Trojan.Siggen29.15870

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\MyService] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\MyService] 'ImagePath' = '%WINDIR%\System\MyService\xrmjad.exe -m s'
[HKLM\System\CurrentControlSet\Services\NPF] 'ImagePath' = 'system32\drivers\NPF.sys'

Creates the following services

'MyService' %WINDIR%\System\MyService\xrmjad.exe -m s
'NPF' system32\drivers\NPF.sys

Modifies file system

Creates the following files

%WINDIR%\system\myservice\.myservice.log
%WINDIR%\temp\_mei28962\api-ms-win-core-profile-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-processthreads-l1-1-1.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-processthreads-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-processenvironment-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-namedpipe-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-memory-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-localization-l1-2-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-libraryloader-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-interlocked-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-heap-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-handle-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-file-l2-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-file-l1-2-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-file-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-errorhandling-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-rtlsupport-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-synch-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-utility-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-synch-l1-2-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-time-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-string-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-stdio-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-runtime-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-process-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-math-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-locale-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-heap-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-filesystem-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-environment-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-convert-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-crt-conio-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-util-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-timezone-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-sysinfo-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-debug-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-string-l1-1-0.dll
%WINDIR%\temp\_mei28962\api-ms-win-core-datetime-l1-1-0.dll
%WINDIR%\temp\_mei28962\cryptodome\math\_modexp.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_keccak.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_ghash_portable.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_ghash_clmul.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_sha512.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_sha384.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_sha256.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_sha224.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_sha1.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_ripemd160.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_md5.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_md4.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_md2.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_blake2s.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_blake2b.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_ofb.pyd
%WINDIR%\temp\_mei28962\cryptodome\hash\_poly1305.pyd
%WINDIR%\temp\_mei28962\cryptodome\protocol\_scrypt.pyd
%WINDIR%\temp\_mei28962\_ssl.pyd
%WINDIR%\temp\_mei28962\cryptodome\publickey\_ec_ws.pyd
%WINDIR%\temp\_mei28962\_socket.pyd
%WINDIR%\temp\_mei28962\_queue.pyd
%WINDIR%\temp\_mei28962\_multiprocessing.pyd
%WINDIR%\temp\_mei28962\_lzma.pyd
%WINDIR%\temp\_mei28962\_hashlib.pyd
%WINDIR%\temp\_mei28962\_decimal.pyd
%WINDIR%\temp\_mei28962\_ctypes.pyd
%WINDIR%\temp\_mei28962\_cffi_backend.cp37-win32.pyd
%WINDIR%\temp\_mei28962\_bz2.pyd
%WINDIR%\temp\_mei28962\vcruntime140.dll
%WINDIR%\temp\_mei28962\cryptodome\util\_strxor.pyd
%WINDIR%\temp\_mei28962\cryptodome\util\_cpuid_c.pyd
%WINDIR%\temp\_mei28962\cryptodome\publickey\_x25519.pyd
%WINDIR%\temp\_mei28962\cryptodome\publickey\_ed448.pyd
%WINDIR%\temp\_mei28962\cryptodome\publickey\_ed25519.pyd
%WINDIR%\temp\_mei28962\api-ms-win-core-console-l1-1-0.dll
%WINDIR%\temp\_mei28962\importlib_metadata-6.7.0.dist-info\license
%WINDIR%\temp\caba2c1.tmp
%WINDIR%\temp\_mei28962\grpc\_cython\cygrpc.cp37-win32.pyd
%WINDIR%\temp\tar48fa.tmp
%WINDIR%\temp\cab48e8.tmp
%WINDIR%\temp\cab48e9.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
global\npf_{a16b3811-6333-49f6-89f3-3db75d9d59b9}
%WINDIR%\temp\udd3dab.tmp
%WINDIR%\system\myservice\services.exe
<DRIVERS>\npf.sys
%WINDIR%\syswow64\packet.dll
%WINDIR%\syswow64\wpcap.dll
%WINDIR%\system\myservice\s.conf
%WINDIR%\system\myservice\e.conf
%WINDIR%\temp\tar1b31.tmp
%WINDIR%\temp\tar1b71.tmp
%WINDIR%\temp\tar48ea.tmp
%WINDIR%\temp\tar4a25.tmp
%WINDIR%\temp\_mei28962\google\protobuf\pyext\_message.cp37-win32.pyd
%WINDIR%\temp\cab6054.tmp
%WINDIR%\temp\tar8d2d.tmp
%WINDIR%\temp\cab8d2c.tmp
%WINDIR%\temp\tar8cfc.tmp
%WINDIR%\temp\cab8cfb.tmp
%WINDIR%\temp\tar7758.tmp
%WINDIR%\temp\cab7757.tmp
%WINDIR%\temp\tar7727.tmp
%WINDIR%\temp\cab7726.tmp
%WINDIR%\temp\tar6164.tmp
%WINDIR%\temp\cab6163.tmp
%WINDIR%\temp\tar6105.tmp
%WINDIR%\temp\cab6104.tmp
%WINDIR%\temp\tar60a5.tmp
%WINDIR%\temp\cab60a4.tmp
%WINDIR%\temp\tar6055.tmp
%WINDIR%\temp\tar1ae1.tmp
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_ocb.pyd
nul
%WINDIR%\temp\_mei28962\importlib_metadata-6.7.0.dist-info\installer
%WINDIR%\temp\_mei28962\base_library.zip
%WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\zip-safe
%WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\top_level.txt
%WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\wheel
%WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\record
%WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\metadata
%WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\license
%WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\installer
%WINDIR%\temp\_mei28962\unicodedata.pyd
%WINDIR%\temp\_mei28962\ucrtbase.dll
%WINDIR%\temp\_mei28962\select.pyd
%WINDIR%\temp\_mei28962\python37.dll
%WINDIR%\temp\_mei28962\pyexpat.pyd
%WINDIR%\temp\_mei28962\libssl-1_1.dll
%WINDIR%\temp\_mei28962\libcrypto-1_1.dll
%WINDIR%\temp\_mei28962\grpc\_cython\_credentials\roots.pem
%WINDIR%\temp\_mei28962\google\protobuf\internal\_api_implementation.cp37-win32.pyd
%WINDIR%\temp\cab1b30.tmp
%WINDIR%\temp\_mei28962\importlib_metadata-6.7.0.dist-info\metadata
%WINDIR%\temp\cab1ae0.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\2d85f72862b55c4eadd9e66e06947f3d
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\2d85f72862b55c4eadd9e66e06947f3d
%WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\top_level.txt
%WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\entry_points.txt
%WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\wheel
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\14232b434cf29d4c4fb335a86d7fffe3
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\14232b434cf29d4c4fb335a86d7fffe3
%WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\record
%WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\metadata
%WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\installer
%WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\copying.txt
%WINDIR%\temp\_mei28962\importlib_metadata-6.7.0.dist-info\top_level.txt
%WINDIR%\temp\_mei28962\importlib_metadata-6.7.0.dist-info\wheel
%WINDIR%\temp\_mei28962\importlib_metadata-6.7.0.dist-info\record
%WINDIR%\temp\cab1b70.tmp
%WINDIR%\temp\cab4a24.tmp
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_eksblowfish.pyd
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\metadata
%WINDIR%\temp\_mei26842\cryptodome\util\_cpuid_c.pyd
%WINDIR%\temp\_mei26842\cryptodome\publickey\_x25519.pyd
%WINDIR%\temp\_mei26842\cryptodome\publickey\_ed448.pyd
%WINDIR%\temp\_mei26842\cryptodome\publickey\_ed25519.pyd
%WINDIR%\temp\_mei26842\cryptodome\publickey\_ec_ws.pyd
%WINDIR%\temp\_mei26842\cryptodome\protocol\_scrypt.pyd
%WINDIR%\temp\_mei26842\cryptodome\math\_modexp.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_poly1305.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_keccak.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_ghash_portable.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_ghash_clmul.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_sha512.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_sha384.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_sha256.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_sha224.pyd
%WINDIR%\temp\_mei26842\cryptodome\util\_strxor.pyd
%WINDIR%\temp\_mei26842\_bz2.pyd
%WINDIR%\temp\_mei26842\api-ms-win-core-handle-l1-1-0.dll
%WINDIR%\temp\_mei26842\_cffi_backend.cp37-win32.pyd
%WINDIR%\temp\_mei26842\api-ms-win-core-file-l2-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-file-l1-2-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-file-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-errorhandling-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-debug-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-datetime-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-console-l1-1-0.dll
%WINDIR%\temp\_mei26842\_ssl.pyd
%WINDIR%\temp\_mei26842\_socket.pyd
%WINDIR%\temp\_mei26842\_queue.pyd
%WINDIR%\temp\_mei26842\_multiprocessing.pyd
%WINDIR%\temp\_mei26842\_lzma.pyd
%WINDIR%\temp\_mei26842\_hashlib.pyd
%WINDIR%\temp\_mei26842\_decimal.pyd
%WINDIR%\temp\_mei26842\_ctypes.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_sha1.pyd
%WINDIR%\temp\_mei26842\vcruntime140.dll
%WINDIR%\temp\_mei26842\cryptodome\hash\_ripemd160.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_pkcs1_decode.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_salsa20.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_arc4.pyd
%WINDIR%\system\myservice\csrs_upgrade.exe
%WINDIR%\system\myservice\csrs_upgrade.exe.s.remote
%WINDIR%\system\myservice\csrs_upgrade.exe.remote
%WINDIR%\system\myservice\.asst_bin.v
%WINDIR%\system\myservice\.myservice.t.s.remote
%WINDIR%\system\myservice\.myservice.t.remote
%WINDIR%\system\myservice\.task_config.v
%WINDIR%\system\myservice\.myservice.c.s.remote
%WINDIR%\system\myservice\.myservice.c.remote
%WINDIR%\system\myservice\.app_config.v
%WINDIR%\system\myservice\.app_bin.v
%WINDIR%\system\myservice\.myservice
%WINDIR%\system\myservice\xrmjad.exe
%WINDIR%\temp\_mei26842\cryptodome\cipher\_chacha20.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_aes.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_md4.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_aesni.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_md2.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_blake2s.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_blake2b.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ofb.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ocb.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_eksblowfish.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ecb.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_des3.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_des.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ctr.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_cfb.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_cbc.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_cast.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_blowfish.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_arc2.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_md5.pyd
%WINDIR%\temp\_mei26842\api-ms-win-crt-filesystem-l1-1-0.dll
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_des3.pyd
%WINDIR%\temp\_mei26842\api-ms-win-core-libraryloader-l1-1-0.dll
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\copying.txt
%WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\top_level.txt
%WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\wheel
%WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\record
%WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\metadata
%WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\license
%WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\installer
%WINDIR%\temp\_mei26842\grpc\_cython\_credentials\roots.pem
%WINDIR%\temp\_mei26842\base_library.zip
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\zip-safe
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\top_level.txt
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\wheel
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\record
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\metadata
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\license
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\installer
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\record
%WINDIR%\temp\_mei26842\api-ms-win-core-interlocked-l1-1-0.dll
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\wheel
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_des.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_ctr.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_cfb.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_cbc.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_cast.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_blowfish.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_arc2.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_aesni.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_aes.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_pkcs1_decode.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_chacha20.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_salsa20.pyd
%WINDIR%\temp\_mei28962\cryptodome\cipher\_arc4.pyd
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\top_level.txt
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\entry_points.txt
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\installer
%WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_ecb.pyd
%WINDIR%\temp\_mei26842\unicodedata.pyd
%WINDIR%\temp\_mei26842\api-ms-win-crt-environment-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-conio-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-util-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-timezone-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-sysinfo-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-synch-l1-2-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-synch-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-string-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-rtlsupport-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-profile-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-processthreads-l1-1-1.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-processthreads-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-processenvironment-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-namedpipe-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-memory-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-localization-l1-2-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-convert-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-heap-l1-1-0.dll
%WINDIR%\temp\_mei26842\select.pyd
%WINDIR%\temp\_mei26842\api-ms-win-crt-heap-l1-1-0.dll
%WINDIR%\temp\_mei26842\python37.dll
%WINDIR%\temp\_mei26842\pyexpat.pyd
%WINDIR%\temp\_mei26842\libssl-1_1.dll
%WINDIR%\temp\_mei26842\libcrypto-1_1.dll
%WINDIR%\temp\_mei26842\grpc\_cython\cygrpc.cp37-win32.pyd
%WINDIR%\temp\_mei26842\google\protobuf\pyext\_message.cp37-win32.pyd
%WINDIR%\temp\_mei26842\google\protobuf\internal\_api_implementation.cp37-win32.pyd
%WINDIR%\temp\_mei26842\api-ms-win-crt-utility-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-time-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-string-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-stdio-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-runtime-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-process-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-math-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-locale-l1-1-0.dll
%WINDIR%\temp\_mei26842\ucrtbase.dll
%WINDIR%\temp\tara2c2.tmp

Deletes the following files

%WINDIR%\system\myservice\.app_bin.v
%WINDIR%\temp\_mei26842\libcrypto-1_1.dll
%WINDIR%\temp\_mei26842\libssl-1_1.dll
%WINDIR%\temp\_mei26842\pyexpat.pyd
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\copying.txt
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\entry_points.txt
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\installer
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\metadata
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\top_level.txt
%WINDIR%\temp\_mei26842\_cffi_backend.cp37-win32.pyd
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\wheel
%WINDIR%\temp\_mei26842\python37.dll
%WINDIR%\temp\_mei26842\select.pyd
%WINDIR%\temp\_mei26842\ucrtbase.dll
%WINDIR%\temp\_mei26842\unicodedata.pyd
%WINDIR%\temp\_mei26842\vcruntime140.dll
%WINDIR%\temp\_mei26842\_bz2.pyd
%WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\wheel
%WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\record
%WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\top_level.txt
%WINDIR%\temp\_mei26842\cryptodome\publickey\_x25519.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_sha384.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_sha512.pyd
%WINDIR%\temp\_mei26842\cryptodome\math\_modexp.pyd
%WINDIR%\temp\_mei26842\cryptodome\protocol\_scrypt.pyd
%WINDIR%\temp\_mei26842\cryptodome\publickey\_ec_ws.pyd
%WINDIR%\temp\_mei26842\cryptodome\publickey\_ed25519.pyd
%WINDIR%\temp\_mei26842\cryptodome\publickey\_ed448.pyd
%WINDIR%\temp\_mei26842\cryptodome\util\_cpuid_c.pyd
%WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\metadata
%WINDIR%\temp\_mei26842\cryptodome\util\_strxor.pyd
%WINDIR%\temp\_mei26842\google\protobuf\internal\_api_implementation.cp37-win32.pyd
%WINDIR%\temp\_mei26842\google\protobuf\pyext\_message.cp37-win32.pyd
%WINDIR%\temp\_mei26842\grpc\_cython\cygrpc.cp37-win32.pyd
%WINDIR%\temp\_mei26842\grpc\_cython\_credentials\roots.pem
%WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\installer
%WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\license
%WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\record
%WINDIR%\temp\tar1ae1.tmp
%WINDIR%\temp\caba2c1.tmp
%WINDIR%\temp\_mei26842\_hashlib.pyd
%WINDIR%\temp\cab6054.tmp
%WINDIR%\temp\tar6055.tmp
%WINDIR%\temp\cab60a4.tmp
%WINDIR%\temp\tar60a5.tmp
%WINDIR%\temp\cab6104.tmp
%WINDIR%\temp\tar6105.tmp
%WINDIR%\temp\cab6163.tmp
%WINDIR%\temp\cab7726.tmp
%WINDIR%\temp\_mei26842\_decimal.pyd
%WINDIR%\temp\tar7727.tmp
%WINDIR%\temp\cab7757.tmp
%WINDIR%\temp\tar7758.tmp
%WINDIR%\temp\cab8cfb.tmp
%WINDIR%\temp\tar8cfc.tmp
%WINDIR%\temp\cab8d2c.tmp
%WINDIR%\temp\tar8d2d.tmp
%WINDIR%\temp\tar4a25.tmp
%WINDIR%\temp\_mei26842\cryptodome\hash\_sha256.pyd
%WINDIR%\temp\cab4a24.tmp
%WINDIR%\temp\cab1ae0.tmp
%WINDIR%\temp\_mei26842\_lzma.pyd
%WINDIR%\temp\_mei26842\_multiprocessing.pyd
%WINDIR%\temp\_mei26842\_queue.pyd
%WINDIR%\temp\_mei26842\_socket.pyd
%WINDIR%\temp\_mei26842\_ssl.pyd
%WINDIR%\system\myservice\csrs_upgrade.exe
%WINDIR%\system\myservice\csrs_upgrade.exe.s
%WINDIR%\temp\_mei26842\_ctypes.pyd
%WINDIR%\temp\cab48e8.tmp
%WINDIR%\temp\cab1b70.tmp
%WINDIR%\temp\tar1b71.tmp
%WINDIR%\temp\cab1b30.tmp
%WINDIR%\temp\tar1b31.tmp
%WINDIR%\temp\udd3dab.tmp
%WINDIR%\temp\cab48e9.tmp
%WINDIR%\temp\tar48fa.tmp
%WINDIR%\temp\tar48ea.tmp
%WINDIR%\temp\tar6164.tmp
%WINDIR%\temp\_mei26842\cryptodome\hash\_sha224.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_blake2b.pyd
%WINDIR%\temp\_mei26842\api-ms-win-core-libraryloader-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-localization-l1-2-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-memory-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-namedpipe-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-processenvironment-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-processthreads-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-processthreads-l1-1-1.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-rtlsupport-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-convert-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-string-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-synch-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-synch-l1-2-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-sysinfo-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-timezone-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-util-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-conio-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-interlocked-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-profile-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-heap-l1-1-0.dll
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\top_level.txt
%WINDIR%\system\myservice\.app_config.v
%WINDIR%\system\myservice\.task_config.v
%WINDIR%\system\myservice\.asst_bin.v
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\installer
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\license
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\metadata
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\record
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\wheel
%WINDIR%\temp\_mei26842\api-ms-win-core-file-l2-1-0.dll
%WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\zip-safe
%WINDIR%\temp\_mei26842\api-ms-win-core-console-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-datetime-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-debug-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-errorhandling-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-file-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-file-l1-2-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-core-handle-l1-1-0.dll
%WINDIR%\temp\_mei26842\base_library.zip
%WINDIR%\temp\_mei26842\cryptodome\hash\_ripemd160.pyd
%WINDIR%\temp\_mei26842\api-ms-win-crt-heap-l1-1-0.dll
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_des.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_des3.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ecb.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_eksblowfish.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ocb.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ofb.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_salsa20.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_blake2s.pyd
%WINDIR%\temp\_mei26842\api-ms-win-crt-filesystem-l1-1-0.dll
%WINDIR%\temp\_mei26842\cryptodome\hash\_ghash_clmul.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_ghash_portable.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_keccak.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_md2.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_md4.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_md5.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_poly1305.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ctr.pyd
%WINDIR%\temp\_mei26842\cryptodome\hash\_sha1.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_cfb.pyd
%WINDIR%\temp\_mei26842\api-ms-win-crt-utility-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-locale-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-math-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-process-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-runtime-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-stdio-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-string-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-time-l1-1-0.dll
%WINDIR%\temp\_mei26842\api-ms-win-crt-environment-l1-1-0.dll
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_cast.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_arc4.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_chacha20.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_pkcs1_decode.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_aes.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_aesni.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_arc2.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_blowfish.pyd
%WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_cbc.pyd
%WINDIR%\temp\tara2c2.tmp

Moves the following files

from %WINDIR%\system\myservice\.myservice.c.remote to %WINDIR%\system\myservice\.myservice.c
from %WINDIR%\system\myservice\.myservice.c.s.remote to %WINDIR%\system\myservice\.myservice.c.s
from %WINDIR%\system\myservice\.myservice.t.remote to %WINDIR%\system\myservice\.myservice.t
from %WINDIR%\system\myservice\.myservice.t.s.remote to %WINDIR%\system\myservice\.myservice.t.s
from %WINDIR%\system\myservice\csrs_upgrade.exe.s.remote to %WINDIR%\system\myservice\csrs_upgrade.exe.s
from %WINDIR%\system\myservice\csrs_upgrade.exe to %WINDIR%\system\myservice\csrs.exe

Substitutes the following files

%WINDIR%\system\myservice\.app_bin.v
%WINDIR%\system\myservice\.app_config.v
%WINDIR%\system\myservice\csrs_upgrade.exe

Network activity

Connects to

'91.##5.152.45':9999
'21#.#92.15.157':5678
'5.##.176.171':8171
'91.##5.152.45':1234
'wh#####yip.akamai.com':80
'ch#####.amazonaws.com':80
'ic###azip.com':443
'id##t.me':80
'my####rnalip.com':443
'if##nfig.io':80
'sh###yip.com':443
'localhost':49199
'x1.#.lencr.org':80
'microsoft.com':80

TCP

HTTP GET requests

http://21#.##2.15.157:5678/a/WX4/v via 21#.#92.15.157
http://91.###.152.45:1234/s/WX4/s via 91.##5.152.45
http://id##t.me/
http://if##nfig.io/ip
http://ch#####.amazonaws.com/
http://91.###.152.45:1234/s/WX4/d via 91.##5.152.45
http://wh#####yip.akamai.com/
http://91.###.152.45:1234/s/WX4/v via 91.##5.152.45
http://21#.##2.15.157:5678/t/s via 21#.#92.15.157
http://21#.##2.15.157:5678/t/d via 21#.#92.15.157
http://21#.##2.15.157:5678/t/v via 21#.#92.15.157
http://5.##.#76.171:8171/c/v via 5.##.176.171
http://5.##.#76.171:8171/a/WX4/v via 5.##.176.171
http://21#.##2.15.157:5678/c/s via 21#.#92.15.157
http://21#.##2.15.157:5678/c/d via 21#.#92.15.157
http://21#.##2.15.157:5678/c/v via 21#.#92.15.157
http://x1.#.lencr.org/
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

Other

'91.##5.152.45':9999
'ic###azip.com':443
'my####rnalip.com':443
'sh###yip.com':443
'localhost':49199
'localhost':49207

UDP

DNS ASK wh#####yip.akamai.com
DNS ASK my####rnalip.com
DNS ASK ch#####.amazonaws.com
DNS ASK if##nfig.io
DNS ASK sh###yip.com
DNS ASK ic###azip.com
DNS ASK id##t.me
DNS ASK x1.#.lencr.org
DNS ASK microsoft.com

Miscellaneous

Creates and executes the following

'%WINDIR%\system\myservice\xrmjad.exe' -m s
'%WINDIR%\system\myservice\xrmjad.exe' -action restart
'%WINDIR%\system\myservice\csrs_upgrade.exe' -b
'%WINDIR%\system\myservice\csrs.exe' -l 127.0.0.1:49199 -t 32
'%WINDIR%\system\myservice\services.exe' --conf %WINDIR%\system\MyService\s.conf

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial