Technical Information
Triggers a user-defined sigma rule:
- ec82e2a5-81ea-4211-a1f8-37a0286df2c2
- edf3485d-dac4-4d50-90e4-b0e5813f7e60
- 0363014af973d856c696adf0d0c4669089d563f0a1915ece70715ff8f7aa9949
- 15434e33-5027-4914-88d5-3d4145ec25a9
- 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32
- f4bbd493-b796-416e-bbf2-121235348529
- b9aeac14-2ffd-4ad3-b967-1354a4e628c3
- c3dbbc9f-ef1d-470a-a90a-d343448d5875
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\howto-index.html
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\tileimage.bmp
Modifies file system
Creates the following files
- %TEMP%\_mei10762\pil\_avif.cp314-win_amd64.pyd
- %TEMP%\_mei10762\pil\_imaging.cp314-win_amd64.pyd
- %TEMP%\_mei10762\pil\_imagingcms.cp314-win_amd64.pyd
- %TEMP%\_mei10762\pil\_imagingmath.cp314-win_amd64.pyd
- %TEMP%\_mei10762\pil\_imagingtk.cp314-win_amd64.pyd
- %TEMP%\_mei10762\pil\_webp.cp314-win_amd64.pyd
- %TEMP%\_mei10762\vcruntime140.dll
- %TEMP%\_mei10762\vcruntime140_1.dll
- %TEMP%\_mei10762\_asyncio.pyd
- %TEMP%\_mei10762\_bz2.pyd
- %TEMP%\_mei10762\_cffi_backend.cp314-win_amd64.pyd
- %TEMP%\_mei10762\_ctypes.pyd
- %TEMP%\_mei10762\_decimal.pyd
- %TEMP%\_mei10762\_elementtree.pyd
- %TEMP%\_mei10762\_hashlib.pyd
- %TEMP%\_mei10762\_lzma.pyd
- %TEMP%\_mei10762\_multiprocessing.pyd
- %TEMP%\_mei10762\_overlapped.pyd
- %TEMP%\_mei10762\_queue.pyd
- %TEMP%\_mei10762\_socket.pyd
- %TEMP%\_mei10762\_sqlite3.pyd
- %TEMP%\_mei10762\_ssl.pyd
- %TEMP%\_mei10762\_wmi.pyd
- %TEMP%\_mei10762\_zstd.pyd
- %TEMP%\_mei10762\ada92cb5d92a588d1b93__mypyc.cp314-win_amd64.pyd
- %TEMP%\_mei10762\base_library.zip
- %TEMP%\_mei10762\certifi\cacert.pem
- %TEMP%\_mei10762\charset_normalizer\cd.cp314-win_amd64.pyd
- %TEMP%\_mei10762\charset_normalizer\md.cp314-win_amd64.pyd
- %TEMP%\_mei10762\cryptography-50.0.0.dist-info\installer
- %TEMP%\_mei10762\cryptography-50.0.0.dist-info\metadata
- %TEMP%\_mei10762\cryptography-50.0.0.dist-info\record
- %TEMP%\_mei10762\cryptography-50.0.0.dist-info\wheel
- %TEMP%\_mei10762\cryptography-50.0.0.dist-info\licenses\license
- %TEMP%\_mei10762\cryptography-50.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei10762\cryptography-50.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei10762\cryptography-50.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei10762\cryptography-50.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei10762\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei10762\cv2\__init__.py
- %TEMP%\_mei10762\cv2\config-3.py
- %TEMP%\_mei10762\cv2\config.py
- %TEMP%\_mei10762\cv2\cv2.pyd
- %TEMP%\_mei10762\cv2\data\__init__.py
- %TEMP%\_mei10762\cv2\load_config_py3.py
- %TEMP%\_mei10762\cv2\mat_wrapper\__init__.py
- %TEMP%\_mei10762\cv2\misc\__init__.py
- %TEMP%\_mei10762\cv2\misc\version.py
- %TEMP%\_mei10762\cv2\opencv_videoio_ffmpeg500_64.dll
- %TEMP%\_mei10762\cv2\typing\__init__.py
- %TEMP%\_mei10762\cv2\utils\__init__.py
- %TEMP%\_mei10762\cv2\version.py
- %TEMP%\_mei10762\libcrypto-3.dll
- %TEMP%\_mei10762\libffi-8.dll
- %TEMP%\_mei10762\libssl-3.dll
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\delvewheel
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\installer
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\metadata
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\record
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\wheel
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\entry_points.txt
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\license.txt
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\_core\include\numpy\libdivide\license.txt
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\_core\src\common\pythoncapi-compat\copying
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\_core\src\highway\license
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\_core\src\multiarray\dragon4_license.txt
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\_core\src\npysort\x86-simd-sort\license.md
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\_core\src\umath\svml\license
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\fft\pocketfft\license.md
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\linalg\lapack_lite\license.txt
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\ma\license
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\license.md
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\src\distributions\license.md
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\src\mt19937\license.md
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\src\pcg64\license.md
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\src\philox\license.md
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\src\sfc64\license.md
- %TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\src\splitmix64\license.md
- %TEMP%\_mei10762\numpy.libs\libscipy_openblas64_-327b2e0bcffce2882e0dc04cdeb4eaa6.dll
- %TEMP%\_mei10762\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
- %TEMP%\_mei10762\numpy\_core\_multiarray_tests.cp314-win_amd64.pyd
- %TEMP%\_mei10762\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd
- %TEMP%\_mei10762\numpy\fft\_pocketfft_umath.cp314-win_amd64.pyd
- %TEMP%\_mei10762\numpy\linalg\_umath_linalg.cp314-win_amd64.pyd
- %TEMP%\_mei10762\numpy\random\_bounded_integers.cp314-win_amd64.pyd
- %TEMP%\_mei10762\numpy\random\_common.cp314-win_amd64.pyd
- %TEMP%\_mei10762\numpy\random\_generator.cp314-win_amd64.pyd
- %TEMP%\_mei10762\numpy\random\_mt19937.cp314-win_amd64.pyd
- %TEMP%\_mei10762\numpy\random\_pcg64.cp314-win_amd64.pyd
- %TEMP%\_mei10762\numpy\random\_philox.cp314-win_amd64.pyd
- %TEMP%\_mei10762\numpy\random\_sfc64.cp314-win_amd64.pyd
- %TEMP%\_mei10762\numpy\random\bit_generator.cp314-win_amd64.pyd
- %TEMP%\_mei10762\numpy\random\mtrand.cp314-win_amd64.pyd
- %TEMP%\_mei10762\psutil\_psutil_windows.pyd
- %TEMP%\_mei10762\pyexpat.pyd
- %TEMP%\_mei10762\python3.dll
- %TEMP%\_mei10762\python314.dll
- %TEMP%\_mei10762\select.pyd
- %TEMP%\_mei10762\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei10762\sqlite3.dll
- %TEMP%\_mei10762\unicodedata.pyd
- %TEMP%\_iw8o3n2
- %TEMP%\stolen_data\passwords\chrome_login data
- %TEMP%\stolen_data\cookies\chrome_cookies
- %TEMP%\stolen_data\history\chrome_history
- %TEMP%\stolen_data\autofill\chrome_web data
- %TEMP%\stolen_data\passwords\chrome_local state
- %TEMP%\login_pn607zjb\login data
- %TEMP%\cookies_wjz23z0e\cookies
- %TEMP%\history_54yh23ma\history
- %TEMP%\cards_a4pvv47m\web data
- %TEMP%\stolen_data\passwords\edge_login data
- %TEMP%\stolen_data\history\edge_history
- %TEMP%\stolen_data\autofill\edge_web data
- %TEMP%\stolen_data\passwords\edge_local state
- %TEMP%\login_jkbsl6zs\login data
- %TEMP%\history_0t_v6nxw\history
- %TEMP%\cards_qswy7065\web data
- %TEMP%\stolen_data\passwords\opera_login data
- %TEMP%\stolen_data\history\opera_history
- %TEMP%\stolen_data\autofill\opera_web data
- %TEMP%\stolen_data\passwords\opera_local state
- %TEMP%\login_air78mzx\login data
- %TEMP%\history_sbcckok8\history
- %TEMP%\cards_l8zd_e2d\web data
- %TEMP%\stolen_data\passwords\firefox_dnyauhh1.default-release_key4.db
- %TEMP%\stolen_data\cookies\firefox_dnyauhh1.default-release_cookies.sqlite
- %TEMP%\stolen_data\cookies\firefox_dnyauhh1.default-release_cookies.sqlite-shm
- %TEMP%\stolen_data\history\firefox_dnyauhh1.default-release_places.sqlite
- %TEMP%\stolen_data\history\firefox_dnyauhh1.default-release_places.sqlite-shm
- %TEMP%\stolen_data\autofill\firefox_dnyauhh1.default-release_formhistory.sqlite
- %TEMP%\stolen_data\url_uniq_history.txt
- %TEMP%\stolen_data\history\all_history.txt
- %TEMP%\stolen_data\information.txt
- %TEMP%\stolen_data\soft\installed_software.txt
- %TEMP%\stolen_data\files\desktop_508softwareandos.doc
- %TEMP%\stolen_data\files\desktop_about.htm
- %TEMP%\stolen_data\files\desktop_adadsi.html
- %TEMP%\stolen_data\files\desktop_advice_process.htm
- %TEMP%\stolen_data\files\desktop_alert.html
- %TEMP%\stolen_data\files\desktop_aoc_saq_d_v3_merchant.docx
- %TEMP%\stolen_data\files\desktop_cveuropeo.doc
- %TEMP%\stolen_data\files\desktop_holycrosschurchinstructions.docx
- %TEMP%\stolen_data\files\desktop_howto-index.html
- %TEMP%\stolen_data\files\desktop_iisstart.htm
- %TEMP%\stolen_data\files\desktop_lisp_success.doc
- %TEMP%\stolen_data\files\desktop_thlps_keeper_mayer_1965.docx
- %TEMP%\stolen_data\screenshots\screenshot_20260811_195624.png
- %TEMP%\stolen_data\media\000814251_video_01.avi
- %TEMP%\stolen_data\media\archer.avi
- %TEMP%\stolen_data\media\dashborder_144.bmp
- %TEMP%\stolen_data\media\dashborder_192.bmp
- %TEMP%\stolen_data\media\dial.bmp
- %TEMP%\stolen_data\media\tileimage.bmp
- %TEMP%\stolen_data\media\archer_001.avi
- %TEMP%\stolen_data\media\000814251_video_01_001.avi
- %TEMP%\stolen_data\media\join.avi
- %TEMP%\stolen_data\media\delete.avi
- %TEMP%\stolen_data\media\toolbar.bmp
- %TEMP%\stolen_data\media\dialmap.bmp
- %TEMP%\stolen_data\media\dial_001.bmp
- %TEMP%\stolen_data\media\tileimage_001.bmp
- %TEMP%\stolen_data\media\dashborder_144_001.bmp
- %TEMP%\stolen_data\media\region-north-karelia.jpeg
- %TEMP%\stolen_data\media\1189.jpeg
- %TEMP%\stolen_data\media\pushkin.jpeg
- %TEMP%\stolen_data\media\4f0bf7ff71f28.jpeg
- %TEMP%\stolen_data\media\210252809.jpeg
- %TEMP%\stolen_data\media\3.jpeg
- %TEMP%\stolen_data\media\2.jpeg
- %TEMP%\stolen_data\media\2.jpg
- %TEMP%\stolen_data\media\pushkin.jpg
- %TEMP%\stolen_data\media\168.jpg
- %TEMP%\stolen_data\media\parnas_01.jpg
- %TEMP%\stolen_data\media\3.jpg
- %TEMP%\stolen_data\media\4f0bf7ff71f28.jpg
- %TEMP%\stolen_data\media\1189.jpg
- %TEMP%\stolen_data\media\13.jpg
- %TEMP%\stolen_data\media\etc6_m_1.mov
- %TEMP%\stolen_data\media\51.mp4
- %TEMP%\stolen_data\media\clip_480_5sec_6mbps_h264.mp4
- %TEMP%\stolen_data\media\video_1.mp4
- %TEMP%\stolen_data\media\cleanlyrics.png
- %TEMP%\stolen_data\media\asm.png
- %TEMP%\stolen_data\media\breakpoint.png
- %TEMP%\stolen_data\media\background.png
- %TEMP%\stolen_data\media\babyboymaintoscenesbackground_pal.wmv
- %TEMP%\stolen_data\media\babyboymaintoscenesbackground.wmv
- %TEMP%\stolen_data\media\testwmv.wmv
- %TEMP%\stolen_data\media\flower_trans_matte.wmv
- %TEMP%\stolen_data\media\babyboymaintonotesbackground_pal.wmv
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_application_47.0.2526.106_secondarytile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_application_47.0.2526.106_visualelements_logo.png
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_application_47.0.2526.106_visualelements_smalllogo.png
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_google profile.ico
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_aohghmighlieiainnegkcijnfilokake_0.0.0.6_0_icon_128.png
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_aohghmighlieiainnegkcijnfilokake_0.0.0.6_0_icon_16.png
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_apdfllckaahabafndbhieahigkjlhalf_6.2_0_128.png
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_blpcfgokakmgnkcojhhkbfbldkacnbeo_4.2.5_0_128.png
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_128.png
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_16.png
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_32.png
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_48.png
- %TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_pjkljhegncpnkpknbcohdijeoejaedia_7_0_128.png
- %TEMP%\stolen_data\media\users_user_appdata_local_microsoft_edge_user data_default_edge profile.ico
- %TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_26310719480_squaretile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_26310719480_tinytile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_38975140460_squaretile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_38975140460_tinytile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_6501008900_squaretile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_6501008900_tinytile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_7603651830_squaretile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_7603651830_tinytile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_wallpaper.bmp
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_000814251_video_01.avi
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_000814251_video_01_001.avi
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_1189.jpeg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_1189.jpg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_13.jpg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_168.jpg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_2.jpeg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_2.jpg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_210252809.jpeg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_3.jpeg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_3.jpg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_4f0bf7ff71f28.jpeg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_4f0bf7ff71f28.jpg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_51.mp4
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_archer.avi
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_archer_001.avi
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_asm.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_babyboymaintonotesbackground_pal.wmv
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_babyboymaintoscenesbackground.wmv
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_babyboymaintoscenesbackground_pal.wmv
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_background.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_breakpoint.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_cleanlyrics.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_clip_480_5sec_6mbps_h264.mp4
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_dashborder_144.bmp
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_dashborder_144_001.bmp
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_dashborder_192.bmp
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_delete.avi
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_dial.bmp
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_dialmap.bmp
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_dial_001.bmp
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_etc6_m_1.mov
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_flower_trans_matte.wmv
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_join.avi
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_parnas_01.jpg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_pushkin.jpeg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_pushkin.jpg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_region-north-karelia.jpeg
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_testwmv.wmv
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_tileimage.bmp
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_tileimage_001.bmp
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_toolbar.bmp
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_application_47.0.2526.106_secondarytile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_application_47.0.2526.106_visualelements_logo.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_application_47.0.2526.106_visualelements_smalllogo.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_aohghmighlieiainnegkcijnfilokake_0.0.0.6_0_icon_128....
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_aohghmighlieiainnegkcijnfilokake_0.0.0.6_0_icon_16.p...
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_apdfllckaahabafndbhieahigkjlhalf_6.2_0_128.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_blpcfgokakmgnkcojhhkbfbldkacnbeo_4.2.5_0_128.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_128.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_16.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_32.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_48.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_pjkljhegncpnkpknbcohdijeoejaedia_7_0_128.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_google profile.ico
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_microsoft_edge_user data_default_edge profile.ico
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_26310719480_squaretile.pn...
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_26310719480_tinytile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_38975140460_squaretile.pn...
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_38975140460_tinytile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_6501008900_squaretile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_6501008900_tinytile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_7603651830_squaretile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_7603651830_tinytile.png
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_temp_wallpaper.bmp
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_video_1.mp4
- %TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_screenshots_screenshot_20260811_195624.png
- %TEMP%\stolen_data\media\users_user_desktop_000814251_video_01.avi
- %TEMP%\stolen_data\media\users_user_desktop_archer.avi
- %TEMP%\stolen_data\media\users_user_desktop_dashborder_144.bmp
- %TEMP%\stolen_data\media\users_user_desktop_dashborder_192.bmp
- %TEMP%\stolen_data\media\users_user_desktop_dial.bmp
- %TEMP%\stolen_data\media\users_user_desktop_tileimage.bmp
- %TEMP%\stolen_zdbmrvaun_20260811_195630_part001.zip
- %TEMP%\stolen_zdbmrvaun_20260811_195630_part002.zip
Deletes following files that it created itself
- %TEMP%\_iw8o3n2
- %TEMP%\login_pn607zjb\login data
- %TEMP%\cookies_wjz23z0e\cookies
- %TEMP%\history_54yh23ma\history
- %TEMP%\login_jkbsl6zs\login data
- %TEMP%\history_0t_v6nxw\history
- %TEMP%\cards_qswy7065\web data
- %TEMP%\login_air78mzx\login data
- %TEMP%\history_sbcckok8\history
Network activity
Connects to
- 'gi##ub.com':443
- 'ap#.#pify.org':443
- 'ap#.##legram.org':443
TCP
Other
- 'gi##ub.com':443
- 'ap#.#pify.org':443
UDP
- DNS ASK gi##ub.com
- DNS ASK ap#.#pify.org
- DNS ASK ap#.##legram.org
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '<SYSTEM32>\wbem\wmic.exe' product get name,version
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command Get-Clipboard
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
