Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM "Fivem.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "Steam.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "Discord.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "DiscordPTB.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "EpicGamesLauncher.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "Launcher.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "SocialClubHelper.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "RockstarService.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "LauncherPatcher.exe"
- '<SYSTEM32>\taskkill.exe' /f /im smartscreen.exe
- '<SYSTEM32>\taskkill.exe' /f /im EasyAntiCheat.exe
- '<SYSTEM32>\taskkill.exe' /f /im dnf.exe
- '<SYSTEM32>\taskkill.exe' /f /im CrossProxy.exe
- '<SYSTEM32>\taskkill.exe' /f /im tensafe_1.exe
- '<SYSTEM32>\taskkill.exe' /f /im tensafe_2.exe
- '<SYSTEM32>\taskkill.exe' /f /im tencentdl.exe
- '<SYSTEM32>\taskkill.exe' /f /im TenioDL.exe
- '<SYSTEM32>\taskkill.exe' /f /im uishell.exe
- '<SYSTEM32>\taskkill.exe' /f /im BackgroundDownloader.exe
- '<SYSTEM32>\taskkill.exe' /f /im conime.exe
- '<SYSTEM32>\taskkill.exe' /f /im QQDL.EXE
- '<SYSTEM32>\taskkill.exe' /f /im qqlogin.exe
- '<SYSTEM32>\taskkill.exe' /f /im dnfchina.exe
- '<SYSTEM32>\taskkill.exe' /f /im dnfchinatest.exe
- '<SYSTEM32>\taskkill.exe' /f /im txplatform.exe
- '<SYSTEM32>\taskkill.exe' /f /im OriginWebHelperService.exe
- '<SYSTEM32>\taskkill.exe' /f /im Origin.exe
- '<SYSTEM32>\taskkill.exe' /f /im OriginClientService.exe
- '<SYSTEM32>\taskkill.exe' /f /im OriginER.exe
- '<SYSTEM32>\taskkill.exe' /f /im OriginThinSetupInternal.exe
- '<SYSTEM32>\taskkill.exe' /f /im OriginLegacyCLI.exe
- '<SYSTEM32>\taskkill.exe' /f /im Agent.exe
- '<SYSTEM32>\taskkill.exe' /f /im Client.exe
Modifies file system
Creates the following files
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\appxprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\assocprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\cbsprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\dismcore.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\dismcoreps.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\dismhost.exe
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\dismprov.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\dmiprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\appxprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\assocprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\cbsprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\dismcore.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\dismprov.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\dmiprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\ffuprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\folderprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\genericprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\ibsprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\imagingprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\intlprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\logprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\msiprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\offlinesetupprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\osprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\provprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\setupplatformprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\smiprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\sysprepprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\transmogprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\unattendprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\vhdprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\en-us\wimprovider.dll.mui
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\ffuprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\folderprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\genericprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\ibsprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\imagingprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\intlprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\logprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\msiprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\offlinesetupprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\osprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\provprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\setupplatformprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\smiprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\sysprepprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\transmogprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\unattendprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\vhdprovider.dll
- %TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\wimprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\appxprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\assocprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\cbsprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\dismcore.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\dismcoreps.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\dismhost.exe
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\dismprov.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\dmiprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\appxprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\assocprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\cbsprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\dismcore.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\dismprov.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\dmiprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\ffuprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\folderprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\genericprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\ibsprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\imagingprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\intlprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\logprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\msiprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\offlinesetupprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\osprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\provprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\setupplatformprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\smiprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\sysprepprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\transmogprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\unattendprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\vhdprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\en-us\wimprovider.dll.mui
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\ffuprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\folderprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\genericprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\ibsprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\imagingprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\intlprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\logprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\msiprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\offlinesetupprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\osprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\provprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\setupplatformprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\smiprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\sysprepprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\transmogprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\unattendprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\vhdprovider.dll
- %TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\wimprovider.dll
Network activity
Connects to
- 'mo#####.map.fastly.net':443
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
UDP
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\4e8101c4-59d7-4245-951e-a1ac51eb6132\dismhost.exe' {F35D0C4B-1CFD-40D0-88B8-CD481F519880}
- '%TEMP%\b25706ae-90e8-45e4-8ecf-735253d38ab6\dismhost.exe' {9F402883-9B05-41CB-9220-6D0CE382D651}
Executes the following
- '<SYSTEM32>\cmd.exe' /c mode CON: COLS=120 LINES=20
- '<SYSTEM32>\mode.com' CON: COLS=120 LINES=20
- '<SYSTEM32>\cmd.exe' /c sc stop XboxNetApiSvc
- '<SYSTEM32>\sc.exe' stop XboxNetApiSvc
- '<SYSTEM32>\cmd.exe' /c sc stop XboxGipSvc
- '<SYSTEM32>\sc.exe' stop XboxGipSvc
- '<SYSTEM32>\cmd.exe' /c sc stop XblGameSave
- '<SYSTEM32>\sc.exe' stop XblGameSave
- '<SYSTEM32>\cmd.exe' /c sc stop XblAuthManager
- '<SYSTEM32>\sc.exe' stop XblAuthManager
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "Fivem.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "Steam.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "Discord.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "DiscordPTB.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "EpicGamesLauncher.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "Launcher.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "SocialClubHelper.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "RockstarService.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "LauncherPatcher.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im smartscreen.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im EasyAntiCheat.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im dnf.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im CrossProxy.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im tensafe_1.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im tensafe_2.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im tencentdl.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im TenioDL.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im uishell.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im BackgroundDownloader.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im conime.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im QQDL.EXE
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im qqlogin.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im dnfchina.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im dnfchinatest.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im txplatform.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im OriginWebHelperService.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Origin.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im OriginClientService.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im OriginER.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im OriginThinSetupInternal.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im OriginLegacyCLI.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Agent.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Client.exe
- '<SYSTEM32>\cmd.exe' /c PowerShell -Command "Get-AppxPackage *xbox* | Remove-AppxPackage"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-AppxPackage *xbox* | Remove-AppxPackage"
- '<SYSTEM32>\cmd.exe' /c DISM /Online /Remove-ProvisionedAppxPackage /PackageName:Microsoft.XboxGameCallableUI_*
- '<SYSTEM32>\dism.exe' /Online /Remove-ProvisionedAppxPackage /PackageName:Microsoft.XboxGameCallableUI_*
- '<SYSTEM32>\cmd.exe' /c DISM /Online /Remove-ProvisionedAppxPackage /PackageName:Microsoft.XboxGamingOverlay_*
- '<SYSTEM32>\dism.exe' /Online /Remove-ProvisionedAppxPackage /PackageName:Microsoft.XboxGamingOverlay_*
- '<SYSTEM32>\cmd.exe' /c DISM /Online /Remove-ProvisionedAppxPackage /PackageName:Microsoft.XboxSpeechToTextOverlay_*
- '<SYSTEM32>\dism.exe' /Online /Remove-ProvisionedAppxPackage /PackageName:Microsoft.XboxSpeechToTextOverlay_*
- '<SYSTEM32>\cmd.exe' /c DISM /Online /Remove-ProvisionedAppxPackage /PackageName:Microsoft.XboxApp_*
- '<SYSTEM32>\dism.exe' /Online /Remove-ProvisionedAppxPackage /PackageName:Microsoft.XboxApp_*
- '<SYSTEM32>\cmd.exe' \c dism \online \remove-provisionedappxpackage \packagename:Microsoft.XboxGameOverlay_1.47.14001.0_neutral_~_8wekyb3d8bbwe
- '<SYSTEM32>\dism.exe' /online /remove-provisionedappxpackage /packagename:Microsoft.XboxGameOverlay_1.47.14001.0_neutral_~_8wekyb3d8bbwe
