Техническая информация
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /IM msedge.exe /IM brave.exe /IM opera.exe /IM vivaldi.exe /IM browser.exe /IM discord.exe /IM Discord.exe /IM chromium.exe /IM iron.exe /IM torch.exe /IM dragon.exe /IM centb...
Внедряет код в
следующие пользовательские процессы:
- launcher.exe
- uglymorons.exe
- msedge.exe
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsp7b66.tmp\system.dll
- %TEMP%\nsp7b66.tmp\app-64.7z
- %TEMP%\nsp7b66.tmp\nsis7z.dll
- %TEMP%\nsp7b66.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nsp7b66.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nsp7b66.tmp\7z-out\icudtl.dat
- %TEMP%\nsp7b66.tmp\7z-out\license.electron.txt
- %TEMP%\nsp7b66.tmp\7z-out\licenses.chromium.html
- %TEMP%\nsp7b66.tmp\7z-out\locales\af.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\am.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\ar.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\bg.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\bn.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\ca.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\cs.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\da.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\de.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\el.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\en-gb.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\en-us.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\es-419.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\es.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\et.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\fa.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\fi.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\fil.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\fr.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\gu.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\he.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\hi.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\hr.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\hu.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\id.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\it.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\ja.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\kn.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\ko.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\lt.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\lv.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\ml.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\mr.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\ms.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\nb.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\nl.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\pl.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\pt-br.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\pt-pt.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\ro.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\ru.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\sk.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\sl.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\sr.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\sv.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\sw.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\ta.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\te.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\th.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\tr.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\uk.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\ur.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\vi.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\zh-cn.pak
- %TEMP%\nsp7b66.tmp\7z-out\locales\zh-tw.pak
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\bson\vendor\base64\base64.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\bson\vendor\base64\license-mit.txt
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\bson\vendor\base64\package.json
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\bson\vendor\base64\readme.md
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\bson\vendor\text-encoding\index.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\bson\vendor\text-encoding\lib\encoding-indexes.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\bson\vendor\text-encoding\lib\encoding.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\bson\vendor\text-encoding\license.md
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\bson\vendor\text-encoding\package.json
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\bson\vendor\text-encoding\readme.md
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\.devcontainer\devcontainer.json
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\.devcontainer\dockerfile
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\.eslintrc.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\.jsdoc.config.json
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\authors
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\contributing.md
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-asm-debug.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-asm-memory-growth.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-asm.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-wasm-debug.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-wasm-debug.wasm
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-wasm.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-wasm.wasm
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\sqljs-all.zip
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\sqljs-wasm.zip
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\sqljs-worker-wasm.zip
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\worker.sql-asm-debug.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\worker.sql-asm.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\worker.sql-wasm-debug.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\dist\worker.sql-wasm.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\documentation_index.md
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\license
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\logo.svg
- %TEMP%\nsp7b66.tmp\7z-out\resources\app.asar.unpacked\node_modules\sql.js\package.json
- %TEMP%\nsp7b66.tmp\7z-out\resources\vendor\chrome_key.cs
- %TEMP%\nsp7b66.tmp\7z-out\resources\vendor\elevator_helper.cs
- %TEMP%\nsp7b66.tmp\7z-out\resources\vendor\sql-asm.js
- %TEMP%\nsp7b66.tmp\7z-out\resources\vendor\sql-wasm.wasm
- %TEMP%\nsp7b66.tmp\7z-out\resources.pak
- %TEMP%\nsp7b66.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nsp7b66.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\nsp7b66.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nsp7b66.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nsp7b66.tmp\7z-out\ffmpeg.dll
- %TEMP%\nsp7b66.tmp\7z-out\libegl.dll
- %TEMP%\nsp7b66.tmp\7z-out\libglesv2.dll
- %TEMP%\nsp7b66.tmp\7z-out\resources\chromelevator.exe
- %TEMP%\nsp7b66.tmp\7z-out\resources\dllextractchromiumsecrets.dll
- %TEMP%\nsp7b66.tmp\7z-out\resources\dumpbrowsersecrets.exe
- %TEMP%\nsp7b66.tmp\7z-out\resources\elevate.exe
- %TEMP%\nsp7b66.tmp\7z-out\resources\vendor\chromelevator.exe
- %TEMP%\nsp7b66.tmp\7z-out\resources\vendor\chrome_key.exe
- %TEMP%\nsp7b66.tmp\7z-out\resources\vendor\elevator_helper.exe
- %TEMP%\nsp7b66.tmp\7z-out\uglymorons.exe
- %TEMP%\nsp7b66.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nsp7b66.tmp\7z-out\vulkan-1.dll
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\chrome_100_percent.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\chrome_200_percent.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\d3dcompiler_47.dll
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\ffmpeg.dll
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\icudtl.dat
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\libegl.dll
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\libglesv2.dll
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\license.electron.txt
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\licenses.chromium.html
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\snapshot_blob.bin
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\uglymorons.exe
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\v8_context_snapshot.bin
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\vk_swiftshader.dll
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\vk_swiftshader_icd.json
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\vulkan-1.dll
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\af.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\am.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\ar.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\bg.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\bn.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\ca.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\cs.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\da.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\de.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\el.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\en-gb.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\en-us.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\es-419.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\es.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\et.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\fa.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\fi.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\fil.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\fr.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\gu.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\he.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\hi.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\hr.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\hu.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\id.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\it.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\ja.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\kn.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\ko.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\lt.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\lv.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\ml.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\mr.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\ms.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\nb.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\nl.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\pl.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\pt-br.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\pt-pt.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\ro.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\ru.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\sk.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\sl.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\sr.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\sv.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\sw.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\ta.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\te.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\th.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\tr.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\uk.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\ur.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\vi.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\zh-cn.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\locales\zh-tw.pak
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\chromelevator.exe
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dllextractchromiumsecrets.dll
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\elevate.exe
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\bson\vendor\base64\base64.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\bson\vendor\base64\license-mit.txt
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\bson\vendor\base64\package.json
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\bson\vendor\base64\readme.md
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\bson\vendor\text-encoding\index.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\bson\vendor\text-encoding\license.md
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\bson\vendor\text-encoding\package.json
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\bson\vendor\text-encoding\readme.md
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\bson\vendor\text-encoding\lib\encoding-indexes.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\bson\vendor\text-encoding\lib\encoding.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\.eslintrc.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\.jsdoc.config.json
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\authors
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\contributing.md
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\documentation_index.md
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\license
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\logo.svg
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\package.json
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\.devcontainer\devcontainer.json
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\.devcontainer\dockerfile
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-asm-debug.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-asm-memory-growth.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-asm.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-wasm-debug.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-wasm-debug.wasm
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-wasm.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\sql-wasm.wasm
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\sqljs-all.zip
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\sqljs-wasm.zip
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\sqljs-worker-wasm.zip
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\worker.sql-asm-debug.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\worker.sql-asm.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\worker.sql-wasm-debug.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\app.asar.unpacked\node_modules\sql.js\dist\worker.sql-wasm.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\vendor\chromelevator.exe
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\vendor\chrome_key.cs
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\vendor\chrome_key.exe
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\vendor\elevator_helper.cs
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\vendor\elevator_helper.exe
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\vendor\sql-asm.js
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\vendor\sql-wasm.wasm
- %TEMP%\nsp7b66.tmp\stdutils.dll
- nul
- %TEMP%\ugly_debug.txt
- %APPDATA%\updater\local storage\leveldb\log
- %APPDATA%\updater\local storage\leveldb\manifest-000001
- %APPDATA%\updater\local storage\leveldb\000001.dbtmp
- %APPDATA%\updater\code cache\js\index
- %APPDATA%\updater\code cache\wasm\index
- %APPDATA%\updater\code cache\wasm\index-dir\temp-index
- %APPDATA%\updater\code cache\js\index-dir\temp-index
- %APPDATA%\microsoft\spelling\en-us\default.dic
- %APPDATA%\microsoft\spelling\en-us\default.exc
- %APPDATA%\microsoft\spelling\en-us\default.acl
- %APPDATA%\updater\shared dictionary\cache\index
- %APPDATA%\updater\network\trust tokens-journal
- %APPDATA%\updater\shared dictionary\db-journal
- %APPDATA%\updater\network\trust tokens
- %APPDATA%\updater\shared dictionary\db
- %APPDATA%\updater\shared dictionary\cache\index-dir\temp-index
- %APPDATA%\updater\d2e7f459-8507-4c27-bee6-a1a1a9a559ca.tmp
- %APPDATA%\updater\df88fa23-b113-4174-89e4-ec486eb95449.tmp
- %TEMP%\ugly_ss_9ebe2aeb.ps1
- %APPDATA%\updater\network\54d43886-2770-4154-9f45-363e1fd6ff67.tmp
- %LOCALAPPDATA%\8ae32a8691bc0627\output\screenshot.png
- %TEMP%\tmpb2eb.tmp
- %TEMP%\tmpb2fc.tmp
- %TEMP%\tmpb30d.tmp
- %TEMP%\tmpb30e.tmp
- %TEMP%\tmpba00.tmp
- %TEMP%\tmpba10.tmp
- %TEMP%\tmpba11.tmp
- %TEMP%\tmpba22.tmp
- %TEMP%\tmpc7db.tmp
- %TEMP%\tmpc7dc.tmp
- %TEMP%\tmpc7ec.tmp
- %TEMP%\tmpc7ed.tmp
- %TEMP%\tmpca4c.tmp
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\edgedata.json
- %TEMP%\ugly_dbs_85eebed2\edgedata.json
- %TEMP%\tmpf96a.tmp
Удаляет файлы, которые сам же создал
- %TEMP%\ugly_ss_9ebe2aeb.ps1
- %TEMP%\tmpb2eb.tmp
- %TEMP%\tmpb2fc.tmp
- %TEMP%\tmpb30d.tmp
- %TEMP%\tmpb30e.tmp
- %TEMP%\tmpba00.tmp
- %TEMP%\tmpba10.tmp
- %TEMP%\tmpba11.tmp
- %TEMP%\tmpba22.tmp
- %TEMP%\tmpca4c.tmp
- %TEMP%\tmpc7db.tmp
- %TEMP%\tmpc7dc.tmp
- %TEMP%\tmpc7ec.tmp
- %TEMP%\tmpc7ed.tmp
- %TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\edgedata.json
- %TEMP%\tmpf96a.tmp
- %TEMP%\ugly_dbs_85eebed2\edgedata.json
Перемещает следующие файлы
- %APPDATA%\updater\local storage\leveldb\000001.dbtmp в %APPDATA%\updater\local storage\leveldb\current
- %APPDATA%\updater\code cache\wasm\index-dir\temp-index в %APPDATA%\updater\code cache\wasm\index-dir\the-real-index
- %APPDATA%\updater\code cache\js\index-dir\temp-index в %APPDATA%\updater\code cache\js\index-dir\the-real-index
- %APPDATA%\updater\shared dictionary\cache\index-dir\temp-index в %APPDATA%\updater\shared dictionary\cache\index-dir\the-real-index
- %APPDATA%\updater\d2e7f459-8507-4c27-bee6-a1a1a9a559ca.tmp в %APPDATA%\updater\local state
- %APPDATA%\updater\df88fa23-b113-4174-89e4-ec486eb95449.tmp в %APPDATA%\updater\preferences
- %APPDATA%\updater\network\54d43886-2770-4154-9f45-363e1fd6ff67.tmp в %APPDATA%\updater\network\network persistent state
Сетевая активность
Подключается к
- 'ca####.discord.com':443
TCP
Другие
- 'ca####.discord.com':443
UDP
- DNS ASK ca####.discord.com
Другое
Ищет следующие окна
- ClassName: '#32770' WindowName: ''
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\uglymorons.exe'
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\uglymorons.exe' --type=gpu-process --user-data-dir="%APPDATA%\updater" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgA...
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\uglymorons.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\updater" --field-trial-handle=2172,i,10429710108999482147,4558...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "%TEMP%\ugly_ss_9ebe2aeb.ps1"
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\chromelevator.exe' all -o %TEMP%\ugly_chromelev_53b37119
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:chrome /e:all /spoof
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:chrome /e:all
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:chrome /all /o %TEMP%\ugly_dbs_85eebed2\chromeData.json
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:chrome /o %TEMP%\ugly_dbs_85eebed2\chromeData.json
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:edge /e:all /spoof
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:brave /e:all /spoof
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:brave /e:all
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:brave /all /o %TEMP%\ugly_dbs_85eebed2\braveData.json
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:brave /o %TEMP%\ugly_dbs_85eebed2\braveData.json
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:operagx /e:all /spoof
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:operagx /e:all
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:operagx /all /o %TEMP%\ugly_dbs_85eebed2\operagxData.json
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:operagx /o %TEMP%\ugly_dbs_85eebed2\operagxData.json
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:opera /e:all /spoof
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:firefox /e:all /spoof
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\vendor\chrome_key.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Local State"
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\vendor\chrome_key.exe' "%LOCALAPPDATA%\Microsoft\Edge\User Data\Local State"
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\vendor\chrome_key.exe' "%APPDATA%\Opera Software\Opera Stable\Local State"
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "%TEMP%\ugly_ss_9ebe2aeb.ps1"" (со скрытым окном)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' (со скрытым окном)
- '%ProgramFiles(x86)%\opera\launcher.exe' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /d /s /c ""%TEMP%\3IESwUrnuKuHTqnBA5xB78cgoE9\resources\vendor\chrome_key.exe" "%LOCALAPPDATA%\Google\Chrome\User Data\Local State"" (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /d /s /c ""%TEMP%\3IESwUrnuKuHTqnBA5xB78cgoE9\resources\vendor\chrome_key.exe" "%LOCALAPPDATA%\Microsoft\Edge\User Data\Local State"" (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /d /s /c ""%TEMP%\3IESwUrnuKuHTqnBA5xB78cgoE9\resources\vendor\chrome_key.exe" "%APPDATA%\Opera Software\Opera Stable\Local State"" (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /IM msedge.exe /IM brave.exe /IM opera.exe /IM vivaldi.exe /IM browser.exe /IM discord.exe /IM Discord.exe /IM chromium.exe /IM iron.exe /IM torch.exe /IM dragon.exe /IM centb... (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\chromelevator.exe' all -o %TEMP%\ugly_chromelev_53b37119 (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:chrome /e:all /spoof (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:chrome /e:all (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:chrome /all /o %TEMP%\ugly_dbs_85eebed2\chromeData.json (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:chrome /o %TEMP%\ugly_dbs_85eebed2\chromeData.json (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:edge /e:all /spoof (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:brave /e:all /spoof (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:brave /e:all (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:brave /all /o %TEMP%\ugly_dbs_85eebed2\braveData.json (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:brave /o %TEMP%\ugly_dbs_85eebed2\braveData.json (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:operagx /e:all /spoof (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:operagx /e:all (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:operagx /all /o %TEMP%\ugly_dbs_85eebed2\operagxData.json (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:operagx /o %TEMP%\ugly_dbs_85eebed2\operagxData.json (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:opera /e:all /spoof (со скрытым окном)
- '%TEMP%\3ieswurnukuhtqnba5xb78cgoe9\resources\dumpbrowsersecrets.exe' /b:firefox /e:all /spoof (со скрытым окном)
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' --disable-gpu --disable-extensions --no-first-run --no-default-browser-check --disable-sync --disable-background-networking --disable-features=TranslateUI --window-position=-32000,-32000 --wind... (со скрытым окном)
