Trojan.PWS.Siggen2.55505

Technical Information

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\login data
%APPDATA%\opera software\opera stable\login data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%TEMP%\_mei23482\536450151.exe.manifest
%TEMP%\_mei25282\_queue.pyd
%TEMP%\_mei25282\_socket.pyd
%TEMP%\_mei25282\_sqlite3.pyd
%TEMP%\_mei25282\_ssl.pyd
%TEMP%\_mei25282\_win32sysloader.pyd
%TEMP%\_mei25282\libcrypto-1_1.dll
%TEMP%\_mei25282\_lzma.pyd
%TEMP%\_mei25282\_multiprocessing.pyd
%TEMP%\_mei25282\libopenblas.noijjg62emaszi6nyurl6jbkm4evbgm7.gfortran-win_amd64.dll
%TEMP%\_mei25282\numpy\core\_multiarray_tests.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\core\_multiarray_umath.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\fft\_pocketfft_internal.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\linalg\_umath_linalg.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\linalg\lapack_lite.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\random\_bounded_integers.cp37-win_amd64.pyd
%TEMP%\_mei25282\libssl-1_1.dll
%TEMP%\_mei25282\mfc140u.dll
%TEMP%\_mei25282\numpy\random\_generator.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\random\_common.cp37-win_amd64.pyd
%TEMP%\_mei25282\_decimal.pyd
%TEMP%\_mei25282\crypto\hash\_ghash_portable.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_keccak.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_poly1305.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\math\_modexp.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\protocol\_scrypt.cp37-win_amd64.pyd
%TEMP%\_mei25282\_elementtree.pyd
%TEMP%\_mei25282\crypto\hash\_sha512.cp37-win_amd64.pyd
%TEMP%\_mei25282\_hashlib.pyd
%TEMP%\_mei25282\crypto\publickey\_ec_ws.cp37-win_amd64.pyd
%TEMP%\_mei25282\pil\_imagingtk.cp37-win_amd64.pyd
%TEMP%\_mei25282\pil\_webp.cp37-win_amd64.pyd
%TEMP%\_mei25282\vcruntime140.dll
%TEMP%\_mei25282\_bz2.pyd
%TEMP%\_mei25282\_ctypes.pyd
%TEMP%\_mei25282\crypto\util\_cpuid_c.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\util\_strxor.cp37-win_amd64.pyd
%TEMP%\_mei25282\pil\_imaging.cp37-win_amd64.pyd
%TEMP%\_mei23482\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei25282\numpy\random\_mt19937.cp37-win_amd64.pyd
%TEMP%\_mei25282\certifi\cacert.pem
%TEMP%\_mei25282\lib2to3\grammar3.7.6.final.0.pickle
%TEMP%\_mei25282\lib2to3\patterngrammar.txt
%TEMP%\_mei25282\lib2to3\patterngrammar3.7.6.final.0.pickle
%TEMP%\_mei25282\lib2to3\tests\data\readme
%TEMP%\ufmaxqek
%TEMP%\_mei25282\base_library.zip
nul
%TEMP%\_mei25282\lib2to3\grammar.txt
%LOCALAPPDATA%\tempinfo_xfbqlrbrmwn.db
%LOCALAPPDATA%\tempinfo_gfhysoeulxmjlegi.db
%LOCALAPPDATA%\tempinfo_opyxpyphppna.db
%LOCALAPPDATA%\tempinfo_tdnrjdequyc.db
%APPDATA%\testscreeeen.jpg
%APPDATA%\logs598938000.txt
%LOCALAPPDATA%\tempinfo_ktbcjspknmbtw.db
%TEMP%\_mei25282\include\pyconfig.h
%LOCALAPPDATA%\tempinfo_leuqlrwipmlkba.db
%TEMP%\_mei25282\win32wnet.pyd
%TEMP%\_mei25282\win32ui.pyd
%TEMP%\_mei25282\numpy\random\_philox.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\random\bit_generator.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\random\mtrand.cp37-win_amd64.pyd
%TEMP%\_mei25282\pyexpat.pyd
%TEMP%\_mei25282\python37.dll
%TEMP%\_mei25282\pythoncom37.dll
%TEMP%\_mei25282\pywintypes37.dll
%TEMP%\_mei25282\select.pyd
%TEMP%\_mei25282\numpy\random\_sfc64.cp37-win_amd64.pyd
%TEMP%\_mei25282\sqlite3.dll
%TEMP%\_mei25282\unicodedata.pyd
%TEMP%\_mei25282\win32api.pyd
%TEMP%\_mei25282\win32com\shell\shell.pyd
%TEMP%\_mei25282\win32gui.pyd
%TEMP%\_mei25282\win32pdh.pyd
%TEMP%\_mei25282\win32trace.pyd
%TEMP%\_mei25282\crypto\hash\_sha384.cp37-win_amd64.pyd
%TEMP%\_mei25282\stealer.exe.manifest
%TEMP%\_mei25282\crypto\hash\_ghash_clmul.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_sha256.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_sha224.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_sha1.cp37-win_amd64.pyd
%TEMP%\_mei23482\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei23482\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei23482\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei23482\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei23482\_bz2.pyd
%TEMP%\_mei23482\_hashlib.pyd
%TEMP%\_mei23482\_lzma.pyd
%TEMP%\_mei23482\_socket.pyd
%TEMP%\_mei23482\_ssl.pyd
%TEMP%\_mei23482\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei23482\vcruntime140.dll
%TEMP%\_mei23482\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei23482\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-errorhandling-l1-1-0.dll
%APPDATA%\598938000.zip
%TEMP%\_mei25282\numpy\random\_pcg64.cp37-win_amd64.pyd
%TEMP%\_mei23482\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei25282\crypto\cipher\_raw_cfb.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_ctr.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_des.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_des3.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_ecb.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_blowfish.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_eksblowfish.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_cbc.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_ofb.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_blake2s.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_md2.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_md4.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_md5.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_ripemd160.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_ocb.cp37-win_amd64.pyd
%TEMP%\_mei23482\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei25282\crypto\hash\_blake2b.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_cast.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_arc2.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_aesni.cp37-win_amd64.pyd
%TEMP%\_mei23482\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei23482\libcrypto-1_1.dll
%TEMP%\_mei23482\libssl-1_1.dll
%TEMP%\_mei23482\pyexpat.pyd
%TEMP%\_mei23482\python37.dll
%TEMP%\_mei23482\pywintypes37.dll
%TEMP%\_mei23482\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei23482\select.pyd
%TEMP%\_mei23482\unicodedata.pyd
%TEMP%\_mei23482\win32gui.pyd
%TEMP%\_mei23482\base_library.zip
%APPDATA%\msvreg.exe
%TEMP%\_mei25282\crypto\cipher\_arc4.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_salsa20.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_chacha20.cp37-win_amd64.pyd
%TEMP%\_mei23482\ucrtbase.dll
%TEMP%\_mei25282\crypto\cipher\_raw_aes.cp37-win_amd64.pyd
%TEMP%\_mei23482\api-ms-win-crt-stdio-l1-1-0.dll
%APPDATA%\del.bat

Deletes the following files

%TEMP%\ufmaxqek
%TEMP%\_mei25282\_ssl.pyd
%TEMP%\_mei25282\_win32sysloader.pyd
%TEMP%\_mei23482\536450151.exe.manifest
%TEMP%\_mei23482\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei25282\_sqlite3.pyd
%TEMP%\_mei25282\_socket.pyd
%TEMP%\_mei23482\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei23482\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei25282\select.pyd
%TEMP%\_mei23482\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei25282\win32trace.pyd
%TEMP%\_mei25282\stealer.exe.manifest
%TEMP%\_mei25282\unicodedata.pyd
%TEMP%\_mei25282\vcruntime140.dll
%TEMP%\_mei25282\win32api.pyd
%TEMP%\_mei25282\win32com\shell\shell.pyd
%TEMP%\_mei25282\win32gui.pyd
%TEMP%\_mei25282\_lzma.pyd
%TEMP%\_mei25282\_queue.pyd
%TEMP%\_mei25282\_multiprocessing.pyd
%TEMP%\_mei25282\win32wnet.pyd
%TEMP%\_mei25282\_bz2.pyd
%TEMP%\_mei25282\_ctypes.pyd
%TEMP%\_mei25282\_decimal.pyd
%TEMP%\_mei25282\_elementtree.pyd
%TEMP%\_mei25282\_hashlib.pyd
%TEMP%\_mei25282\win32pdh.pyd
%TEMP%\_mei25282\win32ui.pyd
%TEMP%\_mei25282\sqlite3.dll
%TEMP%\_mei23482\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei23482\base_library.zip
%TEMP%\_mei23482\libcrypto-1_1.dll
%TEMP%\_mei23482\libssl-1_1.dll
%TEMP%\_mei23482\pyexpat.pyd
%TEMP%\_mei23482\python37.dll
%TEMP%\_mei23482\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei23482\pywintypes37.dll
%TEMP%\_mei23482\unicodedata.pyd
%TEMP%\_mei23482\vcruntime140.dll
%TEMP%\_mei23482\win32gui.pyd
%TEMP%\_mei23482\_bz2.pyd
%TEMP%\_mei23482\_hashlib.pyd
%TEMP%\_mei23482\_lzma.pyd
%TEMP%\_mei23482\select.pyd
%TEMP%\_mei23482\ucrtbase.dll
%TEMP%\_mei23482\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei23482\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei23482\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei23482\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei25282\pywintypes37.dll
%TEMP%\_mei25282\pythoncom37.dll
%TEMP%\_mei25282\python37.dll
%TEMP%\_mei25282\crypto\cipher\_raw_ctr.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_des.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_des3.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_ecb.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_eksblowfish.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_ocb.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_cbc.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_md5.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_cast.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_blake2s.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_ghash_clmul.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_ghash_portable.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_keccak.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_md2.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_md4.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_salsa20.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_ofb.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_blake2b.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_arc2.cp37-win_amd64.pyd
%APPDATA%\msvreg.exe
%LOCALAPPDATA%\tempinfo_xfbqlrbrmwn.db
%LOCALAPPDATA%\tempinfo_leuqlrwipmlkba.db
%LOCALAPPDATA%\tempinfo_gfhysoeulxmjlegi.db
%LOCALAPPDATA%\tempinfo_opyxpyphppna.db
%LOCALAPPDATA%\tempinfo_tdnrjdequyc.db
%APPDATA%\logs598938000.txt
%TEMP%\_mei25282\crypto\cipher\_raw_blowfish.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_poly1305.cp37-win_amd64.pyd
%LOCALAPPDATA%\tempinfo_ktbcjspknmbtw.db
%TEMP%\_mei25282\base_library.zip
%TEMP%\_mei25282\certifi\cacert.pem
%TEMP%\_mei25282\crypto\cipher\_arc4.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_chacha20.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_aes.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\cipher\_raw_aesni.cp37-win_amd64.pyd
%APPDATA%\598938000.zip
%APPDATA%\testscreeeen.jpg
%TEMP%\_mei25282\crypto\cipher\_raw_cfb.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_ripemd160.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\fft\_pocketfft_internal.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\linalg\_umath_linalg.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\random\bit_generator.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\random\mtrand.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\random\_bounded_integers.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\random\_common.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\core\_multiarray_umath.cp37-win_amd64.pyd
%TEMP%\_mei25282\mfc140u.dll
%TEMP%\_mei25282\numpy\linalg\lapack_lite.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\random\_generator.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\random\_sfc64.cp37-win_amd64.pyd
%TEMP%\_mei25282\pil\_imaging.cp37-win_amd64.pyd
%TEMP%\_mei25282\pil\_imagingtk.cp37-win_amd64.pyd
%TEMP%\_mei25282\pil\_webp.cp37-win_amd64.pyd
%TEMP%\_mei25282\pyexpat.pyd
%TEMP%\_mei25282\numpy\random\_mt19937.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\random\_pcg64.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\random\_philox.cp37-win_amd64.pyd
%TEMP%\_mei25282\numpy\core\_multiarray_tests.cp37-win_amd64.pyd
%TEMP%\_mei25282\libssl-1_1.dll
%TEMP%\_mei25282\crypto\hash\_sha1.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_sha256.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_sha384.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_sha512.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\math\_modexp.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\protocol\_scrypt.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\publickey\_ec_ws.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\util\_cpuid_c.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\hash\_sha224.cp37-win_amd64.pyd
%TEMP%\_mei25282\crypto\util\_strxor.cp37-win_amd64.pyd
%TEMP%\_mei25282\lib2to3\grammar.txt
%TEMP%\_mei25282\lib2to3\grammar3.7.6.final.0.pickle
%TEMP%\_mei25282\lib2to3\patterngrammar.txt
%TEMP%\_mei25282\lib2to3\patterngrammar3.7.6.final.0.pickle
%TEMP%\_mei25282\lib2to3\tests\data\readme
%TEMP%\_mei25282\libcrypto-1_1.dll
%TEMP%\_mei25282\libopenblas.noijjg62emaszi6nyurl6jbkm4evbgm7.gfortran-win_amd64.dll
%TEMP%\_mei25282\include\pyconfig.h
%TEMP%\_mei23482\_socket.pyd
%TEMP%\_mei23482\_ssl.pyd

Network activity

TCP

'drive.google.com':443
'do#########ocs.googleusercontent.com':443
'ap#.##legram.org':443

UDP

DNS ASK drive.google.com
DNS ASK do#########ocs.googleusercontent.com
DNS ASK ap#.##legram.org

Miscellaneous

Searches for the following windows

ClassName: 'ConsoleWindowClass' WindowName: ''

Creates and executes the following

'%APPDATA%\msvreg.exe' GEZTSNBUGYYTMNRVHJAUCSCMKE2DI3JQIUYEMT3SNZLFM2LKL5BDQ32QMY4HE2DQJ5GDEOL2LE======/GUZTMNBVGAYTKMI=/GIYDEMBNGEYC2MJW -o_r y

Executes the following

'<SYSTEM32>\cmd.exe' /c %APPDATA%\msvreg.exe GEZTSNBUGYYTMNRVHJAUCSCMKE2DI3JQIUYEMT3SNZLFM2LKL5BDQ32QMY4HE2DQJ5GDEOL2LE======/GUZTMNBVGAYTKMI=/GIYDEMBNGEYC2MJW -o_r y
'<SYSTEM32>\cmd.exe' /c @chcp 65001 1>nul
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\cmd.exe' /c %APPDATA%\del.bat

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial