Trojan.Siggen13.6148

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\firefox default browser agent da59ebdc7270c466

Malicious functions

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe

the following user processes:

3286.exe

Hooks functions

in browsers

iexplore.exe process, wininet.dll module
firefox.exe process, nss3.dll module

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\Martin Prikryl]
[<HKLM>\Software\Wow6432Node\Martin Prikryl]

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%APPDATA%\opera software\opera stable\login data
%APPDATA%\mozilla\firefox\profiles.ini
%APPDATA%\thunderbird\profiles.ini
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx

Modifies file system

Creates the following files

%TEMP%\ae30.tmp
%TEMP%\tmpe201.tmp
%TEMP%\tmpe1f1.tmp
%TEMP%\tmpe1e0.tmp
%TEMP%\tmpe1df.tmp
%TEMP%\tmpe1bf.tmp
%TEMP%\tmpe1be.tmp
%TEMP%\tmpe1bd.tmp
%TEMP%\tmpe1bc.tmp
%TEMP%\tmpe1ab.tmp
%TEMP%\tmpe17b.tmp
%TEMP%\tmpe13f.tmp
%TEMP%\tmpe17a.tmp
%TEMP%\tmpe169.tmp
%TEMP%\tmpe168.tmp
%TEMP%\tmpe167.tmp
%TEMP%\tmpe166.tmp
%TEMP%\tmpe155.tmp
%TEMP%\tmpe154.tmp
%TEMP%\tmpe153.tmp
%TEMP%\tmpe152.tmp
%TEMP%\tmpe142.tmp
%TEMP%\tmpe141.tmp
%TEMP%\tmpe179.tmp
%TEMP%\tmpe140.tmp
%TEMP%\tmpe212.tmp
%TEMP%\tmpe873.tmp
%TEMP%\tmpe8bc.tmp
%TEMP%\tmpe8ab.tmp
%TEMP%\tmpe8aa.tmp
%TEMP%\tmpe8a9.tmp
%TEMP%\tmpe899.tmp
%TEMP%\tmpe898.tmp
%TEMP%\tmpe897.tmp
%TEMP%\tmpe896.tmp
%TEMP%\tmpe885.tmp
%TEMP%\tmpe884.tmp
%TEMP%\tmpe233.tmp
%TEMP%\tmpe222.tmp
%TEMP%\tmpe852.tmp
%TEMP%\tmpe851.tmp
%TEMP%\tmpe850.tmp
%TEMP%\tmpe84f.tmp
%TEMP%\tmpe84e.tmp
%TEMP%\tmpe84d.tmp
%TEMP%\tmpe82d.tmp
%TEMP%\tmpe82c.tmp
%TEMP%\tmpe283.tmp
%TEMP%\tmpe272.tmp
%TEMP%\tmpe874.tmp
%TEMP%\tmpe12e.tmp
%TEMP%\tmpe12c.tmp
%TEMP%\tmpe8ce.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\tmpe025.tmp
%TEMP%\tmpe024.tmp
%TEMP%\tmpe023.tmp
%TEMP%\tmpe022.tmp
%TEMP%\tmpe011.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\tmpe048.tmp
%TEMP%\tmpe037.tmp
%TEMP%\tmpe038.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l2-1-0.dll
%TEMP%\tmpe059.tmp
%TEMP%\tmpe12b.tmp
%TEMP%\tmpe8cd.tmp
%TEMP%\tmpe026.tmp
%TEMP%\tmpe11a.tmp
%TEMP%\tmpe119.tmp
%TEMP%\tmpe118.tmp
%TEMP%\tmpe117.tmp
%TEMP%\tmpe107.tmp
%TEMP%\tmpe106.tmp
%TEMP%\tmpe0f5.tmp
%TEMP%\tmpe0f4.tmp
%TEMP%\tmpe0e4.tmp
%TEMP%\tmpe0e3.tmp
%TEMP%\tmpe0e2.tmp
%TEMP%\tmpe0e1.tmp
%TEMP%\tmpe0a1.tmp
%TEMP%\tmpe0a0.tmp
%TEMP%\tmpe090.tmp
%TEMP%\tmpe08f.tmp
%TEMP%\tmpe07e.tmp
%TEMP%\tmpe07d.tmp
%TEMP%\tmpe06c.tmp
%TEMP%\tmpe06b.tmp
%TEMP%\tmpe06a.tmp
%TEMP%\tmpe069.tmp
%TEMP%\tmpe12d.tmp
%TEMP%\tmpd250.tmp
%TEMP%\tmpe8de.tmp
%TEMP%\tmp4c7.tmp
%TEMP%\tmp4b6.tmp
%TEMP%\tmp4b5.tmp
%TEMP%\tmp4b4.tmp
%TEMP%\tmp4b3.tmp
%TEMP%\tmp4a3.tmp
%TEMP%\tmp4a2.tmp
%TEMP%\tmp4a1.tmp
%TEMP%\tmp490.tmp
%TEMP%\tmp48f.tmp
%TEMP%\tmp4c8.tmp
%TEMP%\tmp48e.tmp
%TEMP%\tmp47d.tmp
%TEMP%\tmp47c.tmp
%TEMP%\tmp47b.tmp
%TEMP%\tmp46a.tmp
%TEMP%\tmp469.tmp
%TEMP%\tmp468.tmp
%TEMP%\tmp467.tmp
%TEMP%\tmp456.tmp
%TEMP%\tmp455.tmp
%TEMP%\tmp445.tmp
%TEMP%\tmp47e.tmp
%TEMP%\tmp4f8.tmp
%TEMP%\tmp4f9.tmp
%TEMP%\tmp509.tmp
%TEMP%\tmp57e.tmp
%TEMP%\tmp56d.tmp
%TEMP%\tmp55d.tmp
%TEMP%\tmp55c.tmp
%TEMP%\tmp55b.tmp
%TEMP%\tmp54a.tmp
%TEMP%\tmp549.tmp
%TEMP%\tmp548.tmp
%TEMP%\tmp547.tmp
%TEMP%\tmp546.tmp
%TEMP%\tmp536.tmp
%TEMP%\tmp535.tmp
%TEMP%\tmp534.tmp
%TEMP%\tmp533.tmp
%TEMP%\tmp522.tmp
%TEMP%\tmp521.tmp
%TEMP%\tmp520.tmp
%TEMP%\tmp51f.tmp
%TEMP%\tmp51e.tmp
%TEMP%\tmp50d.tmp
%TEMP%\tmp50c.tmp
%TEMP%\tmp50b.tmp
%TEMP%\tmp50a.tmp
%TEMP%\tmp434.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\gxoytrkaz-shm
%TEMP%\tmpe953.tmp
%TEMP%\tmpe952.tmp
%TEMP%\tmpe941.tmp
%TEMP%\tmpe940.tmp
%TEMP%\tmpe930.tmp
%TEMP%\tmpe92f.tmp
%TEMP%\tmpe92e.tmp
%TEMP%\tmpe92d.tmp
%TEMP%\tmpe91c.tmp
%TEMP%\tmpe91b.tmp
%TEMP%\tmpe954.tmp
%TEMP%\tmpe91a.tmp
%TEMP%\tmpe918.tmp
%TEMP%\tmpe917.tmp
%TEMP%\tmpe906.tmp
%TEMP%\tmpe905.tmp
%TEMP%\tmpe904.tmp
%TEMP%\tmpe8f4.tmp
%TEMP%\tmpe8f3.tmp
%TEMP%\tmpe8f2.tmp
%TEMP%\tmpe8e1.tmp
%TEMP%\tmpe8e0.tmp
%TEMP%\tmpe919.tmp
%TEMP%\tmpe955.tmp
%TEMP%\tmpe965.tmp
%TEMP%\tmpe966.tmp
%LOCALAPPDATA%low\gxoytrkaz
%LOCALAPPDATA%low\chd6ywevi-shm
%LOCALAPPDATA%low\chd6ywevi
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\m2sgwlcms-shm
%LOCALAPPDATA%low\m2sgwlcms
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\fraqbc8ws
%TEMP%\tmpea7f.tmp
%TEMP%\tmpea7e.tmp
%TEMP%\tmpea1f.tmp
%TEMP%\tmpea1e.tmp
%TEMP%\tmpea1d.tmp
%TEMP%\tmpe9af.tmp
%TEMP%\tmpe9ae.tmp
%TEMP%\tmpe99d.tmp
%TEMP%\tmpe98d.tmp
%TEMP%\tmpe97c.tmp
%TEMP%\tmpe97b.tmp
%TEMP%\tmpe97a.tmp
%TEMP%\tmpe969.tmp
%TEMP%\tmpe968.tmp
%TEMP%\tmpe967.tmp
%LOCALAPPDATA%low\machineinfo.txt
%TEMP%\tmpe8df.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\tmpbf11.tmp
%TEMP%\tmpbf39.tmp
%TEMP%\tmpbf38.tmp
%TEMP%\tmpbf37.tmp
%TEMP%\tmpbf36.tmp
%TEMP%\tmpbf25.tmp
%TEMP%\tmpbf24.tmp
%TEMP%\tmpbf14.tmp
%TEMP%\tmpbf13.tmp
%TEMP%\tmpbf12.tmp
%TEMP%\tmpbf5c.tmp
%TEMP%\tmpbf4a.tmp
%TEMP%\tmpbf5b.tmp
%TEMP%\tmpbeee.tmp
%TEMP%\tmpbeed.tmp
%TEMP%\tmpbeec.tmp
%TEMP%\tmpbeeb.tmp
%TEMP%\tmpbedb.tmp
%TEMP%\tmpbeda.tmp
%TEMP%\tmpbed9.tmp
%TEMP%\tmpbed8.tmp
%TEMP%\tmpbec7.tmp
%TEMP%\tmpbeff.tmp
%TEMP%\tmpbf5d.tmp
%TEMP%\tmpc03f.tmp
%TEMP%\tmpbec6.tmp
%TEMP%\tmpbea5.tmp
%TEMP%\tmpc02e.tmp
%TEMP%\tmpc00e.tmp
%TEMP%\tmpc00d.tmp
%TEMP%\tmpbfbe.tmp
%TEMP%\tmpbfad.tmp
%TEMP%\tmpbfac.tmp
%TEMP%\tmpbfab.tmp
%TEMP%\tmpbf9b.tmp
%TEMP%\tmpbf9a.tmp
%TEMP%\tmpbf99.tmp
%TEMP%\tmpbf98.tmp
%TEMP%\tmpbf87.tmp
%TEMP%\tmpbf86.tmp
%TEMP%\tmpbf85.tmp
%TEMP%\tmpbf84.tmp
%TEMP%\tmpbf74.tmp
%TEMP%\tmpbf73.tmp
%TEMP%\tmpbf72.tmp
%TEMP%\tmpbf71.tmp
%TEMP%\tmpbf60.tmp
%TEMP%\tmpbf5f.tmp
%TEMP%\tmpbf5e.tmp
%TEMP%\tmpbf00.tmp
%TEMP%\tmp59e.tmp
%TEMP%\tmpc159.tmp
%TEMP%\tmpbe37.tmp
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\fraqbc8wsa
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%LOCALAPPDATA%low\gxix4a2dre
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%TEMP%\5a36.exe
%LOCALAPPDATA%low\sqlite3.dll
%TEMP%\4eb1.exe
%TEMP%\4731.exe
%TEMP%\3c09.exe
%TEMP%\3286.exe
%TEMP%\14c8.exe
%TEMP%\ede.exe
%APPDATA%\urfjvsu
%APPDATA%\ciafvib
%TEMP%\6483.exe
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\exuieaoeii
%TEMP%\8352.tmp
%TEMP%\tmpbe26.tmp
%TEMP%\8744.tmp
%TEMP%\tmpbe16.tmp
%TEMP%\tmpbe05.tmp
%TEMP%\tmpbdd5.tmp
%TEMP%\tmpbdd4.tmp
%TEMP%\tmpbdc4.tmp
%TEMP%\tmpbda3.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ws7zn1lk8tw5ce9s.zip
%TEMP%\8794.tmp-shm
%TEMP%\8794.tmp
%TEMP%\8755.tmp
%TEMP%\8705.tmp
%TEMP%\8352.tmp-shm
%TEMP%\8704.tmp
%TEMP%\86b5.tmp
%TEMP%\86a4.tmp
%TEMP%\8684.tmp
%TEMP%\8645.tmp
%TEMP%\855a.tmp
%TEMP%\853a.tmp
%TEMP%\84fa.tmp
%TEMP%\84da.tmp
%TEMP%\8372.tmp
%TEMP%\tmpbea6.tmp
%LOCALAPPDATA%low\mohqkxkl0hv.zip
%TEMP%\tmpc15a.tmp
%TEMP%\tmpd115.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldif60.dll
%TEMP%\tmpd401.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldap60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ia2marshal.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\freebl3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\breakpadinjector.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblemarshal.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblehandler.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\vcruntime140.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ucrtbase.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\lgpllibs.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\softokn3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\prldap60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssdbm3.dll
%TEMP%\tmpd2c8.tmp
%TEMP%\tmpd2c7.tmp
%TEMP%\tmpd2c6.tmp
%TEMP%\tmpd2a6.tmp
%TEMP%\tmpd2a5.tmp
%TEMP%\tmpd285.tmp
%TEMP%\tmpd284.tmp
%TEMP%\tmpd264.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\qipcap.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\libegl.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy.dll
%TEMP%\tmpd441.tmp
%TEMP%\tmpc189.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssckbi.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nss3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\msvcp140.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32_inuse.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozglue.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy_inuse.dll
%TEMP%\tmpd263.tmp
%TEMP%\tmpd114.tmp
%TEMP%\tmpd252.tmp
%TEMP%\tmpbf49.tmp
%TEMP%\tmpd1b7.tmp
%TEMP%\tmpd1b6.tmp
%TEMP%\tmpd1a6.tmp
%TEMP%\tmpd1a5.tmp
%TEMP%\tmpd1a4.tmp
%TEMP%\tmpd193.tmp
%TEMP%\tmpd192.tmp
%TEMP%\tmpd191.tmp
%TEMP%\tmpd180.tmp
%TEMP%\tmpd17f.tmp
%TEMP%\tmpd1c8.tmp
%TEMP%\tmpd17e.tmp
%TEMP%\tmpd16d.tmp
%TEMP%\tmpd16c.tmp
%TEMP%\tmpd13c.tmp
%TEMP%\tmpd13b.tmp
%TEMP%\tmpd12a.tmp
%TEMP%\tmpd129.tmp
%TEMP%\tmpd128.tmp
%TEMP%\tmpd118.tmp
%TEMP%\tmpd117.tmp
%TEMP%\tmpd116.tmp
%TEMP%\tmpd17d.tmp
%TEMP%\tmpd1c9.tmp
%TEMP%\tmpd1ca.tmp
%TEMP%\tmpd1da.tmp
%TEMP%\tmpd24f.tmp
%TEMP%\tmpd23e.tmp
%TEMP%\tmpd23d.tmp
%TEMP%\tmpd23c.tmp
%TEMP%\tmpd23b.tmp
%TEMP%\tmpd23a.tmp
%TEMP%\tmpd22a.tmp
%TEMP%\tmpd229.tmp
%TEMP%\tmpd228.tmp
%TEMP%\tmpd227.tmp
%TEMP%\tmpd216.tmp
%TEMP%\tmpd215.tmp
%TEMP%\tmpd214.tmp
%TEMP%\tmpd213.tmp
%TEMP%\tmpd203.tmp
%TEMP%\tmpd202.tmp
%TEMP%\tmpd201.tmp
%TEMP%\tmpd200.tmp
%TEMP%\tmpd1ff.tmp
%TEMP%\tmpd1ee.tmp
%TEMP%\tmpd1dd.tmp
%TEMP%\tmpd1dc.tmp
%TEMP%\tmpd1db.tmp
%TEMP%\tmpd251.tmp
%TEMP%\tmp59f.tmp

Sets the 'hidden' attribute to the following files

%APPDATA%\ciafvib
%APPDATA%\urfjvsu

Deletes the following files

%LOCALAPPDATA%low\fraqbc8wsa
%TEMP%\tmpe99d.tmp
%TEMP%\tmpe97b.tmp
%TEMP%\tmpe97c.tmp
%TEMP%\tmpe969.tmp
%TEMP%\tmpe97a.tmp
%TEMP%\tmpe967.tmp
%TEMP%\tmpe968.tmp
%TEMP%\tmpe965.tmp
%TEMP%\tmpe966.tmp
%TEMP%\tmpe954.tmp
%TEMP%\tmpe955.tmp
%TEMP%\tmpe952.tmp
%TEMP%\tmpe953.tmp
%TEMP%\tmpe940.tmp
%TEMP%\tmpe941.tmp
%TEMP%\tmpe92f.tmp
%TEMP%\tmpe930.tmp
%TEMP%\tmpe92d.tmp
%TEMP%\tmpe92e.tmp
%TEMP%\tmpe91b.tmp
%TEMP%\tmpe91c.tmp
%TEMP%\tmpe98d.tmp
%TEMP%\tmpe9af.tmp
%TEMP%\tmpe9ae.tmp
%TEMP%\tmpea1d.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblemarshal.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblehandler.dll
%LOCALAPPDATA%low\mohqkxkl0hv.zip
%LOCALAPPDATA%low\machineinfo.txt
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\gxoytrkaz-shm
%LOCALAPPDATA%low\gxoytrkaz
%LOCALAPPDATA%low\chd6ywevi
%LOCALAPPDATA%low\chd6ywevi-shm
%LOCALAPPDATA%low\m2sgwlcms
%LOCALAPPDATA%low\m2sgwlcms-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\fraqbc8ws-shm
%TEMP%\tmpea7f.tmp
%TEMP%\tmpea7e.tmp
%TEMP%\tmpea1f.tmp
%TEMP%\tmpea1e.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\tmpe919.tmp
%TEMP%\tmpe91a.tmp
%TEMP%\tmpe917.tmp
%TEMP%\tmpe850.tmp
%TEMP%\tmpe84f.tmp
%TEMP%\tmpe84e.tmp
%TEMP%\tmpe84d.tmp
%TEMP%\tmpe82d.tmp
%TEMP%\tmpe82c.tmp
%TEMP%\tmpe283.tmp
%TEMP%\tmpe272.tmp
%TEMP%\tmpe233.tmp
%TEMP%\tmpe222.tmp
%TEMP%\tmpe212.tmp
%TEMP%\tmpe1f1.tmp
%TEMP%\tmpe201.tmp
%TEMP%\tmpe1df.tmp
%TEMP%\tmpe1e0.tmp
%TEMP%\tmpe1be.tmp
%TEMP%\tmpe1bf.tmp
%TEMP%\tmpe1bc.tmp
%TEMP%\tmpe1bd.tmp
%TEMP%\tmpe17b.tmp
%TEMP%\tmpe1ab.tmp
%TEMP%\tmpe851.tmp
%TEMP%\tmpe852.tmp
%TEMP%\tmpe874.tmp
%TEMP%\tmpe873.tmp
%TEMP%\tmpe905.tmp
%TEMP%\tmpe906.tmp
%TEMP%\tmpe8f4.tmp
%TEMP%\tmpe904.tmp
%TEMP%\tmpe8f2.tmp
%TEMP%\tmpe8f3.tmp
%TEMP%\tmpe8e0.tmp
%TEMP%\tmpe8e1.tmp
%TEMP%\tmpe8de.tmp
%TEMP%\tmpe8df.tmp
%TEMP%\tmpe8ce.tmp
%TEMP%\tmpe8cd.tmp
%TEMP%\tmpe8ab.tmp
%TEMP%\tmpe8bc.tmp
%TEMP%\tmpe8a9.tmp
%TEMP%\tmpe8aa.tmp
%TEMP%\tmpe898.tmp
%TEMP%\tmpe899.tmp
%TEMP%\tmpe896.tmp
%TEMP%\tmpe897.tmp
%TEMP%\tmpe884.tmp
%TEMP%\tmpe885.tmp
%TEMP%\tmpe918.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozglue.dll
%TEMP%\tmp59f.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\tmp4c7.tmp
%TEMP%\tmp4c8.tmp
%TEMP%\tmp4b5.tmp
%TEMP%\tmp4b6.tmp
%TEMP%\tmp4b3.tmp
%TEMP%\tmp4b4.tmp
%TEMP%\tmp4a2.tmp
%TEMP%\tmp4a3.tmp
%TEMP%\tmp490.tmp
%TEMP%\tmp4a1.tmp
%TEMP%\tmp48e.tmp
%TEMP%\tmp48f.tmp
%TEMP%\tmp47d.tmp
%TEMP%\tmp47e.tmp
%TEMP%\tmp47b.tmp
%TEMP%\tmp47c.tmp
%TEMP%\tmp469.tmp
%TEMP%\tmp46a.tmp
%TEMP%\tmp467.tmp
%TEMP%\tmp468.tmp
%TEMP%\tmp455.tmp
%TEMP%\tmp4f9.tmp
%TEMP%\tmp4f8.tmp
%TEMP%\tmp50a.tmp
%TEMP%\tmp509.tmp
%TEMP%\tmp56d.tmp
%TEMP%\tmp57e.tmp
%TEMP%\tmp55c.tmp
%TEMP%\tmp55d.tmp
%TEMP%\tmp54a.tmp
%TEMP%\tmp55b.tmp
%TEMP%\tmp548.tmp
%TEMP%\tmp549.tmp
%TEMP%\tmp546.tmp
%TEMP%\tmp547.tmp
%TEMP%\tmp536.tmp
%TEMP%\tmp535.tmp
%TEMP%\tmp533.tmp
%TEMP%\tmp534.tmp
%TEMP%\tmp521.tmp
%TEMP%\tmp522.tmp
%TEMP%\tmp51f.tmp
%TEMP%\tmp520.tmp
%TEMP%\tmp50d.tmp
%TEMP%\tmp51e.tmp
%TEMP%\tmp50b.tmp
%TEMP%\tmp50c.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\tmpe179.tmp
%TEMP%\tmp434.tmp
%TEMP%\tmp445.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\vcruntime140.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ucrtbase.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\softokn3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\qipcap.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\prldap60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssdbm3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssckbi.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nss3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\msvcp140.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32_inuse.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy_inuse.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\libegl.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\lgpllibs.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldif60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldap60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ia2marshal.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\freebl3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\breakpadinjector.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\sqlite3.dll
%TEMP%\tmp456.tmp
%TEMP%\tmpe17a.tmp
%TEMP%\tmpd441.tmp
%TEMP%\tmpbf87.tmp
%TEMP%\tmpbf84.tmp
%TEMP%\tmpbf85.tmp
%TEMP%\tmpbf73.tmp
%TEMP%\tmpbf74.tmp
%TEMP%\tmpbf71.tmp
%TEMP%\tmpbf72.tmp
%TEMP%\tmpbf5f.tmp
%TEMP%\tmpbf60.tmp
%TEMP%\tmpbf5d.tmp
%TEMP%\tmpbf5e.tmp
%TEMP%\tmpbf5b.tmp
%TEMP%\tmpbf5c.tmp
%TEMP%\tmpbf49.tmp
%TEMP%\tmpbf4a.tmp
%TEMP%\tmpbf38.tmp
%TEMP%\tmpbf39.tmp
%TEMP%\tmpbf36.tmp
%TEMP%\tmpbf37.tmp
%TEMP%\tmpbf24.tmp
%TEMP%\tmpbf25.tmp
%TEMP%\tmpbf86.tmp
%TEMP%\tmpbf99.tmp
%TEMP%\tmpbf98.tmp
%TEMP%\tmpbf9b.tmp
%TEMP%\tmpd13b.tmp
%TEMP%\tmpd13c.tmp
%TEMP%\tmpd12a.tmp
%TEMP%\tmpd129.tmp
%TEMP%\tmpd128.tmp
%TEMP%\tmpd118.tmp
%TEMP%\tmpd117.tmp
%TEMP%\tmpd116.tmp
%TEMP%\tmpd115.tmp
%TEMP%\tmpd114.tmp
%TEMP%\tmpc15a.tmp
%TEMP%\tmpc189.tmp
%TEMP%\tmpc159.tmp
%TEMP%\tmpc02e.tmp
%TEMP%\tmpc03f.tmp
%TEMP%\tmpc00d.tmp
%TEMP%\tmpc00e.tmp
%TEMP%\tmpbfad.tmp
%TEMP%\tmpbfbe.tmp
%TEMP%\tmpbfab.tmp
%TEMP%\tmpbfac.tmp
%TEMP%\tmpbf9a.tmp
%TEMP%\tmpd16d.tmp
%TEMP%\tmpbf13.tmp
%TEMP%\tmpbf14.tmp
%TEMP%\tmpbf11.tmp
%TEMP%\8705.tmp
%TEMP%\8704.tmp
%TEMP%\86b5.tmp
%TEMP%\86a4.tmp
%TEMP%\8684.tmp
%TEMP%\8645.tmp
%TEMP%\855a.tmp
%TEMP%\853a.tmp
%TEMP%\84fa.tmp
%TEMP%\84da.tmp
%TEMP%\8372.tmp
%TEMP%\8352.tmp
%TEMP%\8352.tmp-shm
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%TEMP%\8744.tmp
%TEMP%\8755.tmp
%TEMP%\8794.tmp-shm
%TEMP%\8794.tmp
%TEMP%\tmpbeff.tmp
%TEMP%\tmpbf00.tmp
%TEMP%\tmpbeed.tmp
%TEMP%\tmpbeee.tmp
%TEMP%\tmpbeeb.tmp
%TEMP%\tmpbeec.tmp
%TEMP%\tmpbeda.tmp
%TEMP%\tmpbedb.tmp
%TEMP%\tmpbed8.tmp
%TEMP%\tmpbed9.tmp
%TEMP%\tmpbec7.tmp
%TEMP%\tmpbec6.tmp
%TEMP%\tmpbea5.tmp
%TEMP%\tmpbea6.tmp
%TEMP%\tmpbe37.tmp
%TEMP%\tmpbe26.tmp
%TEMP%\tmpbe16.tmp
%TEMP%\tmpbe05.tmp
%TEMP%\tmpbdd5.tmp
%TEMP%\tmpbdd4.tmp
%TEMP%\tmpbdc4.tmp
%TEMP%\tmpbda3.tmp
%TEMP%\tmpbf12.tmp
%TEMP%\tmpd23d.tmp
%TEMP%\tmpe169.tmp
%TEMP%\tmpd17d.tmp
%TEMP%\tmpe0a0.tmp
%TEMP%\tmpe0a1.tmp
%TEMP%\tmpe08f.tmp
%TEMP%\tmpe090.tmp
%TEMP%\tmpe07d.tmp
%TEMP%\tmpe07e.tmp
%TEMP%\tmpe06b.tmp
%TEMP%\tmpe06c.tmp
%TEMP%\tmpe069.tmp
%TEMP%\tmpe06a.tmp
%TEMP%\tmpe048.tmp
%TEMP%\tmpe059.tmp
%TEMP%\tmpe038.tmp
%TEMP%\tmpe037.tmp
%TEMP%\tmpe026.tmp
%TEMP%\tmpe025.tmp
%TEMP%\tmpe024.tmp
%TEMP%\tmpe023.tmp
%TEMP%\tmpe022.tmp
%TEMP%\tmpe011.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ws7zn1lk8tw5ce9s.zip
%TEMP%\tmpe0e2.tmp
%TEMP%\tmpe0e1.tmp
%TEMP%\tmpe0e4.tmp
%TEMP%\tmpe0e3.tmp
%TEMP%\tmpe166.tmp
%TEMP%\tmpe167.tmp
%TEMP%\tmpe154.tmp
%TEMP%\tmpe155.tmp
%TEMP%\tmpe152.tmp
%TEMP%\tmpe153.tmp
%TEMP%\tmpe141.tmp
%TEMP%\tmpe142.tmp
%TEMP%\tmpe13f.tmp
%TEMP%\tmpe140.tmp
%TEMP%\tmpe12e.tmp
%TEMP%\tmpe12d.tmp
%TEMP%\tmpe12b.tmp
%TEMP%\tmpe12c.tmp
%TEMP%\tmpe119.tmp
%TEMP%\tmpe11a.tmp
%TEMP%\tmpe117.tmp
%TEMP%\tmpe118.tmp
%TEMP%\tmpe106.tmp
%TEMP%\tmpe107.tmp
%TEMP%\tmpe0f4.tmp
%TEMP%\tmpe0f5.tmp
%TEMP%\tmpd17e.tmp
%TEMP%\tmpe168.tmp
%TEMP%\tmpd401.tmp
%TEMP%\tmpd2c8.tmp
%TEMP%\tmpd202.tmp
%TEMP%\tmpd1ff.tmp
%TEMP%\tmpd200.tmp
%TEMP%\tmpd1dd.tmp
%TEMP%\tmpd1ee.tmp
%TEMP%\tmpd1db.tmp
%TEMP%\tmpd1dc.tmp
%TEMP%\tmpd1ca.tmp
%TEMP%\tmpd1da.tmp
%TEMP%\tmpd1c8.tmp
%TEMP%\tmpd1c9.tmp
%TEMP%\tmpd1b6.tmp
%TEMP%\tmpd1b7.tmp
%TEMP%\tmpd1a5.tmp
%TEMP%\tmpd1a6.tmp
%TEMP%\tmpd193.tmp
%TEMP%\tmpd1a4.tmp
%TEMP%\tmpd191.tmp
%TEMP%\tmpd192.tmp
%TEMP%\tmpd17f.tmp
%TEMP%\tmpd180.tmp
%TEMP%\tmpd201.tmp
%TEMP%\tmpd213.tmp
%TEMP%\tmpd203.tmp
%TEMP%\tmpd215.tmp
%TEMP%\tmpd2c6.tmp
%TEMP%\tmpd2a5.tmp
%TEMP%\tmpd2a6.tmp
%TEMP%\tmpd284.tmp
%TEMP%\tmpd285.tmp
%TEMP%\tmpd263.tmp
%TEMP%\tmpd264.tmp
%TEMP%\tmpd251.tmp
%TEMP%\tmpd252.tmp
%TEMP%\tmpd24f.tmp
%TEMP%\tmpd16c.tmp
%TEMP%\tmpd250.tmp
%TEMP%\tmpd23e.tmp
%TEMP%\tmpd23b.tmp
%TEMP%\tmpd23c.tmp
%TEMP%\tmpd22a.tmp
%TEMP%\tmpd23a.tmp
%TEMP%\tmpd228.tmp
%TEMP%\tmpd229.tmp
%TEMP%\tmpd216.tmp
%TEMP%\tmpd227.tmp
%TEMP%\tmpd214.tmp
%TEMP%\tmpd2c7.tmp
%TEMP%\tmp59e.tmp

Deletes itself.

Network activity

Connects to

'be######neprihoditodna.top':443
'17#.#0.40.83':7710
'10#.#34.38.124':35200
'99###########51-service10020125999080321.xyz':80
'ap#.ip.sb':443
'17#.#0.40.164':62824

TCP

HTTP GET requests

http://99###########51-service10020125999080321.xyz/raccon.exe
http://99###########51-service10020125999080321.xyz/reestr.exe

HTTP POST requests

http://99###########51-service10020125999080321.xyz/
http://17#.##.40.164:62824/ via 17#.#0.40.164
http://ga##a.xyz//
http://jb##ef.ga/
http://17#.##.40.83:7710// via 17#.#0.40.83
http://10#.###.38.124:35200// via 10#.#34.38.124

'te##te.in':443

'be######neprihoditodna.top':443

'b.##llo8.ru':443

'ap#.ip.sb':443

UDP

DNS ASK 99###########older1002002131-service1002.space
DNS ASK b.##llo8.ru
DNS ASK ga##a.xyz
DNS ASK be######neprihoditodna.top
DNS ASK te##te.in
DNS ASK 99###########51-service10020125999080321.xyz
DNS ASK 99############1-service10020125999080321.website
DNS ASK 99###########71-service100201dom25999080321.ru
DNS ASK 99###########t1341-service10020125999080321.ru
DNS ASK 99############2671-service10020125999080321.online
DNS ASK 99############5671-service10020125999080321.tech
DNS ASK 99###########13461-service10020125999080321.net
DNS ASK 99############4781-service10020125999080321.info
DNS ASK 99###########13561-service10020125999080321.su
DNS ASK 99###########t3481-service10020125999080321.ru
DNS ASK 99############3531-service1002012425999080321.ru
DNS ASK 99############34831-service10020125999080321.space
DNS ASK 99############46831-service10020125999080321.space
DNS ASK 99############47831-service10020125999080321.space
DNS ASK 99############36831-service10020125999080321.space
DNS ASK 99############25831-service10020125999080321.space
DNS ASK 99###########older33417-012425999080321.space
DNS ASK 99###########older1002002531-service1002.space
DNS ASK 99###########older1002002431-service1002.space
DNS ASK 99##########folder3100231-service1002.space
DNS ASK 99###########older1002002231-service1002.space
DNS ASK ap#.ip.sb
DNS ASK jb##ef.ga

Miscellaneous

Creates and executes the following

'%TEMP%\ede.exe'
'%TEMP%\14c8.exe'
'%TEMP%\3286.exe'
'%TEMP%\3c09.exe'
'%TEMP%\4731.exe'
'%TEMP%\4eb1.exe'
'%TEMP%\5a36.exe'
'%TEMP%\6483.exe'

Executes the following

'%WINDIR%\syswow64\explorer.exe'
'%WINDIR%\explorer.exe'
'%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial