Trojan.Siggen33.39930

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\<Имя файла>.exe

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%APPDATA%\mozilla\firefox\profiles.ini
%APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\signons.sqlite
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\signons.sqlite
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\login data
%LOCALAPPDATA%\microsoft\edge\user data\default\web data

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei28682\crypto\cipher\_arc4.pyd
%TEMP%\_mei28682\crypto\cipher\_salsa20.pyd
%TEMP%\_mei28682\crypto\cipher\_chacha20.pyd
%TEMP%\_mei28682\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_des.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei28682\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei28682\crypto\hash\_blake2b.pyd
%TEMP%\_mei28682\crypto\hash\_blake2s.pyd
%TEMP%\_mei28682\crypto\hash\_md2.pyd
%TEMP%\_mei28682\crypto\hash\_md4.pyd
%TEMP%\_mei28682\crypto\hash\_md5.pyd
%TEMP%\_mei28682\crypto\hash\_ripemd160.pyd
%TEMP%\_mei28682\crypto\hash\_sha1.pyd
%TEMP%\_mei28682\crypto\hash\_sha224.pyd
%TEMP%\_mei28682\crypto\hash\_sha256.pyd
%TEMP%\_mei28682\crypto\hash\_sha384.pyd
%TEMP%\_mei28682\crypto\hash\_sha512.pyd
%TEMP%\_mei28682\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei28682\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei28682\crypto\hash\_keccak.pyd
%TEMP%\_mei28682\crypto\hash\_poly1305.pyd
%TEMP%\_mei28682\crypto\math\_modexp.pyd
%TEMP%\_mei28682\crypto\protocol\_scrypt.pyd
%TEMP%\_mei28682\crypto\publickey\_curve25519.pyd
%TEMP%\_mei28682\crypto\publickey\_curve448.pyd
%TEMP%\_mei28682\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei28682\crypto\publickey\_ed25519.pyd
%TEMP%\_mei28682\crypto\publickey\_ed448.pyd
%TEMP%\_mei28682\crypto\util\_cpuid_c.pyd
%TEMP%\_mei28682\crypto\util\_strxor.pyd
%TEMP%\_mei28682\pil\_imaging.cp313-win_amd64.pyd
%TEMP%\_mei28682\pil\_imagingcms.cp313-win_amd64.pyd
%TEMP%\_mei28682\pil\_imagingmath.cp313-win_amd64.pyd
%TEMP%\_mei28682\pil\_imagingtk.cp313-win_amd64.pyd
%TEMP%\_mei28682\pil\_webp.cp313-win_amd64.pyd
%TEMP%\_mei28682\pyqt5\qt5\bin\msvcp140.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\msvcp140_1.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\qt5core.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\qt5dbus.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\qt5gui.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\qt5network.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\qt5qml.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\qt5qmlmodels.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\qt5quick.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\qt5svg.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\qt5websockets.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\qt5widgets.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\vcruntime140.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\vcruntime140_1.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\d3dcompiler_47.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\libegl.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\libglesv2.dll
%TEMP%\_mei28682\pyqt5\qt5\bin\opengl32sw.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\generic\qtuiotouchplugin.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\iconengines\qsvgicon.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\imageformats\qgif.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\imageformats\qicns.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\imageformats\qico.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\imageformats\qjpeg.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\imageformats\qsvg.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\imageformats\qtga.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\imageformats\qtiff.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\imageformats\qwbmp.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\imageformats\qwebp.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\platforms\qminimal.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\platforms\qoffscreen.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\platforms\qwebgl.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\platforms\qwindows.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\platformthemes\qxdgdesktopportal.dll
%TEMP%\_mei28682\pyqt5\qt5\plugins\styles\qwindowsvistastyle.dll
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_ar.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_bg.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_ca.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_cs.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_da.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_de.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_en.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_es.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_fa.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_fi.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_fr.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_gd.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_gl.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_he.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_ar.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_bg.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_ca.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_cs.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_da.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_de.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_en.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_es.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_fr.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_gl.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_hu.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_it.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_ja.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_ko.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_pl.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_ru.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_sk.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_sl.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_tr.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_uk.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_zh_cn.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_help_zh_tw.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_hu.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_it.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_ja.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_ko.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_lt.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_lv.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_pl.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_pt.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_ru.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_sk.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_sl.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_sv.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_tr.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_uk.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_zh_cn.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qt_zh_tw.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_ar.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_bg.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_ca.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_cs.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_da.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_de.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_en.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_es.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_fi.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_fr.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_gd.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_he.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_hu.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_it.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_ja.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_ko.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_lv.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_pl.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_ru.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_sk.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_tr.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_uk.qm
%TEMP%\_mei28682\pyqt5\qt5\translations\qtbase_zh_tw.qm
%TEMP%\_mei28682\pyqt5\qtcore.pyd
%TEMP%\_mei28682\pyqt5\qtgui.pyd
%TEMP%\_mei28682\pyqt5\qtwidgets.pyd
%TEMP%\_mei28682\pyqt5\sip.cp313-win_amd64.pyd
%TEMP%\_mei28682\vcruntime140.dll
%TEMP%\_mei28682\vcruntime140_1.dll
%TEMP%\_mei28682\_asyncio.pyd
%TEMP%\_mei28682\_bz2.pyd
%TEMP%\_mei28682\_cffi_backend.cp313-win_amd64.pyd
%TEMP%\_mei28682\_ctypes.pyd
%TEMP%\_mei28682\_decimal.pyd
%TEMP%\_mei28682\_elementtree.pyd
%TEMP%\_mei28682\_hashlib.pyd
%TEMP%\_mei28682\_lzma.pyd
%TEMP%\_mei28682\_multiprocessing.pyd
%TEMP%\_mei28682\_overlapped.pyd
%TEMP%\_mei28682\_queue.pyd
%TEMP%\_mei28682\_socket.pyd
%TEMP%\_mei28682\_sqlite3.pyd
%TEMP%\_mei28682\_ssl.pyd
%TEMP%\_mei28682\_uuid.pyd
%TEMP%\_mei28682\_wmi.pyd
%TEMP%\_mei28682\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei28682\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei28682\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei28682\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei28682\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei28682\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei28682\attrs-25.1.0.dist-info\installer
%TEMP%\_mei28682\attrs-25.1.0.dist-info\metadata
%TEMP%\_mei28682\attrs-25.1.0.dist-info\record
%TEMP%\_mei28682\attrs-25.1.0.dist-info\wheel
%TEMP%\_mei28682\attrs-25.1.0.dist-info\licenses\license
%TEMP%\_mei28682\base_library.zip
%TEMP%\_mei28682\bcrypt\_bcrypt.pyd
%TEMP%\_mei28682\certifi\cacert.pem
%TEMP%\_mei28682\charset_normalizer\md.cp313-win_amd64.pyd
%TEMP%\_mei28682\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
%TEMP%\_mei28682\cryptography-44.0.1.dist-info\installer
%TEMP%\_mei28682\cryptography-44.0.1.dist-info\metadata
%TEMP%\_mei28682\cryptography-44.0.1.dist-info\record
%TEMP%\_mei28682\cryptography-44.0.1.dist-info\wheel
%TEMP%\_mei28682\cryptography-44.0.1.dist-info\licenses\license
%TEMP%\_mei28682\cryptography-44.0.1.dist-info\licenses\license.apache
%TEMP%\_mei28682\cryptography-44.0.1.dist-info\licenses\license.bsd
%TEMP%\_mei28682\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei28682\cv2\__init__.py
%TEMP%\_mei28682\cv2\config-3.py
%TEMP%\_mei28682\cv2\config.py
%TEMP%\_mei28682\cv2\cv2.pyd
%TEMP%\_mei28682\cv2\data\__init__.py
%TEMP%\_mei28682\cv2\gapi\__init__.py
%TEMP%\_mei28682\cv2\load_config_py3.py
%TEMP%\_mei28682\cv2\mat_wrapper\__init__.py
%TEMP%\_mei28682\cv2\misc\__init__.py
%TEMP%\_mei28682\cv2\misc\version.py
%TEMP%\_mei28682\cv2\opencv_videoio_ffmpeg4100_64.dll
%TEMP%\_mei28682\cv2\typing\__init__.py
%TEMP%\_mei28682\cv2\utils\__init__.py
%TEMP%\_mei28682\cv2\version.py
%TEMP%\_mei28682\h2-4.2.0.dist-info\installer
%TEMP%\_mei28682\h2-4.2.0.dist-info\license
%TEMP%\_mei28682\h2-4.2.0.dist-info\metadata
%TEMP%\_mei28682\h2-4.2.0.dist-info\record
%TEMP%\_mei28682\h2-4.2.0.dist-info\wheel
%TEMP%\_mei28682\h2-4.2.0.dist-info\top_level.txt
%TEMP%\_mei28682\libcrypto-3.dll
%TEMP%\_mei28682\libffi-8.dll
%TEMP%\_mei28682\libssl-3.dll
%TEMP%\_mei28682\numpy.libs\libscipy_openblas64_-43e11ff0749b8cbe0a615c9cf6737e0e.dll
%TEMP%\_mei28682\numpy.libs\msvcp140-d64049c6e3865410a7dda6a7e9f0c575.dll
%TEMP%\_mei28682\numpy\_core\_multiarray_tests.cp313-win_amd64.pyd
%TEMP%\_mei28682\numpy\_core\_multiarray_umath.cp313-win_amd64.pyd
%TEMP%\_mei28682\numpy\fft\_pocketfft_umath.cp313-win_amd64.pyd
%TEMP%\_mei28682\numpy\linalg\_umath_linalg.cp313-win_amd64.pyd
%TEMP%\_mei28682\numpy\random\_bounded_integers.cp313-win_amd64.pyd
%TEMP%\_mei28682\numpy\random\_common.cp313-win_amd64.pyd
%TEMP%\_mei28682\numpy\random\_generator.cp313-win_amd64.pyd
%TEMP%\_mei28682\numpy\random\_mt19937.cp313-win_amd64.pyd
%TEMP%\_mei28682\numpy\random\_pcg64.cp313-win_amd64.pyd
%TEMP%\_mei28682\numpy\random\_philox.cp313-win_amd64.pyd
%TEMP%\_mei28682\numpy\random\_sfc64.cp313-win_amd64.pyd
%TEMP%\_mei28682\numpy\random\bit_generator.cp313-win_amd64.pyd
%TEMP%\_mei28682\numpy\random\mtrand.cp313-win_amd64.pyd
%TEMP%\_mei28682\psutil\_psutil_windows.pyd
%TEMP%\_mei28682\pyexpat.pyd
%TEMP%\_mei28682\python3.dll
%TEMP%\_mei28682\python313.dll
%TEMP%\_mei28682\pywin32_system32\pywintypes313.dll
%TEMP%\_mei28682\select.pyd
%TEMP%\_mei28682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
%TEMP%\_mei28682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
%TEMP%\_mei28682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
%TEMP%\_mei28682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
%TEMP%\_mei28682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
%TEMP%\_mei28682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
%TEMP%\_mei28682\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei28682\setuptools\_vendor\wheel-0.43.0.dist-info\installer
%TEMP%\_mei28682\setuptools\_vendor\wheel-0.43.0.dist-info\license.txt
%TEMP%\_mei28682\setuptools\_vendor\wheel-0.43.0.dist-info\metadata
%TEMP%\_mei28682\setuptools\_vendor\wheel-0.43.0.dist-info\record
%TEMP%\_mei28682\setuptools\_vendor\wheel-0.43.0.dist-info\wheel
%TEMP%\_mei28682\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt
%TEMP%\_mei28682\sqlite3.dll
%TEMP%\_mei28682\ucrtbase.dll
%TEMP%\_mei28682\unicodedata.pyd
%TEMP%\_mei28682\win32\win32api.pyd
%TEMP%\_mei28682\win32\win32crypt.pyd
%TEMP%\_mei28682\win32\win32gui.pyd
%TEMP%\_mei28682\win32\win32pdh.pyd
%TEMP%\_mei28682\win32\win32process.pyd
%TEMP%\_mei28682\yaml\_yaml.cp313-win_amd64.pyd
%TEMP%\u6187r7g
%TEMP%\tmpd2kdtxvg\firefox\history.txt
%TEMP%\tmpd2kdtxvg\firefox\bookmarks.txt
%TEMP%\jnc5mcv2tjlbczpt5d
%TEMP%\tmpd2kdtxvg\browsers\history.txt
%TEMP%\mh7msf5lc6q8dajw
%TEMP%\3yxrmczbatfvpr
%TEMP%\5sdixqsidztf
%TEMP%\kwf90klccwp1w
%TEMP%\ztvpbtz7fe0unjgcsy
%TEMP%\nrexvjzevquydupfwl
%TEMP%\r33opdul6ahw5ezx
%TEMP%\uodobsrboehhiu
%TEMP%\tmpd2kdtxvg\systeme\system_info.txt
%TEMP%\tmpd2kdtxvg\systeme\screenshot.png
%TEMP%\tmpd2kdtxvg\systeme\anti virus.txt
%TEMP%\tmpd2kdtxvg\systeme\wifi info.txt

Удаляет файлы, которые сам же создал

%TEMP%\u6187r7g
%TEMP%\jnc5mcv2tjlbczpt5d
%TEMP%\mh7msf5lc6q8dajw
%TEMP%\5sdixqsidztf
%TEMP%\kwf90klccwp1w
%TEMP%\nrexvjzevquydupfwl
%TEMP%\r33opdul6ahw5ezx

Изменяет следующие файлы

Сетевая активность

Подключается к

'ra#.####ubusercontent.com':443
'ip##fo.io':443
'localhost':49699

TCP

Другие

'ra#.####ubusercontent.com':443
'ip##fo.io':443

UDP

DNS ASK ra#.####ubusercontent.com
DNS ASK ip##fo.io

Другое

Перезапускает анализируемый образец

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "ver" (со скрытым окном)
'<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
'<SYSTEM32>\cmd.exe' /c "powershell Get-Clipboard" (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c "netsh wlan show profile" (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c "powershell -Command "Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match '^USB' }"" (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match '^USB' }"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-Clipboard
'<SYSTEM32>\netsh.exe' wlan show profile
'<SYSTEM32>\wbem\wmic.exe' /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней