Trojan.Siggen32.4916

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\updater.exe

Malicious functions

Injects code into

the following user processes:

msedge.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\login data
%LOCALAPPDATA%\microsoft\edge\user data\default\web data

Modifies file system

Creates the following files

%TEMP%\pkg-nwikna\5ad24cd4d19ef03079717bd6309fe0604c2a4829cd92788ebf6da95c41d3d28f
%HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\package.json
%TEMP%\pkg-nwikna\8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
%HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.js
%TEMP%\pkg-nwikna\762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
%HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3-binding.js
%TEMP%\pkg-nwikna\d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
%HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\trace.js
%TEMP%\pkg-nwikna\b9a7b76665d92af2d90cc6a15ffdc1a79635559cbc1c40bd1f83c4c4449cd442
%HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\release\node_sqlite3.node
%TEMP%\pkg-nwikna\d3a788312c56e9ac2e8d70d3074d94dd4c82abcdef0a1361497b4711cf073a71
%HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\package.json
%TEMP%\pkg-nwikna\cd7d764453f5ad1e02558f1ca98c18f0d28786633c4ea8254858011a4d0eeed6
%HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\index.js
%TEMP%\pkg-nwikna\4ffd787b2864836655710ed9dcbb26b53f799e4ce15dfb820e2f8bc8ad55d0b0
%HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\bin\arm64\node-dpapi.node
%TEMP%\pkg-nwikna\36bff5188c2d75ece4cca1162b3d171c81f1f4703613b358cafc2e9e86610cc6
%HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\bin\ia32\node-dpapi.node
%TEMP%\pkg-nwikna\a0c8843d23ff42ed119a872e4ecbe88fbe80b33095d33f28802c753789cc2669
%HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\bin\x64\node-dpapi.node
%TEMP%\pkg-nwikna\2de3ef9fc3bad6955f503dc641da2db24626760ce1004fe6929cc5e64737ad35
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\package.json
%TEMP%\pkg-nwikna\dc6a2239b69829b7d20aeefc9f5540aa69564d0cac476e442afeb030ae64ca07
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\adm-zip.js
%TEMP%\pkg-nwikna\6bb5b2d4c07d793ca928daa63a8899c6914fafb5ac3aa04ec10cae07f3d57dca
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\license
%TEMP%\pkg-nwikna\35295fdfb2d8e5316db897f2e8ed61ed5eee8a68044774aba56b118a9a959daf
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\zipentry.js
%TEMP%\pkg-nwikna\f95d3d6687e5ed959559943380e3bcf61f3e8849286d740afa45dedb28ffa16d
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\zipfile.js
%TEMP%\pkg-nwikna\7f6a8eec09cadc72e886d44239d5dfea040678327e1e1d1c99a95092aa6e3844
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\build\a.node
%TEMP%\pkg-nwikna\1d3bfe941be84e8d0d1a7e61c1bb62c89590794c6134ab1e1f8ba7acf9c82375
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\build\addon.node
%TEMP%\pkg-nwikna\51b343ba48150d1a4b8d7ea3cc5492028f7cf8c8cf60ff0e4d50e322c8c2b5b0
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\build\check.node
%TEMP%\pkg-nwikna\74da81544ada9a19754da25b2bd7065a57210be47b1df7bb753a2448ff9abca2
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\build\deadlock.node
%TEMP%\pkg-nwikna\c16c15242145ff83283003b4bba5cf5656a375cef878659222b331a734934bde
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\build\re.node
%TEMP%\pkg-nwikna\b6fc4b17ceab96c07d6c14464b95204b1a130d32d845b348a18eefd5633763b1
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\headers\entryheader.js
%TEMP%\pkg-nwikna\536e4b5bf009a3d9f6eccfbbc4157cb6de663d889e0826ea5f6e5fa17aaeb8bf
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\headers\index.js
%TEMP%\pkg-nwikna\28dd1a0db451bc94d8f3234e57d8192ba17154118f841c398e0de35acea286ee
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\headers\mainheader.js
%TEMP%\pkg-nwikna\6dc41b2460594cfa5136b797653c166b2f7403820a40f2fca17cca35a5de1b5f
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\methods\deflater.js
%TEMP%\pkg-nwikna\d67714f1a04be942f90be77069af3ff4214aa8ee84b26edeff3a87eb0d8e2dc0
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\methods\index.js
%TEMP%\pkg-nwikna\c5e4531a11385050d77a5069487b0be8e85c8e44fe6b214d68def321e74528ce
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\methods\inflater.js
%TEMP%\pkg-nwikna\23365c7eda0ea098385dc7ec649517fc110ce2764d2e707c37bf6b528604e25a
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\methods\zipcrypto.js
%TEMP%\pkg-nwikna\208e943a2e5faad056047f3c7991cce3cde637d8e272a564f2546210ebdf2069
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\util\constants.js
%TEMP%\pkg-nwikna\73a0ebb00c4dce2124f07acf0b34374cb03a4384cccd1cd6f58aee27c35953d9
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\util\decoder.js
%TEMP%\pkg-nwikna\d2d243647737c795c2db8aeba2e1f3841d5f76370b521d436cf465322dd4aab7
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\util\errors.js
%TEMP%\pkg-nwikna\31c93eb386a2bfbf19ad92a6bf20d510a8f1e7e90cc71d33dd888f89da12362d
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\util\fattr.js
%TEMP%\pkg-nwikna\dc5b230ed853947ea55c0bf69f0e525fbeffefff09aa3da296d541bb8898314e
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\util\index.js
%TEMP%\pkg-nwikna\a8983582ad5dfa163303d22acd0b0ab3312059a121fb1b377ad41f4a58ed955b
%HOMEPATH%\.cache\pkg\04d9faa3c6e7072a00a6894dbe24678d4b728c96f47e2fd01cf822f30b6e609a\adm-zip\util\utils.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\package.json
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\adm-zip.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\license
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\zipentry.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\zipfile.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\build\a.node
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\build\addon.node
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\build\check.node
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\build\deadlock.node
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\build\re.node
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\headers\entryheader.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\headers\index.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\headers\mainheader.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\methods\deflater.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\methods\index.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\methods\inflater.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\methods\zipcrypto.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\util\constants.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\util\decoder.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\util\errors.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\util\fattr.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\util\index.js
%HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\util\utils.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\package.json
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\adm-zip.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\license
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\zipentry.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\zipfile.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\build\a.node
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\build\addon.node
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\build\check.node
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\build\deadlock.node
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\build\re.node
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\headers\entryheader.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\headers\index.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\headers\mainheader.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\methods\deflater.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\methods\index.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\methods\inflater.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\methods\zipcrypto.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\util\constants.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\util\decoder.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\util\errors.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\util\fattr.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\util\index.js
%HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\util\utils.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\package.json
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\adm-zip.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\license
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\zipentry.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\zipfile.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\build\a.node
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\build\addon.node
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\build\check.node
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\build\deadlock.node
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\build\re.node
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\headers\entryheader.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\headers\index.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\headers\mainheader.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\methods\deflater.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\methods\index.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\methods\inflater.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\methods\zipcrypto.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\util\constants.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\util\decoder.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\util\errors.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\util\fattr.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\util\index.js
%HOMEPATH%\.cache\pkg\afff85868267113c938b5d49e2b404d61fae8fe705675e93a123596f0b6028f5\adm-zip\util\utils.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\package.json
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\adm-zip.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\license
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\zipentry.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\zipfile.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\build\a.node
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\build\addon.node
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\build\check.node
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\build\deadlock.node
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\build\re.node
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\headers\entryheader.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\headers\index.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\headers\mainheader.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\methods\deflater.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\methods\index.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\methods\inflater.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\methods\zipcrypto.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\util\constants.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\util\decoder.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\util\errors.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\util\fattr.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\util\index.js
%HOMEPATH%\.cache\pkg\cad711ff286b81fde35dbe96790e51ec1014b0c21210435e98bd18cd0cfc2ecd\adm-zip\util\utils.js
nul
%TEMP%\thec45.tmp
%TEMP%\thed4f.tmp
%TEMP%\thee5a.tmp
%TEMP%\screencapture\screencapture_1.3.2.bat
%TEMP%\screencapture\app.manifest
%TEMP%\screencapture\csc8398e84c37a498f9fa63833a21db823.tmp
%TEMP%\resf703.tmp
%TEMP%\screencapture\screencapture_1.3.2.exe
%TEMP%\2025101-2424-jne013.xept9.jpg
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\screencapture_1.3.2.exe.log
C:\users\public\moixd\moi.jpg
C:\users\public\moixd-ru-185.93.40.66.zip

Deletes following files that it created itself

%TEMP%\resf703.tmp
%TEMP%\screencapture\csc8398e84c37a498f9fa63833a21db823.tmp
%TEMP%\2025101-2424-jne013.xept9.jpg
C:\users\public\moixd\moi.jpg
C:\users\public\moixd-ru-185.93.40.66.zip
%TEMP%\pkg-nwikna\1d3bfe941be84e8d0d1a7e61c1bb62c89590794c6134ab1e1f8ba7acf9c82375
%TEMP%\pkg-nwikna\208e943a2e5faad056047f3c7991cce3cde637d8e272a564f2546210ebdf2069
%TEMP%\pkg-nwikna\23365c7eda0ea098385dc7ec649517fc110ce2764d2e707c37bf6b528604e25a
%TEMP%\pkg-nwikna\28dd1a0db451bc94d8f3234e57d8192ba17154118f841c398e0de35acea286ee
%TEMP%\pkg-nwikna\2de3ef9fc3bad6955f503dc641da2db24626760ce1004fe6929cc5e64737ad35
%TEMP%\pkg-nwikna\31c93eb386a2bfbf19ad92a6bf20d510a8f1e7e90cc71d33dd888f89da12362d
%TEMP%\pkg-nwikna\35295fdfb2d8e5316db897f2e8ed61ed5eee8a68044774aba56b118a9a959daf
%TEMP%\pkg-nwikna\36bff5188c2d75ece4cca1162b3d171c81f1f4703613b358cafc2e9e86610cc6
%TEMP%\pkg-nwikna\4ffd787b2864836655710ed9dcbb26b53f799e4ce15dfb820e2f8bc8ad55d0b0
%TEMP%\pkg-nwikna\51b343ba48150d1a4b8d7ea3cc5492028f7cf8c8cf60ff0e4d50e322c8c2b5b0
%TEMP%\pkg-nwikna\536e4b5bf009a3d9f6eccfbbc4157cb6de663d889e0826ea5f6e5fa17aaeb8bf
%TEMP%\pkg-nwikna\5ad24cd4d19ef03079717bd6309fe0604c2a4829cd92788ebf6da95c41d3d28f
%TEMP%\pkg-nwikna\6bb5b2d4c07d793ca928daa63a8899c6914fafb5ac3aa04ec10cae07f3d57dca
%TEMP%\pkg-nwikna\6dc41b2460594cfa5136b797653c166b2f7403820a40f2fca17cca35a5de1b5f
%TEMP%\pkg-nwikna\73a0ebb00c4dce2124f07acf0b34374cb03a4384cccd1cd6f58aee27c35953d9
%TEMP%\pkg-nwikna\74da81544ada9a19754da25b2bd7065a57210be47b1df7bb753a2448ff9abca2
%TEMP%\pkg-nwikna\762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
%TEMP%\pkg-nwikna\7f6a8eec09cadc72e886d44239d5dfea040678327e1e1d1c99a95092aa6e3844
%TEMP%\pkg-nwikna\8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
%TEMP%\pkg-nwikna\a0c8843d23ff42ed119a872e4ecbe88fbe80b33095d33f28802c753789cc2669
%TEMP%\pkg-nwikna\a8983582ad5dfa163303d22acd0b0ab3312059a121fb1b377ad41f4a58ed955b
%TEMP%\pkg-nwikna\b6fc4b17ceab96c07d6c14464b95204b1a130d32d845b348a18eefd5633763b1
%TEMP%\pkg-nwikna\b9a7b76665d92af2d90cc6a15ffdc1a79635559cbc1c40bd1f83c4c4449cd442
%TEMP%\pkg-nwikna\c16c15242145ff83283003b4bba5cf5656a375cef878659222b331a734934bde
%TEMP%\pkg-nwikna\c5e4531a11385050d77a5069487b0be8e85c8e44fe6b214d68def321e74528ce
%TEMP%\pkg-nwikna\cd7d764453f5ad1e02558f1ca98c18f0d28786633c4ea8254858011a4d0eeed6
%TEMP%\pkg-nwikna\d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
%TEMP%\pkg-nwikna\d2d243647737c795c2db8aeba2e1f3841d5f76370b521d436cf465322dd4aab7
%TEMP%\pkg-nwikna\d3a788312c56e9ac2e8d70d3074d94dd4c82abcdef0a1361497b4711cf073a71
%TEMP%\pkg-nwikna\d67714f1a04be942f90be77069af3ff4214aa8ee84b26edeff3a87eb0d8e2dc0
%TEMP%\pkg-nwikna\dc5b230ed853947ea55c0bf69f0e525fbeffefff09aa3da296d541bb8898314e
%TEMP%\pkg-nwikna\dc6a2239b69829b7d20aeefc9f5540aa69564d0cac476e442afeb030ae64ca07
%TEMP%\pkg-nwikna\f95d3d6687e5ed959559943380e3bcf61f3e8849286d740afa45dedb28ffa16d

Network activity

Connects to

'ap#.#pify.org':443
'ip##pi.com':80
'ap#.##legram.org':443

TCP

HTTP GET requests

http://ip##pi.com/json/185.93.40.66?fi################

Other

'ap#.#pify.org':443
'ap#.##legram.org':443

UDP

DNS ASK ap#.#pify.org
DNS ASK ip##pi.com
DNS ASK ap#.##legram.org

Miscellaneous

Creates and executes the following

'%TEMP%\screencapture\screencapture_1.3.2.exe' %TEMP%\2025101-2424-jne013.xept9.jpg

Executes the following

'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' 2
'<SYSTEM32>\cmd.exe' /c %TEMP%\screenCapture\screenCapture_1.3.2.bat %TEMP%\2025101-2424-jne013.xept9.jpg
'%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' \nologo \r:"Microsoft.VisualBasic.dll" \win32manifest:"app.manifest" \out:"screenCapture_1.3.2.exe" "%TEMP%\SCREEN~1\SCREEN~1.BAT"
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF703.tmp" "%TEMP%\screenCapture\CSC8398E84C37A498F9FA63833A21DB823.TMP"
'<SYSTEM32>\cmd.exe' /c %TEMP%\screenCapture\screenCapture_1.3.2.bat %TEMP%\2025101-2424-jne013.xept9.jpg' (with hidden window)
'%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF703.tmp" "%TEMP%\screenCapture\CSC8398E84C37A498F9FA63833A21DB823.TMP"' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial