Trojan.Siggen18.27461

Technical Information

Malicious functions

Injects code into

the following user processes:

sidequest.exe

Modifies file system

Creates the following files

%TEMP%\nsf252.tmp\system.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\delete.c854d90e1b59d73ef683.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\back_arrow.2f0a2908c0024613aeb6.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\3rdpartylicenses.txt
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\uninstaller.nsh
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\notarize.js
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\installersidebar.bmp
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\installerheader.bmp
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\installer.nsh
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\vi.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\icon.ico
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\experimental.apk
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\entitlements.mac.plist
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\background@2x.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\background.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\elevate.exe
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app-update.yml
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\zh-tw.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\icon.icns
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\zh-cn.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\favicon.ico
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\runtime-es5.64c61bd775bebb7bc83e.js
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\delete.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\create-organisation.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\close.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\back_arrow.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\background.jpg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\back.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\back.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\allow-auth.webp
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\main-es2015.257696102f022176197f.js
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\index.html
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\runtime-es2015.64c61bd775bebb7bc83e.js
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\roboto-regular-webfont.cfc3cf7f74f9eda47185.eot
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\roboto-regular-webfont.ccc2dd0b454fbaab2a3c.woff
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\roboto-regular-webfont.13d9d23ef6bf480304a2.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\roboto-regular-webfont.112fa84dbbfe1ca2922a.ttf
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\polyfills-es5.2d7d8d208be454f40d3d.js
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\polyfills-es2015.4e77e537cbeb6a433666.js
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\main-es5.257696102f022176197f.js
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\styles.1e903db46f5bcaaf3663.css
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\uk.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\tr.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\th.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\hu.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\hr.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\hi.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\he.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\gu.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\fr.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\fil.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\it.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\fi.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\et.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\es.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\es-419.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\en-us.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\en-gb.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\el.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\de.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\da.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\fa.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\ja.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\id.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\kn.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\te.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\pt-pt.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\ta.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\sw.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\sv.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\sr.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\sl.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\sk.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\ru.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\ro.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\pt-br.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\ko.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\pl.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\nl.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\nb.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\ms.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\mr.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\ml.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\lv.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\lt.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\enable-dev-mode.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\expand_less.png
%TEMP%\bbd00052-502d-485d-a938-ef5adf66567f.tmp
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\feedback.png
%APPDATA%\sidequestlite\cache\f_000001
%APPDATA%\sidequestlite\dictionaries\en-us-9-0.bdic
%APPDATA%\sidequestlite\cache\data_3
%APPDATA%\sidequestlite\cache\data_2
%APPDATA%\sidequestlite\cache\data_1
%APPDATA%\sidequestlite\cache\data_0
%APPDATA%\sidequestlite\cache\index
%APPDATA%\sidequestlite\gpucache\data_3
%APPDATA%\sidequestlite\config.json.tmp-8729995822935429
%APPDATA%\sidequestlite\gpucache\data_2
%APPDATA%\sidequestlite\code cache\js\index-dir\temp-index
%APPDATA%\sidequestlite\code cache\wasm\index-dir\temp-index
%APPDATA%\sidequestlite\gpucache\data_0
%APPDATA%\sidequestlite\gpucache\index
%APPDATA%\sidequestlite\local storage\leveldb\000001.dbtmp
%APPDATA%\sidequestlite\local storage\leveldb\manifest-000001
%APPDATA%\sidequestlite\local storage\leveldb\log
%APPDATA%\sidequestlite\code cache\wasm\index
%APPDATA%\sidequestlite\gpucache\data_1
%APPDATA%\sidequestlite\code cache\js\index
%APPDATA%\sidequestlite\a1cefba5-69f6-46f6-8ee1-0af164af6e8a.tmp
%APPDATA%\sidequestlite\platform-tools\etc1tool.exe
%HOMEPATH%\.android\adbkey
%HOMEPATH%\.android\adbkey.pub
%TEMP%\adb.log
%APPDATA%\sidequestlite\fb9db94b-6932-4a02-828d-b7df966465d8.tmp
%TEMP%\c9ad7940-c1a4-4b04-be24-f8b2470a77f2.tmp.node
%APPDATA%\sidequestlite\platform-tools\adb.exe
%APPDATA%\sidequestlite\platform-tools\adbwinapi.dll
%APPDATA%\sidequestlite\platform-tools\adbwinusbapi.dll
%APPDATA%\sidequestlite\platform-tools\source.properties
%APPDATA%\sidequestlite\platform-tools\sqlite3.exe
%APPDATA%\sidequestlite\platform-tools\fastboot.exe
%APPDATA%\sidequestlite\platform-tools\hprof-conv.exe
%APPDATA%\sidequestlite\platform-tools\libwinpthread-1.dll
%APPDATA%\sidequestlite\platform-tools\make_f2fs.exe
%APPDATA%\sidequestlite\platform-tools\make_f2fs_casefold.exe
%APPDATA%\sidequestlite\platform-tools\mke2fs.conf
%APPDATA%\sidequestlite\platform-tools\mke2fs.exe
%APPDATA%\sidequestlite\platform-tools\notice.txt
%APPDATA%\sidequestlite\platform-tools\dmtracedump.exe
%TEMP%\nsf252.tmp\stdutils.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\swiftshader\libglesv2.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\swiftshader\libegl.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\setup\enable_dev_mode.mp4
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\setup\create_organisation.mp4
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\setup\connect_accept.mp4
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\fonts\roboto-regular-webfont.woff
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\fonts\roboto-regular-webfont.ttf
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\fonts\roboto-regular-webfont.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\fonts\roboto-regular-webfont.eot
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\icons\128x128.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\verify.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\support.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\setup.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\refresh.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\logo.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\info.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\home.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\headset_settings.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\folder.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\transfer_files.svg
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\icons\16x16.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\icons\1024x1024.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\icons\24x24.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\sqlite3.exe
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\fastboot.exe
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\source.properties
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\notice.txt
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\mke2fs.exe
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\mke2fs.conf
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\make_f2fs_casefold.exe
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\make_f2fs.exe
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\libwinpthread-1.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\hprof-conv.exe
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\etc1tool.exe
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\icons\256x256.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\dmtracedump.exe
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\adbwinusbapi.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\adbwinapi.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\platform-tools\adb.exe
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\icons\64x64.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\icons\512x512.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\icons\48x48.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\icons\32x32.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\cs.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources\app.asar.unpacked\build\app\assets\expand.png
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\ca.pak
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\setup.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\3rdpartylicenses.txt
%TEMP%\nsf252.tmp\7z-out\resources\app.asar
%TEMP%\nsf252.tmp\7z-out\resources\app-update.yml
%TEMP%\nsf252.tmp\7z-out\resources.pak
%TEMP%\nsf252.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsf252.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsf252.tmp\7z-out\locales\vi.pak
%TEMP%\nsf252.tmp\7z-out\locales\uk.pak
%TEMP%\nsf252.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsf252.tmp\7z-out\locales\tr.pak
%TEMP%\nsf252.tmp\7z-out\locales\te.pak
%TEMP%\nsf252.tmp\7z-out\locales\ta.pak
%TEMP%\nsf252.tmp\7z-out\locales\sw.pak
%TEMP%\nsf252.tmp\7z-out\locales\sv.pak
%TEMP%\nsf252.tmp\7z-out\locales\sr.pak
%TEMP%\nsf252.tmp\7z-out\locales\sl.pak
%TEMP%\nsf252.tmp\7z-out\locales\sk.pak
%TEMP%\nsf252.tmp\7z-out\locales\ru.pak
%TEMP%\nsf252.tmp\7z-out\locales\th.pak
%TEMP%\nsf252.tmp\7z-out\locales\ro.pak
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\allow-auth.webp
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\feedback.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\logo.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\info.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\home.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\headset_settings.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\fonts\roboto-regular-webfont.woff
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\fonts\roboto-regular-webfont.ttf
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\fonts\roboto-regular-webfont.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\fonts\roboto-regular-webfont.eot
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\back.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\back.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\expand_less.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\expand.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\enable-dev-mode.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\delete.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\create-organisation.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\close.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\back_arrow.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\background.jpg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\folder.png
%TEMP%\nsf252.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsf252.tmp\7z-out\locales\pl.pak
%TEMP%\nsf252.tmp\7z-out\locales\nl.pak
%TEMP%\nsf252.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsf252.tmp\7z-out\locales\el.pak
%TEMP%\nsf252.tmp\7z-out\locales\de.pak
%TEMP%\nsf252.tmp\7z-out\locales\da.pak
%TEMP%\nsf252.tmp\7z-out\locales\cs.pak
%TEMP%\nsf252.tmp\7z-out\locales\ca.pak
%TEMP%\nsf252.tmp\7z-out\locales\bn.pak
%TEMP%\nsf252.tmp\7z-out\locales\es-419.pak
%TEMP%\nsf252.tmp\7z-out\locales\bg.pak
%TEMP%\nsf252.tmp\7z-out\locales\am.pak
%TEMP%\nsf252.tmp\7z-out\licenses.chromium.html
%TEMP%\nsf252.tmp\7z-out\license.electron.txt
%TEMP%\nsf252.tmp\7z-out\icudtl.dat
%TEMP%\nsf252.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsf252.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsf252.tmp\nsis7z.dll
%TEMP%\nsf252.tmp\app-64.7z
%TEMP%\nsf252.tmp\7z-out\locales\ar.pak
%TEMP%\nsf252.tmp\7z-out\locales\es.pak
%TEMP%\nsf252.tmp\7z-out\locales\en-us.pak
%TEMP%\nsf252.tmp\7z-out\locales\et.pak
%TEMP%\nsf252.tmp\7z-out\locales\nb.pak
%TEMP%\nsf252.tmp\7z-out\locales\it.pak
%TEMP%\nsf252.tmp\7z-out\locales\ms.pak
%TEMP%\nsf252.tmp\7z-out\locales\mr.pak
%TEMP%\nsf252.tmp\7z-out\locales\ml.pak
%TEMP%\nsf252.tmp\7z-out\locales\lv.pak
%TEMP%\nsf252.tmp\7z-out\locales\lt.pak
%TEMP%\nsf252.tmp\7z-out\locales\ko.pak
%TEMP%\nsf252.tmp\7z-out\locales\kn.pak
%TEMP%\nsf252.tmp\7z-out\locales\ja.pak
%TEMP%\nsf252.tmp\7z-out\locales\id.pak
%TEMP%\nsf252.tmp\7z-out\locales\fa.pak
%TEMP%\nsf252.tmp\7z-out\locales\hu.pak
%TEMP%\nsf252.tmp\7z-out\locales\hr.pak
%TEMP%\nsf252.tmp\7z-out\locales\hi.pak
%TEMP%\nsf252.tmp\7z-out\locales\he.pak
%TEMP%\nsf252.tmp\7z-out\locales\gu.pak
%TEMP%\nsf252.tmp\7z-out\locales\fr.pak
%TEMP%\nsf252.tmp\7z-out\locales\fil.pak
%TEMP%\nsf252.tmp\7z-out\locales\fi.pak
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\refresh.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\setup\connect_accept.mp4
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\bg.pak
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\setup\create_organisation.mp4
%TEMP%\nsf252.tmp\7z-out\swiftshader\libegl.dll
%TEMP%\nsf252.tmp\7z-out\sidequest.exe
%TEMP%\nsf252.tmp\7z-out\resources\elevate.exe
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\sqlite3.exe
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\mke2fs.exe
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\make_f2fs_casefold.exe
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\make_f2fs.exe
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\libwinpthread-1.dll
%TEMP%\nsf252.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\hprof-conv.exe
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\etc1tool.exe
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\dmtracedump.exe
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\adbwinusbapi.dll
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\adbwinapi.dll
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\adb.exe
%TEMP%\nsf252.tmp\7z-out\libglesv2.dll
%TEMP%\nsf252.tmp\7z-out\libegl.dll
%TEMP%\nsf252.tmp\7z-out\ffmpeg.dll
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\fastboot.exe
%TEMP%\nsf252.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsf252.tmp\7z-out\swiftshader\libglesv2.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\licenses.chromium.html
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\ar.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\am.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\vulkan-1.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\vk_swiftshader_icd.json
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\vk_swiftshader.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\v8_context_snapshot.bin
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\snapshot_blob.bin
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\sidequest.exe
%TEMP%\nsf252.tmp\7z-out\vulkan-1.dll
%TEMP%\nsf252.tmp\7z-out\vk_swiftshader.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\license.electron.txt
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\libglesv2.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\libegl.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\icudtl.dat
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\ffmpeg.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\d3dcompiler_47.dll
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\chrome_200_percent.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\chrome_100_percent.pak
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\resources.pak
%TEMP%\nsf252.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsf252.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\uninstaller.nsh
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\runtime-es2015.64c61bd775bebb7bc83e.js
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\roboto-regular-webfont.cfc3cf7f74f9eda47185.eot
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\roboto-regular-webfont.ccc2dd0b454fbaab2a3c.woff
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\roboto-regular-webfont.13d9d23ef6bf480304a2.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\roboto-regular-webfont.112fa84dbbfe1ca2922a.ttf
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\polyfills-es5.2d7d8d208be454f40d3d.js
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\polyfills-es2015.4e77e537cbeb6a433666.js
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\styles.1e903db46f5bcaaf3663.css
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\main-es5.257696102f022176197f.js
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\index.html
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\favicon.ico
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\delete.c854d90e1b59d73ef683.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\back_arrow.2f0a2908c0024613aeb6.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\verify.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\transfer_files.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\support.svg
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\assets\setup\enable_dev_mode.mp4
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\main-es2015.257696102f022176197f.js
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\background.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\app\runtime-es5.64c61bd775bebb7bc83e.js
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\background@2x.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\source.properties
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\icons\48x48.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\notice.txt
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\platform-tools\mke2fs.conf
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\notarize.js
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\installersidebar.bmp
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\installerheader.bmp
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\installer.nsh
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\icons\64x64.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\icons\512x512.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\icons\32x32.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\entitlements.mac.plist
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\icons\256x256.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\icons\24x24.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\icons\16x16.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\icons\128x128.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\icons\1024x1024.png
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\icon.ico
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\icon.icns
%TEMP%\nsf252.tmp\7z-out\resources\app.asar.unpacked\build\experimental.apk
%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\locales\bn.pak
%APPDATA%\sidequestlite\fontlookuptablecache\font_unique_name_table.pb

Deletes the following files

%APPDATA%\sidequestlite\network persistent state~rfdf2e6.tmp

Moves the following files

from %APPDATA%\sidequestlite\config.json.tmp-8729995822935429 to %APPDATA%\sidequestlite\config.json
from %APPDATA%\sidequestlite\local storage\leveldb\000001.dbtmp to %APPDATA%\sidequestlite\local storage\leveldb\current
from %APPDATA%\sidequestlite\code cache\wasm\index-dir\temp-index to %APPDATA%\sidequestlite\code cache\wasm\index-dir\the-real-index
from %APPDATA%\sidequestlite\code cache\js\index-dir\temp-index to %APPDATA%\sidequestlite\code cache\js\index-dir\the-real-index
from %APPDATA%\sidequestlite\a1cefba5-69f6-46f6-8ee1-0af164af6e8a.tmp to %APPDATA%\sidequestlite\preferences
from %APPDATA%\sidequestlite\fb9db94b-6932-4a02-828d-b7df966465d8.tmp to %APPDATA%\sidequestlite\network persistent state
from %APPDATA%\sidequestlite\network persistent state to %APPDATA%\sidequestlite\network persistent state~rfdf2e6.tmp

Network activity

Connects to

're####ctor.gvt1.com':443
'localhost':5581
'localhost':5579
'localhost':5577
'localhost':5575
'localhost':5573
'localhost':5571
'localhost':5569
'localhost':5567
'ap#.##dequestvr.com':443
'localhost':5565
'localhost':5563
'localhost':5561
'localhost':5559
'localhost':5557
'localhost':5354
'localhost':5555
'localhost':62374
'localhost':62372
'localhost':5037
'localhost':5583
'localhost':5585

TCP

Other

're####ctor.gvt1.com':443
'localhost':62412
'localhost':62413
'localhost':62414
'localhost':62415
'localhost':62416
'localhost':62410
'localhost':62411
'localhost':62417
'localhost':62420
'localhost':62421
'localhost':62422
'localhost':62423
'localhost':62424
'localhost':62418
'localhost':62419
'localhost':62409
'localhost':62408
'localhost':62407
'localhost':62374
'localhost':5037
'localhost':62379
'localhost':62383
'localhost':62384
'ap#.##dequestvr.com':443
'r1######pivhx-n8vl.gvt1.com':443
'localhost':62388
'localhost':62394
'localhost':62395
'localhost':62398
'localhost':62399
'localhost':62402
'localhost':62403
'localhost':62389
'localhost':62425
'localhost':62426

UDP

DNS ASK re####ctor.gvt1.com
DNS ASK r1######pivhx-n8vl.gvt1.com
DNS ASK ap#.##dequestvr.com
'r1######pivhx-n8vl.gvt1.com':443

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''

Creates and executes the following

'%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\sidequest.exe'
'%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\sidequest.exe' --type=gpu-process --field-trial-handle=1076,10576959888681887439,11285089057864504560,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSite...
'%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\sidequest.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1076,10576959888681887439,11285089057864504560,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,S...
'%TEMP%\2b10iaead6h8wvkp2kzryo10rqv\sidequest.exe' --type=renderer --field-trial-handle=1076,10576959888681887439,11285089057864504560,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePer...
'<SYSTEM32>\cmd.exe' /d /s /c ""%APPDATA%\sidequestlite\platform-tools\adb.exe" devices"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /d /s /c ""%APPDATA%\sidequestlite\platform-tools\adb.exe" devices"
'%APPDATA%\sidequestlite\platform-tools\adb.exe' devices
'%APPDATA%\sidequestlite\platform-tools\adb.exe' -L tcp:5037 fork-server server --reply-fd 240

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial