ScreenCapture: It takes screenshots of the infected machine - Download Secondary Payloads: It downloads additional plugins and other malware - Enterprise-aware: It targets administrators and enterprises networks - Infiltrates the Exchange Server: It collects and steal sensitive information from the Microsoft Exchange mail system, including credentials and the domain certificate