Trojan.Siggen14.16830

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\squirreltemp\background.gif
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\splat.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\squirrel.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\nodatime.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\tzdb.nzd
%LOCALAPPDATA%\outlookgooglecalendarsync\outlookgooglecalendarsync.exe
%LOCALAPPDATA%\outlookgooglecalendarsync\packages\squirreltemp\tempa
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\ogcalsync.log
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\settings.xml
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\google.apis.calendar.v3.dll
%APPDATA%\outlook google calendar sync\ogcalsync.log
%HOMEPATH%\desktop\outlook google calendar sync.lnk
%LOCALAPPDATA%\squirreltemp\squirrelsetup.log
%LOCALAPPDATA%\outlookgooglecalendarsync\packages\releases
%TEMP%\e7e52350-f95b-41dd-ae62-93c88589094f.png
%LOCALAPPDATA%\outlookgooglecalendarsync\app.ico
%TEMP%\.squirrel-lock-2e71665db75630e4fa434b64cc7d16e3218c6c4b
%LOCALAPPDATA%\microsoft\forms\frmdata64.dat
%TEMP%\outlook logging\firstrun.log
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\outlookgooglecalendarsync.exe.config
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\outlookgooglecalendarsync.exe.manifest
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\outlookgooglecalendarsync.exe
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\nuget.squirrel.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\newtonsoft.json.net35.dll
%LOCALAPPDATA%\squirreltemp\releases
%LOCALAPPDATA%\squirreltemp\update.exe
%LOCALAPPDATA%\outlookgooglecalendarsync\update.exe
%LOCALAPPDATA%\outlookgooglecalendarsync\packages\outlookgooglecalendarsync-2.6.0-beta-full.nupkg
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\clickoncetosquirrelmigrator.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\deltacompressiondotnet.msdelta.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\deltacompressiondotnet.patchapi.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\dotnetopenauth.dll
%WINDIR%\inf\outlook\outlperf.h
%APPDATA%\microsoft\windows\start menu\programs\paul woolcock\outlook google calendar sync.lnk
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\google.apis.authentication.oauth2.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\icsharpcode.sharpziplib.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\log4net.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\logger.xml
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\mono.cecil.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\mono.cecil.mdb.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\mono.cecil.pdb.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\deltacompressiondotnet.dll
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\mono.cecil.rocks.dll
%LOCALAPPDATA%\squirreltemp\outlookgooglecalendarsync-2.6.0-beta-full.nupkg
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\google.apis.dll
%WINDIR%\inf\outlook\0009\outlperf.ini

Удаляет следующие файлы

%TEMP%\e7e52350-f95b-41dd-ae62-93c88589094f.png
%TEMP%\.squirrel-lock-2e71665db75630e4fa434b64cc7d16e3218c6c4b
%LOCALAPPDATA%\squirreltemp\background.gif
%LOCALAPPDATA%\squirreltemp\outlookgooglecalendarsync-2.6.0-beta-full.nupkg
%LOCALAPPDATA%\squirreltemp\releases
%LOCALAPPDATA%\squirreltemp\update.exe

Перемещает следующие файлы

%LOCALAPPDATA%\outlookgooglecalendarsync\packages\squirreltemp\tempa в %LOCALAPPDATA%\outlookgooglecalendarsync\packages\releases
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\settings.xml в %APPDATA%\outlook google calendar sync\settings.xml
%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\ogcalsync.log в %APPDATA%\outlook google calendar sync\ogcalsync.log

Сетевая активность

Подключается к

'ra#.####ubusercontent.com':443
'gi##ub.com':443
'ap#.#ithub.com':443
'no###ime.org':80
'no###ime.org':443
'go#.gl':80
'go#.gl':443
'google.com':80
'google.com':443

TCP

Другие

'ra#.####ubusercontent.com':443
'gi##ub.com':443
'ap#.#ithub.com':443
'no###ime.org':443
'go#.gl':443
'google.com':443

UDP

DNS ASK ra#.####ubusercontent.com
DNS ASK gi##ub.com
DNS ASK ap#.#ithub.com
DNS ASK no###ime.org
DNS ASK go#.gl
DNS ASK google.com

Другое

Ищет следующие окна

ClassName: 'DDEMLMom' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'Static' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'mspim_wnd32' WindowName: 'Microsoft Outlook'
ClassName: 'rencat' WindowName: ''

Создает и запускает на исполнение

'%LOCALAPPDATA%\squirreltemp\update.exe' --install .
'%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\outlookgooglecalendarsync.exe' --squirrel-install 2.6.0-beta
'%LOCALAPPDATA%\outlookgooglecalendarsync\app-2.6.0-beta\outlookgooglecalendarsync.exe' --squirrel-firstrun

Запускает на исполнение