Trojan.Siggen28.20042

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%WINDIR%\tasks\asliftrightsforclient_sessionsessionid1.job
<SYSTEM32>\tasks\asliftrightsforclient_sessionsessionid1

Malicious functions

Modifies settings of Windows Internet Explorer

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\] 'ProxyOverride' = '*.local.pcvisit.com'
[HKCU\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '*.local.pcvisit.com'

Modifies file system

Creates the following files

%TEMP%\nsv142c.tmp\accesscontrol.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5networkauth.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5svg.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5websockets.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5widgets.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\platforms\qwindows.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\remoteprocstart_x64.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\remoteprocstart_x86.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\ssleay32.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\ucrtbase.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\vcruntime140.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\wodftpd.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\wodkeys.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\wodtunnel.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvadhoc.7z
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\application_de.qm
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\application_en.qm
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvisit_client_de.qm
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvisit_client_en.qm
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qtbase_de.qm
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5network.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\shared_app_elements_de.qm
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5gui.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\imageformats\qsvg.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-core-timezone-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-convert-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-environment-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-filesystem-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-heap-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-locale-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-math-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-multibyte-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-runtime-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-stdio-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-string-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-time-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-utility-l1-1-0.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\concrt140.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\libeay32.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\msvcp140.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\imageformats\qgif.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\imageformats\qico.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\imageformats\qjpeg.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5core.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\wodkeys.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvdisplayserver.exe
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\msvcp140.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\imageformats\qgif.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\imageformats\qico.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\imageformats\qjpeg.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\imageformats\qsvg.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5core.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5gui.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5network.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5networkauth.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5svg.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5websockets.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qt5widgets.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\platforms\qwindows.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\remoteprocstart_x64.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\remoteprocstart_x86.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\ssleay32.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\ucrtbase.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\vcruntime140.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\wodftpd.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\libeay32.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\concrt140.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvisit_client.exe
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvisit_km_starter.exe
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvisit_service_client.exe
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\shared_app_elements_en.qm
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\client.exe
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\qt5websockets.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\concrt140.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\libeay32.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\msvcp140.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\imageformats\qgif.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\imageformats\qico.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\imageformats\qjpeg.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\imageformats\qsvg.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\qt5core.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\qt5gui.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\qt5network.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\qt5networkauth.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\pcvadhoc.7z
%TEMP%\nsv142c.tmp\nsis7z.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\application_de.qm
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\application_en.qm
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\pcvisit_client_de.qm
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\pcvisit_client_en.qm
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\qtbase_de.qm
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\shared_app_elements_de.qm
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\shared_app_elements_en.qm
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\client.exe
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\pcvdisplayserver.exe
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\pcvisit_client.exe
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\pcvisit_km_starter.exe
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\pcvisit_service_client.exe
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\api-ms-win-crt-convert-l1-1-0.dll
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\qt5widgets.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.kpkzfy
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest.setup\release\$(version)\pcvisit_support_kunden_modul.exe
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest.setup\release\24.3.19.954\pcvisit_support_kunden_modul.exe
%TEMP%\nsb3bd8.tmp\accesscontrol.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvadhoc.7z
%TEMP%\nsb3bd8.tmp\nsis7z.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\application_de.qm
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\application_en.qm
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvisit_client_de.qm
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvisit_client_en.qm
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\qtbase_de.qm
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\shared_app_elements_de.qm
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\shared_app_elements_en.qm
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\client.exe
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvdisplayserver.exe
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvisit_client.exe
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvisit_km_starter.exe
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvisit_service_client.exe
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-core-file-l1-2-0.dll
%WINDIR%\temp\lr9260s3-cj67-4p5x-y2xq-e2fn7be5fs98.tmp
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\t174otl0-8o4p-473r-ywz3-42f19tdwcq7d.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\platforms\qwindows.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\remoteprocstart_x64.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\remoteprocstart_x86.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\ssleay32.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\ucrtbase.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\vcruntime140.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\wodftpd.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\wodkeys.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\wodtunnel.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.lock
%ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.aoivhl
%ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.fhpsoz
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_d4602615-9d50-4880-be41-678935e93eaa
%WINDIR%\temp\cabccdf.tmp
%WINDIR%\temp\tarcce0.tmp
%ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.supeho
%ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.kghycb
%ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.fmgbun
%ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.kznmcg
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\qt5svg.dll
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\wodtunnel.dll

Deletes the following files

%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\pcvadhoc.7z
%TEMP%\nsv142c.tmp\accesscontrol.dll
%TEMP%\nsv142c.tmp\nsis7z.dll
%ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.lock
%WINDIR%\temp\cabccdf.tmp
%WINDIR%\temp\tarcce0.tmp
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest.setup\release\$(version)\pcvisit_support_kunden_modul.exe
%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvadhoc.7z
%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\24.3.19.954\pcvadhoc.7z
%TEMP%\nsb3bd8.tmp\accesscontrol.dll
%TEMP%\nsb3bd8.tmp\nsis7z.dll

Moves the following files

from %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.aoivhl to %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini
from %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.fhpsoz to %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini
from %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.supeho to %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini
from %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.kghycb to %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini
from %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.fmgbun to %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini
from %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.kznmcg to %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini
from %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.kpkzfy to %ALLUSERSPROFILE%\pcvisit software ag\caloa.ini

Substitutes the following files

%ALLUSERSPROFILE%\pcvisit software ag\caloa.ini.lock

Network activity

Connects to

'lb#.#cvisit.de':80
'localhost':18701
'lb#.#cvisit.de':443
'localhost':48524
'localhost':48480
'microsoft.com':80
'pc#########dbox.cloudflare-pcvisit.com':443
'pk#.goog':80

TCP

HTTP GET requests

http://lb#.#cvisit.de/alive/check.json
http://12#.#.0.1:8126/v1/hosted/nacl/updateinfo
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://12#.#.0.1:8126/graphql
http://pk#.goog/gsr1/gsr1.crt
http://12#.#.0.1:8080/alive/check.json

HTTP POST requests

http://lb#.#cvisit.de/detect.json

Other

'lb#.#cvisit.de':443
'localhost':48524
'localhost':49189
'localhost':49190
'localhost':48480
'localhost':49193
'localhost':49194
'localhost':49197
'localhost':49198
'localhost':49199
'localhost':49201
'pc#########dbox.cloudflare-pcvisit.com':443
'localhost':49204
'localhost':49207

UDP

DNS ASK lb#.#cvisit.de
DNS ASK microsoft.com
DNS ASK pc#########dbox.cloudflare-pcvisit.com
DNS ASK pk#.goog

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''

Creates and executes the following

'%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\pcvisit_service_client.exe'
'%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\pcvisit_service_client.exe' --StartMode AsLiftRightsForClient --session 1
'%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\pcvisit_service_client.exe' AsClient --startPrivilege STARTED_BY_USER_LEVELD_AS_NON_INTERACTIVE
'%ALLUSERSPROFILE%\pcvisit software ag\caloa\pcvisit.support.guest.setup\release\24.3.19.954\pcvisit_support_kunden_modul.exe' /unpackonly
'%LOCALAPPDATA%\pcvisit software ag\caloa\pcvisit.support.guest\release\23.4.18.1051\pcvisit_service_client.exe' --StartMode AsLiftRightsForClient --session 1' (with hidden window)

Executes the following

'%WINDIR%\syswow64\wbem\wmic.exe' os
'%WINDIR%\syswow64\wbem\wmic.exe' logicaldisk where "deviceid = 'c:'" get volumeserialnumber,freespace
'%WINDIR%\syswow64\wbem\wmic.exe' bios get releasedate
'%WINDIR%\syswow64\wbem\wmic.exe' computersystem get manufacturer,model,partofdomain,systemtype,totalphysicalmemory
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "get-ciminstance msft_physicaldisk -namespace root\microsoft\windows\storage | select model, size, allocatedsize, mediatype, healthstatus, bustype"
'%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\CIMV2\TerminalServices PATH Win32_TSGeneralSetting get SSLCertificateSHA1Hash
'%WINDIR%\syswow64\wbem\wmic.exe' diskdrive get model,size,mediatype,status
'%WINDIR%\syswow64\wbem\wmic.exe' path win32_videocontroller get name

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial