Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\updater.exe
Malicious functions
Injects code into
the following user processes:
- chrome.exe
- msedge.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\pkg-3qpief\2de3ef9fc3bad6955f503dc641da2db24626760ce1004fe6929cc5e64737ad35
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\package.json
- %TEMP%\pkg-3qpief\dc6a2239b69829b7d20aeefc9f5540aa69564d0cac476e442afeb030ae64ca07
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\adm-zip.js
- %TEMP%\pkg-3qpief\6bb5b2d4c07d793ca928daa63a8899c6914fafb5ac3aa04ec10cae07f3d57dca
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\license
- %TEMP%\pkg-3qpief\35295fdfb2d8e5316db897f2e8ed61ed5eee8a68044774aba56b118a9a959daf
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\zipentry.js
- %TEMP%\pkg-3qpief\f95d3d6687e5ed959559943380e3bcf61f3e8849286d740afa45dedb28ffa16d
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\zipfile.js
- %TEMP%\pkg-3qpief\d47b3ea0258af98a7a35cffdbd8bbe290a14f43ccbafda06e87bcf85b29136b7
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\build\addon.node
- %TEMP%\pkg-3qpief\51b343ba48150d1a4b8d7ea3cc5492028f7cf8c8cf60ff0e4d50e322c8c2b5b0
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\build\check.node
- %TEMP%\pkg-3qpief\74da81544ada9a19754da25b2bd7065a57210be47b1df7bb753a2448ff9abca2
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\build\deadlock.node
- %TEMP%\pkg-3qpief\41cb42b9cb5395276ab2cd8711f38318530cfb1f8404adec87f7d98feaa48f69
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\build\screenshot.node
- %TEMP%\pkg-3qpief\b6fc4b17ceab96c07d6c14464b95204b1a130d32d845b348a18eefd5633763b1
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\headers\entryheader.js
- %TEMP%\pkg-3qpief\536e4b5bf009a3d9f6eccfbbc4157cb6de663d889e0826ea5f6e5fa17aaeb8bf
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\headers\index.js
- %TEMP%\pkg-3qpief\28dd1a0db451bc94d8f3234e57d8192ba17154118f841c398e0de35acea286ee
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\headers\mainheader.js
- %TEMP%\pkg-3qpief\6dc41b2460594cfa5136b797653c166b2f7403820a40f2fca17cca35a5de1b5f
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\methods\deflater.js
- %TEMP%\pkg-3qpief\d67714f1a04be942f90be77069af3ff4214aa8ee84b26edeff3a87eb0d8e2dc0
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\methods\index.js
- %TEMP%\pkg-3qpief\c5e4531a11385050d77a5069487b0be8e85c8e44fe6b214d68def321e74528ce
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\methods\inflater.js
- %TEMP%\pkg-3qpief\23365c7eda0ea098385dc7ec649517fc110ce2764d2e707c37bf6b528604e25a
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\methods\zipcrypto.js
- %TEMP%\pkg-3qpief\208e943a2e5faad056047f3c7991cce3cde637d8e272a564f2546210ebdf2069
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\util\constants.js
- %TEMP%\pkg-3qpief\73a0ebb00c4dce2124f07acf0b34374cb03a4384cccd1cd6f58aee27c35953d9
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\util\decoder.js
- %TEMP%\pkg-3qpief\d2d243647737c795c2db8aeba2e1f3841d5f76370b521d436cf465322dd4aab7
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\util\errors.js
- %TEMP%\pkg-3qpief\31c93eb386a2bfbf19ad92a6bf20d510a8f1e7e90cc71d33dd888f89da12362d
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\util\fattr.js
- %TEMP%\pkg-3qpief\dc5b230ed853947ea55c0bf69f0e525fbeffefff09aa3da296d541bb8898314e
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\util\index.js
- %TEMP%\pkg-3qpief\a8983582ad5dfa163303d22acd0b0ab3312059a121fb1b377ad41f4a58ed955b
- %HOMEPATH%\.cache\pkg\f7f4b11fa80cc62806438b48169b2d3ec85e8847d6bfab98d39e5339ecb6e080\adm-zip\util\utils.js
- %TEMP%\pkg-3qpief\5ad24cd4d19ef03079717bd6309fe0604c2a4829cd92788ebf6da95c41d3d28f
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\package.json
- %TEMP%\pkg-3qpief\8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.js
- %TEMP%\pkg-3qpief\762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3-binding.js
- %TEMP%\pkg-3qpief\d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\trace.js
- %TEMP%\pkg-3qpief\b9a7b76665d92af2d90cc6a15ffdc1a79635559cbc1c40bd1f83c4c4449cd442
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\release\node_sqlite3.node
- %TEMP%\pkg-3qpief\d3a788312c56e9ac2e8d70d3074d94dd4c82abcdef0a1361497b4711cf073a71
- %HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\package.json
- %TEMP%\pkg-3qpief\cd7d764453f5ad1e02558f1ca98c18f0d28786633c4ea8254858011a4d0eeed6
- %HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\index.js
- %TEMP%\pkg-3qpief\4ffd787b2864836655710ed9dcbb26b53f799e4ce15dfb820e2f8bc8ad55d0b0
- %HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\bin\arm64\node-dpapi.node
- %TEMP%\pkg-3qpief\36bff5188c2d75ece4cca1162b3d171c81f1f4703613b358cafc2e9e86610cc6
- %HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\bin\ia32\node-dpapi.node
- %TEMP%\pkg-3qpief\a0c8843d23ff42ed119a872e4ecbe88fbe80b33095d33f28802c753789cc2669
- %HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\bin\x64\node-dpapi.node
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\package.json
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\adm-zip.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\license
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\zipentry.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\zipfile.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\build\addon.node
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\build\check.node
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\build\deadlock.node
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\build\screenshot.node
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\headers\entryheader.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\headers\index.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\headers\mainheader.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\methods\deflater.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\methods\index.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\methods\inflater.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\methods\zipcrypto.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\util\constants.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\util\decoder.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\util\errors.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\util\fattr.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\util\index.js
- %HOMEPATH%\.cache\pkg\7e3a6d6ddb1bc6633d86f733de32f12c62d42d1025c2bb92ad2f80c4133a05df\adm-zip\util\utils.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\package.json
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\adm-zip.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\license
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\zipentry.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\zipfile.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\build\addon.node
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\build\check.node
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\build\deadlock.node
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\build\screenshot.node
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\headers\entryheader.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\headers\index.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\headers\mainheader.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\methods\deflater.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\methods\index.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\methods\inflater.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\methods\zipcrypto.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\util\constants.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\util\decoder.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\util\errors.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\util\fattr.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\util\index.js
- %HOMEPATH%\.cache\pkg\837809b00ff22d773b6db727583f8bc3869fe5e991c994c2e6ffe88180c99603\adm-zip\util\utils.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\package.json
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\adm-zip.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\license
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\zipentry.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\zipfile.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\build\addon.node
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\build\check.node
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\build\deadlock.node
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\build\screenshot.node
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\headers\entryheader.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\headers\index.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\headers\mainheader.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\methods\deflater.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\methods\index.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\methods\inflater.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\methods\zipcrypto.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\util\constants.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\util\decoder.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\util\errors.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\util\fattr.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\util\index.js
- %HOMEPATH%\.cache\pkg\d94cc5b3af0cacb9aa68425545cf8920150ffd20c0029b49646c8c704185d855\adm-zip\util\utils.js
- nul
- %TEMP%\th815.tmp
- %TEMP%\th10e0.tmp
- %TEMP%\th15d3.tmp
- %TEMP%\th1cd8.tmp
- %TEMP%\th244c.tmp
- %TEMP%\th2a19.tmp
- %TEMP%\th3054.tmp
- %TEMP%\th367f.tmp
- %TEMP%\th3b91.tmp
- %TEMP%\th4006.tmp
Deletes following files that it created itself
- %TEMP%\pkg-3qpief\208e943a2e5faad056047f3c7991cce3cde637d8e272a564f2546210ebdf2069
- %TEMP%\pkg-3qpief\23365c7eda0ea098385dc7ec649517fc110ce2764d2e707c37bf6b528604e25a
- %TEMP%\pkg-3qpief\28dd1a0db451bc94d8f3234e57d8192ba17154118f841c398e0de35acea286ee
- %TEMP%\pkg-3qpief\2de3ef9fc3bad6955f503dc641da2db24626760ce1004fe6929cc5e64737ad35
- %TEMP%\pkg-3qpief\31c93eb386a2bfbf19ad92a6bf20d510a8f1e7e90cc71d33dd888f89da12362d
- %TEMP%\pkg-3qpief\35295fdfb2d8e5316db897f2e8ed61ed5eee8a68044774aba56b118a9a959daf
- %TEMP%\pkg-3qpief\36bff5188c2d75ece4cca1162b3d171c81f1f4703613b358cafc2e9e86610cc6
- %TEMP%\pkg-3qpief\41cb42b9cb5395276ab2cd8711f38318530cfb1f8404adec87f7d98feaa48f69
- %TEMP%\pkg-3qpief\4ffd787b2864836655710ed9dcbb26b53f799e4ce15dfb820e2f8bc8ad55d0b0
- %TEMP%\pkg-3qpief\51b343ba48150d1a4b8d7ea3cc5492028f7cf8c8cf60ff0e4d50e322c8c2b5b0
- %TEMP%\pkg-3qpief\536e4b5bf009a3d9f6eccfbbc4157cb6de663d889e0826ea5f6e5fa17aaeb8bf
- %TEMP%\pkg-3qpief\5ad24cd4d19ef03079717bd6309fe0604c2a4829cd92788ebf6da95c41d3d28f
- %TEMP%\pkg-3qpief\6bb5b2d4c07d793ca928daa63a8899c6914fafb5ac3aa04ec10cae07f3d57dca
- %TEMP%\pkg-3qpief\6dc41b2460594cfa5136b797653c166b2f7403820a40f2fca17cca35a5de1b5f
- %TEMP%\pkg-3qpief\73a0ebb00c4dce2124f07acf0b34374cb03a4384cccd1cd6f58aee27c35953d9
- %TEMP%\pkg-3qpief\74da81544ada9a19754da25b2bd7065a57210be47b1df7bb753a2448ff9abca2
- %TEMP%\pkg-3qpief\762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- %TEMP%\pkg-3qpief\8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- %TEMP%\pkg-3qpief\a0c8843d23ff42ed119a872e4ecbe88fbe80b33095d33f28802c753789cc2669
- %TEMP%\pkg-3qpief\a8983582ad5dfa163303d22acd0b0ab3312059a121fb1b377ad41f4a58ed955b
- %TEMP%\pkg-3qpief\b6fc4b17ceab96c07d6c14464b95204b1a130d32d845b348a18eefd5633763b1
- %TEMP%\pkg-3qpief\b9a7b76665d92af2d90cc6a15ffdc1a79635559cbc1c40bd1f83c4c4449cd442
- %TEMP%\pkg-3qpief\c5e4531a11385050d77a5069487b0be8e85c8e44fe6b214d68def321e74528ce
- %TEMP%\pkg-3qpief\cd7d764453f5ad1e02558f1ca98c18f0d28786633c4ea8254858011a4d0eeed6
- %TEMP%\pkg-3qpief\d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- %TEMP%\pkg-3qpief\d2d243647737c795c2db8aeba2e1f3841d5f76370b521d436cf465322dd4aab7
- %TEMP%\pkg-3qpief\d3a788312c56e9ac2e8d70d3074d94dd4c82abcdef0a1361497b4711cf073a71
- %TEMP%\pkg-3qpief\d47b3ea0258af98a7a35cffdbd8bbe290a14f43ccbafda06e87bcf85b29136b7
- %TEMP%\pkg-3qpief\d67714f1a04be942f90be77069af3ff4214aa8ee84b26edeff3a87eb0d8e2dc0
- %TEMP%\pkg-3qpief\dc5b230ed853947ea55c0bf69f0e525fbeffefff09aa3da296d541bb8898314e
- %TEMP%\pkg-3qpief\dc6a2239b69829b7d20aeefc9f5540aa69564d0cac476e442afeb030ae64ca07
- %TEMP%\pkg-3qpief\f95d3d6687e5ed959559943380e3bcf61f3e8849286d740afa45dedb28ffa16d
Network activity
UDP
- DNS ASK my##.##i.zaloapp.com
- DNS ASK ip##pi.com
- DNS ASK ap#.##legram.org
- DNS ASK fi#####.###tings.services.mozilla.com
Miscellaneous
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe'
