Trojan.Inject5.6668

Technical Information

Malicious functions

Injects code into

the following user processes:

setup2.exe

Modifies file system

Creates the following files

%TEMP%\nsnf622.tmp\system.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\cs.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\da.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\de.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\el.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\en-gb.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\en-us.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\es-419.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\es.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\et.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\fa.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\fi.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\fil.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\fr.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\gu.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\he.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ca.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\hi.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\bn.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ar.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\d3dcompiler_47.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\ffmpeg.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\icudtl.dat
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\libegl.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\libglesv2.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\license.electron.txt
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\licenses.chromium.html
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\resources.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\setup2.exe
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\snapshot_blob.bin
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\v8_context_snapshot.bin
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\vk_swiftshader.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\vk_swiftshader_icd.json
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\vulkan-1.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\am.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\bg.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\hr.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\hu.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\id.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ta.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\te.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\th.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\tr.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\uk.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\vi.pak
%APPDATA%\com.gtoppocket.launcher\bb27f0b1-941e-462a-ab5c-3f593359e8cf.tmp
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\zh-cn.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\resources\app.asar
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\resources\elevate.exe
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\swiftshader\libegl.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\swiftshader\libglesv2.dll
%TEMP%\nsnf622.tmp\stdutils.dll
%APPDATA%\com.gtoppocket.launcher\logs\main.log
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\sv.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\sw.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\sr.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\sl.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\sk.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ja.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\kn.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ko.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\lt.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\lv.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ml.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\chrome_200_percent.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ms.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\mr.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\nl.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\pl.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\pt-br.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\pt-pt.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ro.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ru.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\it.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\nb.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\zh-tw.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\chrome_100_percent.pak
%TEMP%\nsnf622.tmp\7z-out\ffmpeg.dll
%TEMP%\nsnf622.tmp\7z-out\locales\es.pak
%TEMP%\nsnf622.tmp\7z-out\locales\et.pak
%TEMP%\nsnf622.tmp\7z-out\locales\fa.pak
%TEMP%\nsnf622.tmp\7z-out\locales\fi.pak
%TEMP%\nsnf622.tmp\7z-out\locales\fil.pak
%TEMP%\nsnf622.tmp\7z-out\locales\fr.pak
%TEMP%\nsnf622.tmp\7z-out\locales\gu.pak
%TEMP%\nsnf622.tmp\7z-out\locales\he.pak
%TEMP%\nsnf622.tmp\7z-out\locales\hi.pak
%TEMP%\nsnf622.tmp\7z-out\locales\hr.pak
%TEMP%\nsnf622.tmp\7z-out\locales\hu.pak
%TEMP%\nsnf622.tmp\7z-out\locales\id.pak
%TEMP%\nsnf622.tmp\7z-out\locales\it.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ja.pak
%TEMP%\nsnf622.tmp\7z-out\locales\kn.pak
%TEMP%\nsnf622.tmp\7z-out\locales\es-419.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ko.pak
%TEMP%\nsnf622.tmp\7z-out\locales\en-us.pak
%TEMP%\nsnf622.tmp\7z-out\locales\el.pak
%TEMP%\nsnf622.tmp\app-64.7z
%TEMP%\nsnf622.tmp\nsis7z.dll
%TEMP%\nsnf622.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsnf622.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsnf622.tmp\7z-out\icudtl.dat
%TEMP%\nsnf622.tmp\7z-out\license.electron.txt
%TEMP%\nsnf622.tmp\7z-out\licenses.chromium.html
%TEMP%\nsnf622.tmp\7z-out\locales\am.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ar.pak
%TEMP%\nsnf622.tmp\7z-out\locales\bg.pak
%TEMP%\nsnf622.tmp\7z-out\locales\bn.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ca.pak
%TEMP%\nsnf622.tmp\7z-out\locales\cs.pak
%TEMP%\nsnf622.tmp\7z-out\locales\da.pak
%TEMP%\nsnf622.tmp\7z-out\locales\de.pak
%TEMP%\nsnf622.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsnf622.tmp\7z-out\locales\lt.pak
%TEMP%\nsnf622.tmp\7z-out\locales\lv.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ml.pak
%TEMP%\nsnf622.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsnf622.tmp\7z-out\resources.pak
%TEMP%\nsnf622.tmp\7z-out\resources\app.asar
%TEMP%\nsnf622.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsnf622.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsnf622.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsnf622.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsnf622.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsnf622.tmp\7z-out\libegl.dll
%TEMP%\nsnf622.tmp\7z-out\libglesv2.dll
%TEMP%\nsnf622.tmp\7z-out\resources\elevate.exe
%TEMP%\nsnf622.tmp\7z-out\setup2.exe
%TEMP%\nsnf622.tmp\7z-out\swiftshader\libegl.dll
%TEMP%\nsnf622.tmp\7z-out\swiftshader\libglesv2.dll
%TEMP%\nsnf622.tmp\7z-out\locales\vi.pak
%TEMP%\nsnf622.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsnf622.tmp\7z-out\locales\uk.pak
%TEMP%\nsnf622.tmp\7z-out\locales\tr.pak
%TEMP%\nsnf622.tmp\7z-out\locales\th.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ms.pak
%TEMP%\nsnf622.tmp\7z-out\locales\nb.pak
%TEMP%\nsnf622.tmp\7z-out\locales\nl.pak
%TEMP%\nsnf622.tmp\7z-out\locales\pl.pak
%TEMP%\nsnf622.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsnf622.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsnf622.tmp\7z-out\vulkan-1.dll
%TEMP%\nsnf622.tmp\7z-out\locales\ru.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ro.pak
%TEMP%\nsnf622.tmp\7z-out\locales\sl.pak
%TEMP%\nsnf622.tmp\7z-out\locales\sr.pak
%TEMP%\nsnf622.tmp\7z-out\locales\sv.pak
%TEMP%\nsnf622.tmp\7z-out\locales\sw.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ta.pak
%TEMP%\nsnf622.tmp\7z-out\locales\te.pak
%TEMP%\nsnf622.tmp\7z-out\locales\mr.pak
%TEMP%\nsnf622.tmp\7z-out\locales\sk.pak
%APPDATA%\com.gtoppocket.launcher\fontlookuptablecache\font_unique_name_table.pb

Deletes the following files

%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\chrome_100_percent.pak
%TEMP%\nsnf622.tmp\7z-out\locales\fi.pak
%TEMP%\nsnf622.tmp\7z-out\locales\fil.pak
%TEMP%\nsnf622.tmp\7z-out\locales\fr.pak
%TEMP%\nsnf622.tmp\7z-out\locales\gu.pak
%TEMP%\nsnf622.tmp\7z-out\locales\he.pak
%TEMP%\nsnf622.tmp\7z-out\locales\et.pak
%TEMP%\nsnf622.tmp\7z-out\locales\fa.pak
%TEMP%\nsnf622.tmp\7z-out\locales\hi.pak
%TEMP%\nsnf622.tmp\7z-out\locales\id.pak
%TEMP%\nsnf622.tmp\7z-out\locales\it.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ja.pak
%TEMP%\nsnf622.tmp\7z-out\locales\kn.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ko.pak
%TEMP%\nsnf622.tmp\7z-out\locales\hr.pak
%TEMP%\nsnf622.tmp\7z-out\locales\hu.pak
%TEMP%\nsnf622.tmp\7z-out\locales\es.pak
%TEMP%\nsnf622.tmp\7z-out\locales\en-us.pak
%TEMP%\nsnf622.tmp\7z-out\locales\lv.pak
%TEMP%\nsnf622.tmp\7z-out\libglesv2.dll
%TEMP%\nsnf622.tmp\7z-out\license.electron.txt
%TEMP%\nsnf622.tmp\7z-out\licenses.chromium.html
%TEMP%\nsnf622.tmp\7z-out\locales\am.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ar.pak
%TEMP%\nsnf622.tmp\7z-out\locales\bg.pak
%TEMP%\nsnf622.tmp\7z-out\locales\bn.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ca.pak
%TEMP%\nsnf622.tmp\7z-out\locales\cs.pak
%TEMP%\nsnf622.tmp\7z-out\locales\da.pak
%TEMP%\nsnf622.tmp\7z-out\locales\de.pak
%TEMP%\nsnf622.tmp\7z-out\locales\el.pak
%TEMP%\nsnf622.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsnf622.tmp\7z-out\locales\lt.pak
%TEMP%\nsnf622.tmp\7z-out\icudtl.dat
%TEMP%\nsnf622.tmp\7z-out\locales\es-419.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\te.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ml.pak
%TEMP%\nsnf622.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsnf622.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsnf622.tmp\7z-out\resources\app.asar
%TEMP%\nsnf622.tmp\7z-out\resources\elevate.exe
%TEMP%\nsnf622.tmp\7z-out\resources.pak
%TEMP%\nsnf622.tmp\7z-out\setup2.exe
%TEMP%\nsnf622.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsnf622.tmp\7z-out\swiftshader\libegl.dll
%TEMP%\nsnf622.tmp\7z-out\swiftshader\libglesv2.dll
%TEMP%\nsnf622.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsnf622.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsnf622.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsnf622.tmp\7z-out\vulkan-1.dll
%TEMP%\nsnf622.tmp\app-64.7z
%TEMP%\nsnf622.tmp\nsis7z.dll
%TEMP%\nsnf622.tmp\7z-out\locales\vi.pak
%TEMP%\nsnf622.tmp\7z-out\ffmpeg.dll
%TEMP%\nsnf622.tmp\7z-out\libegl.dll
%TEMP%\nsnf622.tmp\7z-out\locales\th.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ms.pak
%TEMP%\nsnf622.tmp\7z-out\locales\nb.pak
%TEMP%\nsnf622.tmp\7z-out\locales\nl.pak
%TEMP%\nsnf622.tmp\7z-out\locales\pl.pak
%TEMP%\nsnf622.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsnf622.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ro.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ru.pak
%TEMP%\nsnf622.tmp\7z-out\locales\sk.pak
%TEMP%\nsnf622.tmp\7z-out\locales\sl.pak
%TEMP%\nsnf622.tmp\7z-out\locales\sr.pak
%TEMP%\nsnf622.tmp\7z-out\locales\sv.pak
%TEMP%\nsnf622.tmp\7z-out\locales\sw.pak
%TEMP%\nsnf622.tmp\7z-out\locales\ta.pak
%TEMP%\nsnf622.tmp\7z-out\locales\te.pak
%TEMP%\nsnf622.tmp\7z-out\locales\tr.pak
%TEMP%\nsnf622.tmp\7z-out\locales\mr.pak
%TEMP%\nsnf622.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsnf622.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsnf622.tmp\7z-out\chrome_100_percent.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\et.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\fa.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\fi.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\fil.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\fr.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\gu.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\he.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\hi.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\hr.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\hu.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\id.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\it.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ja.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\en-us.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\el.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\es.pak
%TEMP%\nsnf622.tmp\stdutils.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\kn.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\de.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\d3dcompiler_47.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\ffmpeg.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\icudtl.dat
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\libegl.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\libglesv2.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\license.electron.txt
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\chrome_200_percent.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\licenses.chromium.html
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ar.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\bg.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\bn.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ca.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\cs.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\da.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\am.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\en-gb.pak
%TEMP%\nsnf622.tmp\7z-out\locales\uk.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ko.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ml.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\vi.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\zh-cn.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\zh-tw.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\resources\app.asar
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\resources\elevate.exe
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\resources.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\setup2.exe
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\snapshot_blob.bin
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\swiftshader\libegl.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\swiftshader\libglesv2.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\v8_context_snapshot.bin
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\vk_swiftshader.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\vk_swiftshader_icd.json
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\vulkan-1.dll
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\lt.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\uk.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\lv.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\tr.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\es-419.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\mr.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ms.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\nb.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\nl.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\pl.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\pt-br.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\pt-pt.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ro.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ru.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\sk.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\sl.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\sr.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\sv.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\sw.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\ta.pak
%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\locales\th.pak
%TEMP%\nsnf622.tmp\system.dll

Moves the following files

from %APPDATA%\com.gtoppocket.launcher\bb27f0b1-941e-462a-ab5c-3f593359e8cf.tmp to %APPDATA%\com.gtoppocket.launcher\local state

Network activity

UDP

DNS ASK ap####rrent.site

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''

Creates and executes the following

'%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\setup2.exe'
'%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\setup2.exe' --type=gpu-process --user-data-dir="%APPDATA%\com.gtoppocket.launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAA...
'%TEMP%\2d2ugres0ocmsueff7fiaitkb6a\setup2.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="%APPDATA%\com.gt...

Executes the following

'<SYSTEM32>\cmd.exe' /d /s /c "auditpol /set /category:"Система" /success:enable"
'<SYSTEM32>\auditpol.exe' /set /category:"Система" /success:enable
'<SYSTEM32>\cmd.exe' /d /s /c "auditpol /set /category:"Подробное отслеживание" /subcategory:"Создание процесса" /success:enable"
'<SYSTEM32>\auditpol.exe' /set /category:"Подробное отслеживание" /subcategory:"Создание процесса" /success:enable
'<SYSTEM32>\cmd.exe' /d /s /c "auditpol /set /category:"System" /success:enable"
'<SYSTEM32>\auditpol.exe' /set /category:"System" /success:enable
'<SYSTEM32>\cmd.exe' /d /s /c "auditpol /set /category:"Detailed Tracking" /subcategory:"Process Creation" /success:enable"
'<SYSTEM32>\auditpol.exe' /set /category:"Detailed Tracking" /subcategory:"Process Creation" /success:enable
'<SYSTEM32>\cmd.exe' /d /s /c "auditpol /set /category:"Система" /success:enable"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "auditpol /set /category:"Подробное отслеживание" /subcategory:"Создание процесса" /success:enable"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "auditpol /set /category:"System" /success:enable"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "auditpol /set /category:"Detailed Tracking" /subcategory:"Process Creation" /success:enable"' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial