Trojan.Siggen32.4610

Technical Information

Malicious functions

Injects code into

the following user processes:

vidbee.exe

Modifies file system

Creates the following files

%TEMP%\nsre06.tmp\system.dll
%TEMP%\nsre06.tmp\stdutils.dll
%TEMP%\nsre06.tmp\spiderbanner.dll
%TEMP%\nsre06.tmp\nsexec.dll
%TEMP%\nsre06.tmp\app-64.7z
%TEMP%\nsre06.tmp\nsis7z.dll
%TEMP%\nsre06.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsre06.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsre06.tmp\7z-out\icudtl.dat
%TEMP%\nsre06.tmp\7z-out\license.electron.txt
%TEMP%\nsre06.tmp\7z-out\licenses.chromium.html
%TEMP%\nsre06.tmp\7z-out\locales\af.pak
%TEMP%\nsre06.tmp\7z-out\locales\am.pak
%TEMP%\nsre06.tmp\7z-out\locales\ar.pak
%TEMP%\nsre06.tmp\7z-out\locales\bg.pak
%TEMP%\nsre06.tmp\7z-out\locales\bn.pak
%TEMP%\nsre06.tmp\7z-out\locales\ca.pak
%TEMP%\nsre06.tmp\7z-out\locales\cs.pak
%TEMP%\nsre06.tmp\7z-out\locales\da.pak
%TEMP%\nsre06.tmp\7z-out\locales\de.pak
%TEMP%\nsre06.tmp\7z-out\locales\el.pak
%TEMP%\nsre06.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsre06.tmp\7z-out\locales\en-us.pak
%TEMP%\nsre06.tmp\7z-out\locales\es-419.pak
%TEMP%\nsre06.tmp\7z-out\locales\es.pak
%TEMP%\nsre06.tmp\7z-out\locales\et.pak
%TEMP%\nsre06.tmp\7z-out\locales\fa.pak
%TEMP%\nsre06.tmp\7z-out\locales\fi.pak
%TEMP%\nsre06.tmp\7z-out\locales\fil.pak
%TEMP%\nsre06.tmp\7z-out\locales\fr.pak
%TEMP%\nsre06.tmp\7z-out\locales\gu.pak
%TEMP%\nsre06.tmp\7z-out\locales\he.pak
%TEMP%\nsre06.tmp\7z-out\locales\hi.pak
%TEMP%\nsre06.tmp\7z-out\locales\hr.pak
%TEMP%\nsre06.tmp\7z-out\locales\hu.pak
%TEMP%\nsre06.tmp\7z-out\locales\id.pak
%TEMP%\nsre06.tmp\7z-out\locales\it.pak
%TEMP%\nsre06.tmp\7z-out\locales\ja.pak
%TEMP%\nsre06.tmp\7z-out\locales\kn.pak
%TEMP%\nsre06.tmp\7z-out\locales\ko.pak
%TEMP%\nsre06.tmp\7z-out\locales\lt.pak
%TEMP%\nsre06.tmp\7z-out\locales\lv.pak
%TEMP%\nsre06.tmp\7z-out\locales\ml.pak
%TEMP%\nsre06.tmp\7z-out\locales\mr.pak
%TEMP%\nsre06.tmp\7z-out\locales\ms.pak
%TEMP%\nsre06.tmp\7z-out\locales\nb.pak
%TEMP%\nsre06.tmp\7z-out\locales\nl.pak
%TEMP%\nsre06.tmp\7z-out\locales\pl.pak
%TEMP%\nsre06.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsre06.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsre06.tmp\7z-out\locales\ro.pak
%TEMP%\nsre06.tmp\7z-out\locales\ru.pak
%TEMP%\nsre06.tmp\7z-out\locales\sk.pak
%TEMP%\nsre06.tmp\7z-out\locales\sl.pak
%TEMP%\nsre06.tmp\7z-out\locales\sr.pak
%TEMP%\nsre06.tmp\7z-out\locales\sv.pak
%TEMP%\nsre06.tmp\7z-out\locales\sw.pak
%TEMP%\nsre06.tmp\7z-out\locales\ta.pak
%TEMP%\nsre06.tmp\7z-out\locales\te.pak
%TEMP%\nsre06.tmp\7z-out\locales\th.pak
%TEMP%\nsre06.tmp\7z-out\locales\tr.pak
%TEMP%\nsre06.tmp\7z-out\locales\uk.pak
%TEMP%\nsre06.tmp\7z-out\locales\ur.pak
%TEMP%\nsre06.tmp\7z-out\locales\vi.pak
%TEMP%\nsre06.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsre06.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsre06.tmp\7z-out\resources\app-update.yml
%TEMP%\nsre06.tmp\7z-out\resources\app.asar
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide-win32-x64-msvc\license
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide-win32-x64-msvc\package.json
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide-win32-x64-msvc\tailwindcss-oxide.win32-x64-msvc.node
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss-win32-x64-msvc\license
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss-win32-x64-msvc\lightningcss.win32-x64-msvc.node
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss-win32-x64-msvc\package.json
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\resources\icon.png
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\resources\readme.md
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\resources\tray-icon.png
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\resources\yt-dlp_macos
%TEMP%\nsre06.tmp\7z-out\resources.pak
%TEMP%\nsre06.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsre06.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsre06.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsre06.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsre06.tmp\7z-out\dxcompiler.dll
%TEMP%\nsre06.tmp\7z-out\dxil.dll
%TEMP%\nsre06.tmp\7z-out\ffmpeg.dll
%TEMP%\nsre06.tmp\7z-out\libegl.dll
%TEMP%\nsre06.tmp\7z-out\libglesv2.dll
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\resources\yt-dlp.exe
%TEMP%\nsre06.tmp\7z-out\resources\elevate.exe
%TEMP%\nsre06.tmp\7z-out\vidbee.exe
%TEMP%\nsre06.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsre06.tmp\7z-out\vulkan-1.dll
%LOCALAPPDATA%\programs\vidbee\chrome_100_percent.pak
%LOCALAPPDATA%\programs\vidbee\chrome_200_percent.pak
%LOCALAPPDATA%\programs\vidbee\d3dcompiler_47.dll
%LOCALAPPDATA%\programs\vidbee\dxcompiler.dll
%LOCALAPPDATA%\programs\vidbee\dxil.dll
%LOCALAPPDATA%\programs\vidbee\ffmpeg.dll
%LOCALAPPDATA%\programs\vidbee\icudtl.dat
%LOCALAPPDATA%\programs\vidbee\libegl.dll
%LOCALAPPDATA%\programs\vidbee\libglesv2.dll
%LOCALAPPDATA%\programs\vidbee\license.electron.txt
%LOCALAPPDATA%\programs\vidbee\licenses.chromium.html
%LOCALAPPDATA%\programs\vidbee\resources.pak
%LOCALAPPDATA%\programs\vidbee\snapshot_blob.bin
%LOCALAPPDATA%\programs\vidbee\v8_context_snapshot.bin
%LOCALAPPDATA%\programs\vidbee\vidbee.exe
%LOCALAPPDATA%\programs\vidbee\vk_swiftshader.dll
%LOCALAPPDATA%\programs\vidbee\vk_swiftshader_icd.json
%LOCALAPPDATA%\programs\vidbee\vulkan-1.dll
%LOCALAPPDATA%\programs\vidbee\locales\af.pak
%LOCALAPPDATA%\programs\vidbee\locales\am.pak
%LOCALAPPDATA%\programs\vidbee\locales\ar.pak
%LOCALAPPDATA%\programs\vidbee\locales\bg.pak
%LOCALAPPDATA%\programs\vidbee\locales\bn.pak
%LOCALAPPDATA%\programs\vidbee\locales\ca.pak
%LOCALAPPDATA%\programs\vidbee\locales\cs.pak
%LOCALAPPDATA%\programs\vidbee\locales\da.pak
%LOCALAPPDATA%\programs\vidbee\locales\de.pak
%LOCALAPPDATA%\programs\vidbee\locales\el.pak
%LOCALAPPDATA%\programs\vidbee\locales\en-gb.pak
%LOCALAPPDATA%\programs\vidbee\locales\en-us.pak
%LOCALAPPDATA%\programs\vidbee\locales\es-419.pak
%LOCALAPPDATA%\programs\vidbee\locales\es.pak
%LOCALAPPDATA%\programs\vidbee\locales\et.pak
%LOCALAPPDATA%\programs\vidbee\locales\fa.pak
%LOCALAPPDATA%\programs\vidbee\locales\fi.pak
%LOCALAPPDATA%\programs\vidbee\locales\fil.pak
%LOCALAPPDATA%\programs\vidbee\locales\fr.pak
%LOCALAPPDATA%\programs\vidbee\locales\gu.pak
%LOCALAPPDATA%\programs\vidbee\locales\he.pak
%LOCALAPPDATA%\programs\vidbee\locales\hi.pak
%LOCALAPPDATA%\programs\vidbee\locales\hr.pak
%LOCALAPPDATA%\programs\vidbee\locales\hu.pak
%LOCALAPPDATA%\programs\vidbee\locales\id.pak
%LOCALAPPDATA%\programs\vidbee\locales\it.pak
%LOCALAPPDATA%\programs\vidbee\locales\ja.pak
%LOCALAPPDATA%\programs\vidbee\locales\kn.pak
%LOCALAPPDATA%\programs\vidbee\locales\ko.pak
%LOCALAPPDATA%\programs\vidbee\locales\lt.pak
%LOCALAPPDATA%\programs\vidbee\locales\lv.pak
%LOCALAPPDATA%\programs\vidbee\locales\ml.pak
%LOCALAPPDATA%\programs\vidbee\locales\mr.pak
%LOCALAPPDATA%\programs\vidbee\locales\ms.pak
%LOCALAPPDATA%\programs\vidbee\locales\nb.pak
%LOCALAPPDATA%\programs\vidbee\locales\nl.pak
%LOCALAPPDATA%\programs\vidbee\locales\pl.pak
%LOCALAPPDATA%\programs\vidbee\locales\pt-br.pak
%LOCALAPPDATA%\programs\vidbee\locales\pt-pt.pak
%LOCALAPPDATA%\programs\vidbee\locales\ro.pak
%LOCALAPPDATA%\programs\vidbee\locales\ru.pak
%LOCALAPPDATA%\programs\vidbee\locales\sk.pak
%LOCALAPPDATA%\programs\vidbee\locales\sl.pak
%LOCALAPPDATA%\programs\vidbee\locales\sr.pak
%LOCALAPPDATA%\programs\vidbee\locales\sv.pak
%LOCALAPPDATA%\programs\vidbee\locales\sw.pak
%LOCALAPPDATA%\programs\vidbee\locales\ta.pak
%LOCALAPPDATA%\programs\vidbee\locales\te.pak
%LOCALAPPDATA%\programs\vidbee\locales\th.pak
%LOCALAPPDATA%\programs\vidbee\locales\tr.pak
%LOCALAPPDATA%\programs\vidbee\locales\uk.pak
%LOCALAPPDATA%\programs\vidbee\locales\ur.pak
%LOCALAPPDATA%\programs\vidbee\locales\vi.pak
%LOCALAPPDATA%\programs\vidbee\locales\zh-cn.pak
%LOCALAPPDATA%\programs\vidbee\locales\zh-tw.pak
%LOCALAPPDATA%\programs\vidbee\resources\app-update.yml
%LOCALAPPDATA%\programs\vidbee\resources\app.asar
%LOCALAPPDATA%\programs\vidbee\resources\elevate.exe
%LOCALAPPDATA%\programs\vidbee\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide-win32-x64-msvc\license
%LOCALAPPDATA%\programs\vidbee\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide-win32-x64-msvc\package.json
%LOCALAPPDATA%\programs\vidbee\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide-win32-x64-msvc\tailwindcss-oxide.win32-x64-msvc.node
%LOCALAPPDATA%\programs\vidbee\resources\app.asar.unpacked\node_modules\lightningcss-win32-x64-msvc\license
%LOCALAPPDATA%\programs\vidbee\resources\app.asar.unpacked\node_modules\lightningcss-win32-x64-msvc\lightningcss.win32-x64-msvc.node
%LOCALAPPDATA%\programs\vidbee\resources\app.asar.unpacked\node_modules\lightningcss-win32-x64-msvc\package.json
%LOCALAPPDATA%\programs\vidbee\resources\app.asar.unpacked\resources\icon.png
%LOCALAPPDATA%\programs\vidbee\resources\app.asar.unpacked\resources\readme.md
%LOCALAPPDATA%\programs\vidbee\resources\app.asar.unpacked\resources\tray-icon.png
%LOCALAPPDATA%\programs\vidbee\resources\app.asar.unpacked\resources\yt-dlp.exe
%LOCALAPPDATA%\programs\vidbee\resources\app.asar.unpacked\resources\yt-dlp_macos
%LOCALAPPDATA%\vidbee-updater\installer.exe
%LOCALAPPDATA%\programs\vidbee\uninstall vidbee.exe
%APPDATA%\microsoft\windows\start menu\programs\vidbee.lnk
%TEMP%\nsre06.tmp\winshell.dll
%HOMEPATH%\desktop\vidbee.lnk
%APPDATA%\vidbee\config.json.tmp-19318395255ddec1
%APPDATA%\vidbee\download-history.json.tmp-193183957551ebc4
nul
%APPDATA%\vidbee\logs\main.log
%APPDATA%\vidbee\code cache\wasm\index
%APPDATA%\vidbee\code cache\js\index
%APPDATA%\vidbee\local storage\leveldb\log
%APPDATA%\vidbee\local storage\leveldb\manifest-000001
%APPDATA%\vidbee\code cache\wasm\index-dir\temp-index
%APPDATA%\vidbee\code cache\js\index-dir\temp-index
%APPDATA%\vidbee\local storage\leveldb\000001.dbtmp
%APPDATA%\vidbee\gpucache\index
%APPDATA%\vidbee\gpucache\data_0
%APPDATA%\vidbee\gpucache\data_1
%APPDATA%\vidbee\gpucache\data_2
%APPDATA%\vidbee\gpucache\data_3
%APPDATA%\vidbee\dawnwebgpucache\index
%APPDATA%\vidbee\dawnwebgpucache\data_0
%APPDATA%\vidbee\dawnwebgpucache\data_1
%APPDATA%\vidbee\dawnwebgpucache\data_2
%APPDATA%\vidbee\dawnwebgpucache\data_3
%APPDATA%\vidbee\dawngraphitecache\index
%APPDATA%\vidbee\dawngraphitecache\data_0
%APPDATA%\vidbee\dawngraphitecache\data_1
%APPDATA%\vidbee\dawngraphitecache\data_2
%APPDATA%\vidbee\dawngraphitecache\data_3
%APPDATA%\vidbee\shared dictionary\cache\index
%APPDATA%\vidbee\shared dictionary\db-journal
%APPDATA%\microsoft\spelling\en-us\default.dic
%APPDATA%\vidbee\shared dictionary\db
%APPDATA%\microsoft\spelling\en-us\default.exc
%APPDATA%\microsoft\spelling\en-us\default.acl
%APPDATA%\vidbee\network\trust tokens-journal
%APPDATA%\vidbee\network\trust tokens
%APPDATA%\vidbee\shared dictionary\cache\index-dir\temp-index
%APPDATA%\vidbee\dips-journal
%APPDATA%\vidbee\dips
%APPDATA%\vidbee\dips-wal
%APPDATA%\vidbee\session storage\log
%APPDATA%\vidbee\session storage\manifest-000001
%APPDATA%\vidbee\session storage\000001.dbtmp
%APPDATA%\vidbee\session storage\000003.log
%TEMP%\3ada42ee-c4e4-406c-a83f-612561f2711a.tmp
%APPDATA%\vidbee\d3f7e2a7-a4e7-42c4-b362-aa4cdba4086f.tmp
%APPDATA%\vidbee\bb667683-0680-420b-ae5f-a5d3ef88d44d.tmp
%APPDATA%\vidbee\network\a4f67a47-6b88-4761-971f-62f61b0b6a07.tmp

Deletes following files that it created itself

%TEMP%\nsre06.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsre06.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsre06.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsre06.tmp\7z-out\dxcompiler.dll
%TEMP%\nsre06.tmp\7z-out\dxil.dll
%TEMP%\nsre06.tmp\7z-out\ffmpeg.dll
%TEMP%\nsre06.tmp\7z-out\icudtl.dat
%TEMP%\nsre06.tmp\7z-out\libegl.dll
%TEMP%\nsre06.tmp\7z-out\libglesv2.dll
%TEMP%\nsre06.tmp\7z-out\license.electron.txt
%TEMP%\nsre06.tmp\7z-out\licenses.chromium.html
%TEMP%\nsre06.tmp\7z-out\locales\af.pak
%TEMP%\nsre06.tmp\7z-out\locales\am.pak
%TEMP%\nsre06.tmp\7z-out\locales\ar.pak
%TEMP%\nsre06.tmp\7z-out\locales\bg.pak
%TEMP%\nsre06.tmp\7z-out\locales\bn.pak
%TEMP%\nsre06.tmp\7z-out\locales\ca.pak
%TEMP%\nsre06.tmp\7z-out\locales\cs.pak
%TEMP%\nsre06.tmp\7z-out\locales\da.pak
%TEMP%\nsre06.tmp\7z-out\locales\de.pak
%TEMP%\nsre06.tmp\7z-out\locales\el.pak
%TEMP%\nsre06.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsre06.tmp\7z-out\locales\en-us.pak
%TEMP%\nsre06.tmp\7z-out\locales\es-419.pak
%TEMP%\nsre06.tmp\7z-out\locales\es.pak
%TEMP%\nsre06.tmp\7z-out\locales\et.pak
%TEMP%\nsre06.tmp\7z-out\locales\fa.pak
%TEMP%\nsre06.tmp\7z-out\locales\fi.pak
%TEMP%\nsre06.tmp\7z-out\locales\fil.pak
%TEMP%\nsre06.tmp\7z-out\locales\fr.pak
%TEMP%\nsre06.tmp\7z-out\locales\gu.pak
%TEMP%\nsre06.tmp\7z-out\locales\he.pak
%TEMP%\nsre06.tmp\7z-out\locales\hi.pak
%TEMP%\nsre06.tmp\7z-out\locales\hr.pak
%TEMP%\nsre06.tmp\7z-out\locales\hu.pak
%TEMP%\nsre06.tmp\7z-out\locales\id.pak
%TEMP%\nsre06.tmp\7z-out\locales\it.pak
%TEMP%\nsre06.tmp\7z-out\locales\ja.pak
%TEMP%\nsre06.tmp\7z-out\locales\kn.pak
%TEMP%\nsre06.tmp\7z-out\locales\ko.pak
%TEMP%\nsre06.tmp\7z-out\locales\lt.pak
%TEMP%\nsre06.tmp\7z-out\locales\lv.pak
%TEMP%\nsre06.tmp\7z-out\locales\ml.pak
%TEMP%\nsre06.tmp\7z-out\locales\mr.pak
%TEMP%\nsre06.tmp\7z-out\locales\ms.pak
%TEMP%\nsre06.tmp\7z-out\locales\nb.pak
%TEMP%\nsre06.tmp\7z-out\locales\nl.pak
%TEMP%\nsre06.tmp\7z-out\locales\pl.pak
%TEMP%\nsre06.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsre06.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsre06.tmp\7z-out\locales\ro.pak
%TEMP%\nsre06.tmp\7z-out\locales\ru.pak
%TEMP%\nsre06.tmp\7z-out\locales\sk.pak
%TEMP%\nsre06.tmp\7z-out\locales\sl.pak
%TEMP%\nsre06.tmp\7z-out\locales\sr.pak
%TEMP%\nsre06.tmp\7z-out\locales\sv.pak
%TEMP%\nsre06.tmp\7z-out\locales\sw.pak
%TEMP%\nsre06.tmp\7z-out\locales\ta.pak
%TEMP%\nsre06.tmp\7z-out\locales\te.pak
%TEMP%\nsre06.tmp\7z-out\locales\th.pak
%TEMP%\nsre06.tmp\7z-out\locales\tr.pak
%TEMP%\nsre06.tmp\7z-out\locales\uk.pak
%TEMP%\nsre06.tmp\7z-out\locales\ur.pak
%TEMP%\nsre06.tmp\7z-out\locales\vi.pak
%TEMP%\nsre06.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsre06.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsre06.tmp\7z-out\resources\app-update.yml
%TEMP%\nsre06.tmp\7z-out\resources\app.asar
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide-win32-x64-msvc\license
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide-win32-x64-msvc\package.json
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\node_modules\@tailwindcss\oxide-win32-x64-msvc\tailwindcss-oxide.win32-x64-msvc.node
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss-win32-x64-msvc\license
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss-win32-x64-msvc\lightningcss.win32-x64-msvc.node
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\node_modules\lightningcss-win32-x64-msvc\package.json
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\resources\icon.png
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\resources\readme.md
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\resources\tray-icon.png
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\resources\yt-dlp.exe
%TEMP%\nsre06.tmp\7z-out\resources\app.asar.unpacked\resources\yt-dlp_macos
%TEMP%\nsre06.tmp\7z-out\resources\elevate.exe
%TEMP%\nsre06.tmp\7z-out\resources.pak
%TEMP%\nsre06.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsre06.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsre06.tmp\7z-out\vidbee.exe
%TEMP%\nsre06.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsre06.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsre06.tmp\7z-out\vulkan-1.dll
%TEMP%\nsre06.tmp\app-64.7z
%TEMP%\nsre06.tmp\nsexec.dll
%TEMP%\nsre06.tmp\nsis7z.dll
%TEMP%\nsre06.tmp\spiderbanner.dll
%TEMP%\nsre06.tmp\stdutils.dll
%TEMP%\nsre06.tmp\system.dll
%TEMP%\nsre06.tmp\winshell.dll
%APPDATA%\vidbee\dips-journal

Moves the following files

from %APPDATA%\vidbee\config.json.tmp-19318395255ddec1 to %APPDATA%\vidbee\config.json
from %APPDATA%\vidbee\download-history.json.tmp-193183957551ebc4 to %APPDATA%\vidbee\download-history.json
from %APPDATA%\vidbee\local storage\leveldb\000001.dbtmp to %APPDATA%\vidbee\local storage\leveldb\current
from %APPDATA%\vidbee\code cache\wasm\index-dir\temp-index to %APPDATA%\vidbee\code cache\wasm\index-dir\the-real-index
from %APPDATA%\vidbee\code cache\js\index-dir\temp-index to %APPDATA%\vidbee\code cache\js\index-dir\the-real-index
from %APPDATA%\vidbee\shared dictionary\cache\index-dir\temp-index to %APPDATA%\vidbee\shared dictionary\cache\index-dir\the-real-index
from %APPDATA%\vidbee\session storage\000001.dbtmp to %APPDATA%\vidbee\session storage\current
from %APPDATA%\vidbee\d3f7e2a7-a4e7-42c4-b362-aa4cdba4086f.tmp to %APPDATA%\vidbee\local state
from %APPDATA%\vidbee\bb667683-0680-420b-ae5f-a5d3ef88d44d.tmp to %APPDATA%\vidbee\preferences
from %APPDATA%\vidbee\network\a4f67a47-6b88-4761-971f-62f61b0b6a07.tmp to %APPDATA%\vidbee\network\network persistent state

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'SysListView32' WindowName: ''

Creates and executes the following

'%LOCALAPPDATA%\programs\vidbee\vidbee.exe'
'%LOCALAPPDATA%\programs\vidbee\vidbee.exe' --type=gpu-process --user-data-dir="%APPDATA%\vidbee" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== ...
'%LOCALAPPDATA%\programs\vidbee\vidbee.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\vidbee" --field-trial-handle=1764,i,4251589940062116136,800213...
'%LOCALAPPDATA%\programs\vidbee\vidbee.exe' --type=renderer --user-data-dir="%APPDATA%\vidbee" --app-user-model-id=com.vidbee --app-path="%LOCALAPPDATA%\Programs\vidbee\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu...
'%LOCALAPPDATA%\programs\vidbee\vidbee.exe' --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="%...

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq vidbee.exe" /FO csv | "<SYSTEM32>\find.exe" "vidbee.exe"
'%WINDIR%\syswow64\tasklist.exe' /FI "USERNAME eq user" /FI "IMAGENAME eq vidbee.exe" /FO csv
'%WINDIR%\syswow64\find.exe' "vidbee.exe"
'%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq vidbee.exe" /FO csv | "<SYSTEM32>\find.exe" "vidbee.exe"' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial