bi######.#emplates.cdn.office.net':443
UDP
- DNS ASK me######.#emplates.cdn.office.net
- DNS ASK bi######.#emplates.cdn.office.net
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
