P98M.Downloader.72

Technical Information

To ensure autorun and distribution

Infects the following executable files

%ProgramFiles(x86)%\microsoft office\office16\powerpnt.exe

Modifies file system

Creates the following files

%TEMP%\tcdbc06.tmp\convergingtext.glox
%TEMP%\tcdc5fa.tmp\tabbedarc.glox
%TEMP%\tcdc5fa.tmp\content.inf
%TEMP%\tcdc7a2.tmp\themepicturealternatingaccent.glox
%TEMP%\tcdc7a2.tmp\content.inf
%TEMP%\tcdc801.tmp\tablist.glox
%TEMP%\tcdc801.tmp\content.inf
%TEMP%\tcdc821.tmp\rings.glox
%TEMP%\tcdc821.tmp\content.inf
%TEMP%\tcdcc59.tmp\content.inf
%TEMP%\tcdcc59.tmp\dividend.thmx
%TEMP%\tcdbd52.tmp\content.inf
%TEMP%\tcdd072.tmp\content.inf
%TEMP%\tcdd6dd.tmp\basis.thmx
%TEMP%\tcdd6dd.tmp\content.inf
%TEMP%\tcdda59.tmp\content.inf
%TEMP%\tcdda59.tmp\frame.thmx
%TEMP%\tcde45e.tmp\content.inf
%TEMP%\tcde45e.tmp\metropolitan.thmx
%TEMP%\tcde6a2.tmp\content.inf
%TEMP%\tcde6a2.tmp\view.thmx
%TEMP%\tcde944.tmp\content.inf
%TEMP%\tcde944.tmp\facet.thmx
%TEMP%\tcdc4fe.tmp\themepictureaccent.glox
%TEMP%\tcdc4fe.tmp\content.inf
%TEMP%\tcdc3b2.tmp\content.inf
%TEMP%\tcdc3b2.tmp\chevronaccent.glox
%TEMP%\tcdc074.tmp\content.inf
%TEMP%\tcdbc07.tmp\hexagonradial.glox
%TEMP%\tcdbc07.tmp\content.inf
%TEMP%\tcdba8b.tmp\circleprocess.glox
%TEMP%\tcdba8b.tmp\content.inf
%TEMP%\tcdbc94.tmp\content.inf
%TEMP%\tcdbc94.tmp\wisp.thmx
%TEMP%\tcdbafa.tmp\architecture.glox
%TEMP%\tcdbafa.tmp\content.inf
%TEMP%\tcdbc95.tmp\bracketlist.glox
%TEMP%\tcdbc95.tmp\content.inf
%TEMP%\tcdf02b.tmp\content.inf
%TEMP%\tcdd072.tmp\wood_type.thmx
%TEMP%\tcdbd52.tmp\interconnectedblockprocess.glox
%TEMP%\tcdbd63.tmp\content.inf
%TEMP%\tcdbefb.tmp\varyingwidthlist.glox
%TEMP%\tcdbefb.tmp\content.inf
%TEMP%\tcdbada.tmp\radialpicturelist.glox
%TEMP%\tcdbbc6.tmp\pictureframe.glox
%TEMP%\tcdbbc6.tmp\content.inf
%TEMP%\tcdbada.tmp\content.inf
%TEMP%\tcdbd83.tmp\themepicturegrid.glox
%TEMP%\tcdbd83.tmp\content.inf
%TEMP%\tcdc074.tmp\banded.thmx
%TEMP%\tcdbc06.tmp\content.inf
%TEMP%\tcdbd63.tmp\pictureorgchart.glox
%TEMP%\tcdf02b.tmp\parcel.thmx

Moves the following files

from %TEMP%\tcdbc06.tmp\convergingtext.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328916[[fn=converging text]].glox
from %TEMP%\tcde6a2.tmp\view.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457515[[fn=view]].thmx
from %TEMP%\tcde45e.tmp\metropolitan.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457491[[fn=metropolitan]].thmx
from %TEMP%\tcdda59.tmp\frame.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457475[[fn=frame]].thmx
from %TEMP%\tcdd6dd.tmp\basis.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457444[[fn=basis]].thmx
from %TEMP%\tcdd072.tmp\wood_type.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090434[[fn=wood type]].thmx
from %TEMP%\tcdcc59.tmp\dividend.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457464[[fn=dividend]].thmx
from %TEMP%\tcdc821.tmp\rings.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328998[[fn=rings]].glox
from %TEMP%\tcdc801.tmp\tablist.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328972[[fn=tab list]].glox
from %TEMP%\tcdc7a2.tmp\themepicturealternatingaccent.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328983[[fn=theme picture alternating accent]].glox
from %TEMP%\tcdc5fa.tmp\tabbedarc.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328951[[fn=tabbed arc]].glox
from %TEMP%\tcdc4fe.tmp\themepictureaccent.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328975[[fn=theme picture accent]].glox
from %TEMP%\tcde944.tmp\facet.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm02900688[[fn=facet]].thmx
from %TEMP%\tcdc3b2.tmp\chevronaccent.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328905[[fn=chevron accent]].glox
from %TEMP%\tcdbd83.tmp\themepicturegrid.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328986[[fn=theme picture grid]].glox
from %TEMP%\tcdbada.tmp\radialpicturelist.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328940[[fn=radial picture list]].glox
from %TEMP%\tcdbbc6.tmp\pictureframe.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328932[[fn=picture frame]].glox
from %TEMP%\tcdbefb.tmp\varyingwidthlist.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328990[[fn=varying width list]].glox
from %TEMP%\tcdbd63.tmp\pictureorgchart.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328935[[fn=picture organization chart]].glox
from %TEMP%\tcdbd52.tmp\interconnectedblockprocess.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328925[[fn=interconnected block process]].glox
from %TEMP%\tcdbc95.tmp\bracketlist.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328893[[fn=bracketlist]].glox
from %TEMP%\tcdbafa.tmp\architecture.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328884[[fn=architecture]].glox
from %TEMP%\tcdbc94.tmp\wisp.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm02892315[[fn=wisp]].thmx
from %TEMP%\tcdba8b.tmp\circleprocess.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328908[[fn=circle process]].glox
from %TEMP%\tcdbc07.tmp\hexagonradial.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328919[[fn=hexagon radial]].glox
from %TEMP%\tcdc074.tmp\banded.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090430[[fn=banded]].thmx
from %TEMP%\tcdf02b.tmp\parcel.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001115[[fn=parcel]].thmx