Trojan.Siggen32.26862

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\outlook cli manager update

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msedge.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM brave.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM opera.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM operagx.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM waterfox.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM palemoon.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM seamonkey.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM iridium.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM chromium.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM yandex.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM slimjet.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM torch.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM maxthon.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM dragon.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM browser.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM chrome_pwa_launcher.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM chrome_proxy.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msedge_pwa_launcher.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msedge_proxy.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msedgewebview2.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msedgewebview.exe /T

Launches a large number of processes

Reads files which store third party applications passwords

%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\login data
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%APPDATA%\thunderbird\profiles.ini

Modifies file system

Creates the following files

%LOCALAPPDATA%\outlook\outlookcli\dllmanager\dllmanager.exe
nul
C:\recovery\oem\resetconfig.xml
C:\recovery\oem\systemupdate.bat
%TEMP%\collected_data\info.txt
%TEMP%\collected_data\monitor 1.jpg
%TEMP%\784786521.dat
%TEMP%\3360093932.dat
%TEMP%\2690961959.dat
%TEMP%\567262636.dat
%TEMP%\831047506.dat
%TEMP%\1050938553.dat
%TEMP%\grabbedfiles\grabber\aoc_saq_d_v3_merchant.docx
%TEMP%\grabbedfiles\grabber\desktop.ini
%TEMP%\grabbedfiles\grabber\applicantform_en.doc
%TEMP%\grabbedfiles\grabber\coffee.bmp
%TEMP%\grabbedfiles\grabber\dashborder_192.bmp
%TEMP%\grabbedfiles\grabber\dial.bmp
%TEMP%\grabbedfiles\grabber\dialmap.bmp
%TEMP%\grabbedfiles\grabber\february_catalogue__2015.doc
%TEMP%\grabbedfiles\grabber\file_p_00000000_1371597592.docx
%TEMP%\grabbedfiles\grabber\hanni_umami_chapter.doc
%TEMP%\grabbedfiles\grabber\howto-index.html
%TEMP%\grabbedfiles\grabber\lisp_success.doc
%TEMP%\grabbedfiles\grabber\thlps_keeper_mayer_1965.docx
%TEMP%\grabbedfiles\grabber\uep_form_786_bulletin_1726i602.doc
%TEMP%\crypto.zip
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\crash reports\installtime20210406220621
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\b376zl1q.default\times.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\abook.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addonstartup.json.lz4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addons.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\blist.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cert9.db
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\compatibility.ini
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cookies.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1df428.new-profile.j...
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb050509c4.main.jsonlz4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.first-shutdow...
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\session-state.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\state.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\directorytree.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\enigmail.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extension-preferences.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extensions.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\favicons.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\formhistory.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\global-messages-db.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\history.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\key4.db
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\mailviews.dat
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\openpgp.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\permissions.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\pkcs11.txt
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\places.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\prefs.js
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\search.json.mozlz4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\sessioncheckpoints.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\times.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\webappsstore.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\xulstore.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\installs.ini
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles.ini
%TEMP%\user_data.zip
%TEMP%\3545054813.dat
%TEMP%\3938358914.dat
%TEMP%\2557975379.dat
%TEMP%\504143015.dat
%TEMP%\2105241918.dat
%TEMP%\2436438488.dat

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\outlook\outlookcli\dllmanager\dllmanager.exe

Deletes following files that it created itself

%TEMP%\2690961959.dat
%TEMP%\784786521.dat
%TEMP%\3360093932.dat
%TEMP%\567262636.dat
%TEMP%\1050938553.dat
%TEMP%\831047506.dat
%TEMP%\crypto.zip
%TEMP%\collected_data\info.txt
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\crash reports\installtime20210406220621
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\installs.ini
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\b376zl1q.default\times.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\abook.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addons.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addonstartup.json.lz4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\blist.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cert9.db
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\compatibility.ini
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cookies.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\session-state.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\state.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\directorytree.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1df428.new-profile.j...
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\enigmail.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extension-preferences.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb050509c4.main.jsonlz4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.first-shutdow...
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extensions.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\favicons.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\formhistory.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\global-messages-db.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\history.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\key4.db
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\mailviews.dat
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\openpgp.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\permissions.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\pkcs11.txt
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\places.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\prefs.js
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\search.json.mozlz4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\sessioncheckpoints.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\times.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\webappsstore.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\xulstore.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles.ini
%TEMP%\collected_data\monitor 1.jpg
%TEMP%\user_data.zip
%TEMP%\3938358914.dat
%TEMP%\3545054813.dat
%TEMP%\2557975379.dat
%TEMP%\504143015.dat
%TEMP%\2105241918.dat
%TEMP%\2436438488.dat

Substitutes the following files

%TEMP%\crypto.zip
%TEMP%\collected_data\info.txt
%TEMP%\collected_data\monitor 1.jpg
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\crash reports\installtime20210406220621
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\b376zl1q.default\times.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\abook.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addonstartup.json.lz4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addons.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\blist.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cert9.db
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\compatibility.ini
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cookies.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1df428.new-profile.j...
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb050509c4.main.jsonlz4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.first-shutdow...
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\session-state.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\state.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\directorytree.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\enigmail.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extension-preferences.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extensions.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\favicons.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\formhistory.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\global-messages-db.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\history.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\key4.db
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\mailviews.dat
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\openpgp.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\permissions.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\pkcs11.txt
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\places.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\prefs.js
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\search.json.mozlz4
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\sessioncheckpoints.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\times.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\webappsstore.sqlite
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\xulstore.json
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\installs.ini
%TEMP%\collected_data\mails\client_profiles\thunderbird_profile\profiles.ini
%TEMP%\user_data.zip

Network activity

Connects to

'93.#4.96.35':80
'19#.#58.212.5':80
'ip##fo.io':443
'x1.#.lencr.org':80

TCP

HTTP GET requests

Other

'93.#4.96.35':80
'19#.#58.212.5':80
'ip##fo.io':443

UDP

DNS ASK ip##fo.io
DNS ASK x1.#.lencr.org

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%LOCALAPPDATA%\outlook\outlookcli\dllmanager\dllmanager.exe'

Executes the following

'<SYSTEM32>\schtasks.exe' /Create /TN "Outlook CLI Manager Update" /TR '%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe' /SC ONLOGON /RL HIGHEST /F
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -ExpandProperty Name"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -ExpandProperty Name"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-CimInstance -ClassName Win32_OperatingSystem).Caption + ' ' + (Get-CimInstance -ClassName Win32_OperatingSystem).Version"
'<SYSTEM32>\schtasks.exe' /Create /TN "Outlook CLI Manager Update" /TR '%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe' /SC ONLOGON /RL HIGHEST /F' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -ExpandProperty Name"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -ExpandProperty Name"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-CimInstance -ClassName Win32_OperatingSystem).Caption + ' ' + (Get-CimInstance -ClassName Win32_OperatingSystem).Version"' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM msedge.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM brave.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM opera.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM operagx.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM waterfox.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM palemoon.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM seamonkey.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM iridium.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM chromium.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM yandex.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM slimjet.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM torch.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM maxthon.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM dragon.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM browser.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM chrome_pwa_launcher.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM chrome_proxy.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM msedge_pwa_launcher.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM msedge_proxy.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM msedgewebview2.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM msedgewebview.exe /T' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial