Trojan.Siggen18.29097

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Classes\gdlauncher\shell\open\command] '' = '"%LOCALAPPDATA%\Programs\gdlauncher\GDLauncher.exe" "%1"'

Malicious functions

Injects code into

the following user processes:

gdlauncher.exe

Modifies file system

Creates the following files

%TEMP%\nsmab3d.tmp\system.dll
%LOCALAPPDATA%\programs\gdlauncher\locales\ko.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\lt.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\lv.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\ml.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\mr.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\ms.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\nb.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\nl.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\pl.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\pt-br.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\en-us.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\pt-pt.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\ru.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\sk.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\sl.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\sr.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\sv.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\sw.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\ta.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\te.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\th.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\tr.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\ja.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\kn.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\it.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\id.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\hu.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\af.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\am.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\ar.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\bg.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\bn.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\ca.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\cs.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\da.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\de.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\el.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\uk.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\ro.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\en-gb.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\es.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\et.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\fa.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\fi.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\fil.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\fr.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\gu.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\he.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\hi.pak
%LOCALAPPDATA%\programs\gdlauncher\locales\hr.pak
%LOCALAPPDATA%\programs\gdlauncher\vulkan-1.dll
%LOCALAPPDATA%\programs\gdlauncher\locales\es-419.pak
%APPDATA%\gdlauncher_next\local storage\leveldb\log
%APPDATA%\gdlauncher_next\02c65de4-39f0-44dd-b359-4c518cbec107.tmp
%LOCALAPPDATA%\programs\gdlauncher\locales\zh-cn.pak
%APPDATA%\gdlauncher_next\dictionaries\en-us-10-1.bdic
%APPDATA%\gdlauncher_next\cache\cache_data\f_000001
%APPDATA%\gdlauncher_next\network\cookies-journal
%APPDATA%\gdlauncher_next\network\cookies
%APPDATA%\gdlauncher_next\cache\cache_data\f_000002
%APPDATA%\gdlauncher_next\b7883dd0-9f3e-43ea-92ba-460fd6922e5e.tmp
%APPDATA%\gdlauncher_next\44db6207-afe1-44b6-8412-895240fbe5af.tmp
%APPDATA%\gdlauncher_next\webstorage\quotamanager-journal
%APPDATA%\gdlauncher_next\webstorage\quotamanager
%APPDATA%\gdlauncher_next\databases\databases.db-journal
%LOCALAPPDATA%\programs\gdlauncher\locales\ur.pak
%APPDATA%\gdlauncher_next\databases\databases.db
%APPDATA%\gdlauncher_next\indexeddb\file__0.indexeddb.leveldb\manifest-000001
%APPDATA%\gdlauncher_next\indexeddb\file__0.indexeddb.leveldb\000001.dbtmp
%APPDATA%\gdlauncher_next\indexeddb\file__0.indexeddb.leveldb\000003.log
%APPDATA%\gdlauncher_next\network\295a16c8-8ad2-4ff1-8330-842c79969e14.tmp
%APPDATA%\gdlauncher_next\.updaterid
%APPDATA%\gdlauncher_next\network\4f76ecfe-7aeb-4ae8-8a23-95cde5f964c2.tmp
%APPDATA%\gdlauncher_next\indexeddb\file__0.indexeddb.blob\1\00\2
%TEMP%\1d7fca06-7f59-410d-b457-579457257ec2.tmp
%APPDATA%\gdlauncher_next\cache\cache_data\f_000003
%APPDATA%\gdlauncher_next\fontlookuptablecache\font_unique_name_table.pb
%APPDATA%\gdlauncher_next\cache\cache_data\data_2
%APPDATA%\gdlauncher_next\cache\cache_data\data_3
%APPDATA%\gdlauncher_next\cache\cache_data\data_1
%APPDATA%\gdlauncher_next\cache\cache_data\data_0
%APPDATA%\gdlauncher_next\cache\cache_data\index
%LOCALAPPDATA%\programs\gdlauncher\resources\app-update.yml
%LOCALAPPDATA%\programs\gdlauncher\resources\app.asar
%LOCALAPPDATA%\programs\gdlauncher\resources\elevate.exe
%LOCALAPPDATA%\gdlauncher-updater\installer.exe
%LOCALAPPDATA%\programs\gdlauncher\uninstall gdlauncher.exe
%APPDATA%\microsoft\windows\start menu\programs\gdlauncher.lnk
%TEMP%\nsmab3d.tmp\winshell.dll
%HOMEPATH%\desktop\gdlauncher.lnk
%TEMP%\0deabdbd-f614-40cd-9c04-7843c7a29434.tmp.node
%TEMP%\a25b266d-ed4c-4dff-84bf-a1d684555cf8.tmp.node
%LOCALAPPDATA%\programs\gdlauncher\locales\vi.pak
%LOCALAPPDATA%\programs\gdlauncher\vk_swiftshader_icd.json
%APPDATA%\gdlauncher\logs\main.log
%APPDATA%\gdlauncher_next\local storage\leveldb\000001.dbtmp
%APPDATA%\gdlauncher_next\code cache\js\index
%APPDATA%\gdlauncher_next\code cache\js\index-dir\temp-index
%APPDATA%\gdlauncher_next\code cache\wasm\index
%APPDATA%\gdlauncher_next\code cache\wasm\index-dir\temp-index
%APPDATA%\gdlauncher_next\gpucache\index
%APPDATA%\gdlauncher_next\gpucache\data_0
%APPDATA%\gdlauncher_next\gpucache\data_1
%APPDATA%\gdlauncher_next\gpucache\data_2
%APPDATA%\gdlauncher_next\gpucache\data_3
%LOCALAPPDATA%\programs\gdlauncher\locales\zh-tw.pak
%APPDATA%\gdlauncher_next\local storage\leveldb\manifest-000001
%APPDATA%\gdlauncher_next\indexeddb\file__0.indexeddb.leveldb\log
%LOCALAPPDATA%\programs\gdlauncher\vk_swiftshader.dll
%LOCALAPPDATA%\programs\gdlauncher\info-about-msvcredist.txt
%TEMP%\nsmab3d.tmp\7z-out\locales\fr.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\gu.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\he.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\hi.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\hr.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\hu.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\id.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\it.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ja.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\kn.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\am.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ko.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\lv.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ml.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\mr.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ms.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\nb.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\nl.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\pl.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ro.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\fi.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\fil.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\fa.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\et.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\es.pak
%TEMP%\nsmab3d.tmp\spiderbanner.dll
%TEMP%\nsmab3d.tmp\nsexec.dll
%TEMP%\nsmab3d.tmp\app-64.7z
%TEMP%\nsmab3d.tmp\nsis7z.dll
%TEMP%\nsmab3d.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsmab3d.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsmab3d.tmp\7z-out\icudtl.dat
%TEMP%\nsmab3d.tmp\7z-out\info-about-msvcredist.txt
%TEMP%\nsmab3d.tmp\7z-out\license.electron.txt
%TEMP%\nsmab3d.tmp\7z-out\licenses.chromium.html
%TEMP%\nsmab3d.tmp\7z-out\locales\ru.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\lt.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\af.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\bg.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\bn.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ca.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\cs.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\da.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\de.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\el.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\en-us.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\es-419.pak
%TEMP%\nsmab3d.tmp\stdutils.dll
%TEMP%\nsmab3d.tmp\7z-out\locales\ar.pak
%TEMP%\nsmab3d.tmp\7z-out\resources\app-update.yml
%LOCALAPPDATA%\programs\gdlauncher\vccorlib140.dll
%TEMP%\nsmab3d.tmp\7z-out\locales\sr.pak
%TEMP%\nsmab3d.tmp\7z-out\vcruntime140.dll
%TEMP%\nsmab3d.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsmab3d.tmp\7z-out\vulkan-1.dll
%LOCALAPPDATA%\programs\gdlauncher\7za.exe
%LOCALAPPDATA%\programs\gdlauncher\chrome_100_percent.pak
%LOCALAPPDATA%\programs\gdlauncher\chrome_200_percent.pak
%LOCALAPPDATA%\programs\gdlauncher\concrt140.dll
%LOCALAPPDATA%\programs\gdlauncher\d3dcompiler_47.dll
%LOCALAPPDATA%\programs\gdlauncher\ffmpeg.dll
%LOCALAPPDATA%\programs\gdlauncher\gdlauncher.exe
%TEMP%\nsmab3d.tmp\7z-out\locales\sk.pak
%LOCALAPPDATA%\programs\gdlauncher\icudtl.dat
%LOCALAPPDATA%\programs\gdlauncher\libegl.dll
%LOCALAPPDATA%\programs\gdlauncher\libglesv2.dll
%LOCALAPPDATA%\programs\gdlauncher\license.electron.txt
%LOCALAPPDATA%\programs\gdlauncher\licenses.chromium.html
%LOCALAPPDATA%\programs\gdlauncher\msvcp140.dll
%LOCALAPPDATA%\programs\gdlauncher\msvcp140_1.dll
%LOCALAPPDATA%\programs\gdlauncher\msvcp140_2.dll
%LOCALAPPDATA%\programs\gdlauncher\resources.pak
%LOCALAPPDATA%\programs\gdlauncher\snapshot_blob.bin
%LOCALAPPDATA%\programs\gdlauncher\v8_context_snapshot.bin
%TEMP%\nsmab3d.tmp\7z-out\resources\elevate.exe
%TEMP%\nsmab3d.tmp\7z-out\vccorlib140.dll
%TEMP%\nsmab3d.tmp\7z-out\msvcp140_2.dll
%TEMP%\nsmab3d.tmp\7z-out\msvcp140_1.dll
%TEMP%\nsmab3d.tmp\7z-out\msvcp140.dll
%TEMP%\nsmab3d.tmp\7z-out\locales\sw.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ta.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\te.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\th.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\tr.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\uk.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ur.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\vi.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\sl.pak
%LOCALAPPDATA%\programs\gdlauncher\vcruntime140.dll
%TEMP%\nsmab3d.tmp\7z-out\resources.pak
%TEMP%\nsmab3d.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsmab3d.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsmab3d.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsmab3d.tmp\7z-out\7za.exe
%TEMP%\nsmab3d.tmp\7z-out\concrt140.dll
%TEMP%\nsmab3d.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsmab3d.tmp\7z-out\ffmpeg.dll
%TEMP%\nsmab3d.tmp\7z-out\gdlauncher.exe
%TEMP%\nsmab3d.tmp\7z-out\libegl.dll
%TEMP%\nsmab3d.tmp\7z-out\libglesv2.dll
%TEMP%\nsmab3d.tmp\7z-out\locales\sv.pak
%TEMP%\nsmab3d.tmp\7z-out\resources\app.asar
%APPDATA%\gdlauncher_next\network\b7badf72-c69f-4c4b-ad9f-8e9033c8e8cc.tmp

Deletes the following files

%TEMP%\nsmab3d.tmp\7z-out\7za.exe
%TEMP%\nsmab3d.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\vi.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ur.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\uk.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\tr.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\th.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\te.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ta.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\sw.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\sv.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\sr.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\sl.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\sk.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ru.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ro.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\pl.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\nl.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsmab3d.tmp\7z-out\msvcp140.dll
%TEMP%\nsmab3d.tmp\7z-out\msvcp140_1.dll
%TEMP%\nsmab3d.tmp\7z-out\msvcp140_2.dll
%APPDATA%\gdlauncher_next\network\transportsecurity~rf12e214.tmp
%APPDATA%\gdlauncher_next\preferences~rf12d7c8.tmp
%TEMP%\nsmab3d.tmp\winshell.dll
%TEMP%\nsmab3d.tmp\system.dll
%TEMP%\nsmab3d.tmp\stdutils.dll
%TEMP%\nsmab3d.tmp\spiderbanner.dll
%TEMP%\nsmab3d.tmp\nsis7z.dll
%TEMP%\nsmab3d.tmp\nsexec.dll
%TEMP%\nsmab3d.tmp\app-64.7z
%TEMP%\nsmab3d.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsmab3d.tmp\7z-out\vulkan-1.dll
%TEMP%\nsmab3d.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsmab3d.tmp\7z-out\vcruntime140.dll
%TEMP%\nsmab3d.tmp\7z-out\vccorlib140.dll
%TEMP%\nsmab3d.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsmab3d.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsmab3d.tmp\7z-out\resources.pak
%TEMP%\nsmab3d.tmp\7z-out\resources\elevate.exe
%TEMP%\nsmab3d.tmp\7z-out\resources\app.asar
%TEMP%\nsmab3d.tmp\7z-out\resources\app-update.yml
%APPDATA%\gdlauncher_next\network\network persistent state~rf139166.tmp
%TEMP%\nsmab3d.tmp\7z-out\locales\nb.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ms.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\mr.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\cs.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ca.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\bn.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\bg.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ar.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\am.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\af.pak
%TEMP%\nsmab3d.tmp\7z-out\licenses.chromium.html
%TEMP%\nsmab3d.tmp\7z-out\license.electron.txt
%TEMP%\nsmab3d.tmp\7z-out\libglesv2.dll
%TEMP%\nsmab3d.tmp\7z-out\libegl.dll
%TEMP%\nsmab3d.tmp\7z-out\info-about-msvcredist.txt
%TEMP%\nsmab3d.tmp\7z-out\icudtl.dat
%TEMP%\nsmab3d.tmp\7z-out\gdlauncher.exe
%TEMP%\nsmab3d.tmp\7z-out\ffmpeg.dll
%TEMP%\nsmab3d.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsmab3d.tmp\7z-out\concrt140.dll
%TEMP%\nsmab3d.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsmab3d.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\da.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\de.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\el.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\lv.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\lt.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ko.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\kn.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ja.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\it.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\id.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\hu.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\hr.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\he.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\hi.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\gu.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\fr.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\fil.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\fi.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\fa.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\et.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\es.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\es-419.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\en-us.pak
%TEMP%\nsmab3d.tmp\7z-out\locales\ml.pak
%APPDATA%\gdlauncher_next\network\transportsecurity~rf139ece.tmp

Moves the following files

from %APPDATA%\gdlauncher_next\local storage\leveldb\000001.dbtmp to %APPDATA%\gdlauncher_next\local storage\leveldb\current
from %APPDATA%\gdlauncher_next\code cache\js\index-dir\temp-index to %APPDATA%\gdlauncher_next\code cache\js\index-dir\the-real-index
from %APPDATA%\gdlauncher_next\code cache\wasm\index-dir\temp-index to %APPDATA%\gdlauncher_next\code cache\wasm\index-dir\the-real-index
from %APPDATA%\gdlauncher_next\b7883dd0-9f3e-43ea-92ba-460fd6922e5e.tmp to %APPDATA%\gdlauncher_next\local state
from %APPDATA%\gdlauncher_next\44db6207-afe1-44b6-8412-895240fbe5af.tmp to %APPDATA%\gdlauncher_next\preferences
from %APPDATA%\gdlauncher_next\indexeddb\file__0.indexeddb.leveldb\000001.dbtmp to %APPDATA%\gdlauncher_next\indexeddb\file__0.indexeddb.leveldb\current
from %APPDATA%\gdlauncher_next\network\295a16c8-8ad2-4ff1-8330-842c79969e14.tmp to %APPDATA%\gdlauncher_next\network\network persistent state
from %APPDATA%\gdlauncher_next\network\4f76ecfe-7aeb-4ae8-8a23-95cde5f964c2.tmp to %APPDATA%\gdlauncher_next\network\transportsecurity
from %APPDATA%\gdlauncher_next\preferences to %APPDATA%\gdlauncher_next\preferences~rf12d7c8.tmp
from %APPDATA%\gdlauncher_next\network\transportsecurity to %APPDATA%\gdlauncher_next\network\transportsecurity~rf12e214.tmp
from %APPDATA%\gdlauncher_next\network\network persistent state to %APPDATA%\gdlauncher_next\network\network persistent state~rf139166.tmp
from %APPDATA%\gdlauncher_next\network\transportsecurity to %APPDATA%\gdlauncher_next\network\transportsecurity~rf139ece.tmp

Substitutes the following files

%APPDATA%\gdlauncher_next\preferences
%APPDATA%\gdlauncher_next\network\transportsecurity

Network activity

Connects to

'dn#.google':443
're####ctor.gvt1.com':443
'74.##5.131.113':443
'me##.#abricmc.net':443
'cd#.##launcher.com':443
'13.##.243.23':443
'51.##.83.165':443
'14#.#2.121.3':443
'18#.#99.109.133':443
'x.##2.us':80
'microsoft.com':80

TCP

HTTP GET requests

http://x.##2.us/x.cer
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

Other

'dn#.google':443
're####ctor.gvt1.com':443
'85.##2.116.140':443
'74.##5.131.113':443
'me##.#abricmc.net':443
'cd#.##launcher.com':443
'13.##.243.23':443
'51.##.83.165':443
'14#.#2.121.3':443
'18#.#99.109.133':443

UDP

DNS ASK dn#.google
DNS ASK re####ctor.gvt1.com
DNS ASK me##.#abricmc.net
DNS ASK cd#.##launcher.com
DNS ASK x.##2.us
DNS ASK microsoft.com
'dn#.google':443
'85.##2.116.140':443
'74.##5.131.113':443

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'SysListView32' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\gdlauncher'

Creates and executes the following

'%LOCALAPPDATA%\programs\gdlauncher\gdlauncher.exe'
'%LOCALAPPDATA%\programs\gdlauncher\gdlauncher.exe' --type=gpu-process --user-data-dir="%APPDATA%\gdlauncher_next" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAA...
'%LOCALAPPDATA%\programs\gdlauncher\gdlauncher.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\gdlauncher_next" --mojo-platform-channel-handle=1360 --field-t...
'%LOCALAPPDATA%\programs\gdlauncher\gdlauncher.exe' --type=renderer --user-data-dir="%APPDATA%\gdlauncher_next" --app-path="%LOCALAPPDATA%\Programs\gdlauncher\resources\app.asar" --enable-experimental-web-platform-features --no-sandbox --no-zygo...
'%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq GDLauncher.exe" | find "GDLauncher.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq GDLauncher.exe" | find "GDLauncher.exe"
'%WINDIR%\syswow64\tasklist.exe' /FI "USERNAME eq user" /FI "IMAGENAME eq GDLauncher.exe"
'%WINDIR%\syswow64\find.exe' "GDLauncher.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
'<SYSTEM32>\reg.exe' QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial