It collects open ports on the victim host by running the netstat command - It lists all the running processes - It lists available services on the system - It exfiltrates .ppt and .pptx file, in addition to the extension mentioned in the G1 variant - If a USB key is connected on the system, the malware steals the file based on an extension list - It supports file encryption (AES with the key "lolomycin2017") - It collects information on the account (account type, description, domain name, full name, SID and status) - It checks if the system is a virtual machine with several techniques