Trojan.Siggen32.27229

Technical Information

Modifies file system

Creates the following files

%TEMP%\_mei25162\crypto\cipher\_arc4.pyd
%TEMP%\_mei25162\crypto\cipher\_salsa20.pyd
%TEMP%\_mei25162\crypto\cipher\_chacha20.pyd
%TEMP%\_mei25162\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_des.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei25162\crypto\hash\_blake2b.pyd
%TEMP%\_mei25162\crypto\hash\_blake2s.pyd
%TEMP%\_mei25162\crypto\hash\_md2.pyd
%TEMP%\_mei25162\crypto\hash\_md4.pyd
%TEMP%\_mei25162\crypto\hash\_md5.pyd
%TEMP%\_mei25162\crypto\hash\_ripemd160.pyd
%TEMP%\_mei25162\crypto\hash\_sha1.pyd
%TEMP%\_mei25162\crypto\hash\_sha224.pyd
%TEMP%\_mei25162\crypto\hash\_sha256.pyd
%TEMP%\_mei25162\crypto\hash\_sha384.pyd
%TEMP%\_mei25162\crypto\hash\_sha512.pyd
%TEMP%\_mei25162\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei25162\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei25162\crypto\hash\_keccak.pyd
%TEMP%\_mei25162\crypto\hash\_poly1305.pyd
%TEMP%\_mei25162\crypto\math\_modexp.pyd
%TEMP%\_mei25162\crypto\protocol\_scrypt.pyd
%TEMP%\_mei25162\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei25162\crypto\publickey\_ed25519.pyd
%TEMP%\_mei25162\crypto\publickey\_ed448.pyd
%TEMP%\_mei25162\crypto\publickey\_x25519.pyd
%TEMP%\_mei25162\crypto\util\_cpuid_c.pyd
%TEMP%\_mei25162\crypto\util\_strxor.pyd
%TEMP%\_mei25162\vcruntime140.dll
%TEMP%\_mei25162\_asyncio.pyd
%TEMP%\_mei25162\_bz2.pyd
%TEMP%\_mei25162\_cffi_backend.cp310-win_amd64.pyd
%TEMP%\_mei25162\_ctypes.pyd
%TEMP%\_mei25162\_decimal.pyd
%TEMP%\_mei25162\_hashlib.pyd
%TEMP%\_mei25162\_lzma.pyd
%TEMP%\_mei25162\_multiprocessing.pyd
%TEMP%\_mei25162\_overlapped.pyd
%TEMP%\_mei25162\_queue.pyd
%TEMP%\_mei25162\_socket.pyd
%TEMP%\_mei25162\_sqlite3.pyd
%TEMP%\_mei25162\_ssl.pyd
%TEMP%\_mei25162\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei25162\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei25162\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei25162\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei25162\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei25162\base_library.zip
%TEMP%\_mei25162\certifi\cacert.pem
%TEMP%\_mei25162\charset_normalizer\md.cp310-win_amd64.pyd
%TEMP%\_mei25162\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\installer
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\metadata
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\record
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\wheel
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\licenses\license
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\licenses\license.apache
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\licenses\license.bsd
%TEMP%\_mei25162\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei25162\importlib_metadata-8.7.1.dist-info\installer
%TEMP%\_mei25162\importlib_metadata-8.7.1.dist-info\metadata
%TEMP%\_mei25162\importlib_metadata-8.7.1.dist-info\record
%TEMP%\_mei25162\importlib_metadata-8.7.1.dist-info\wheel
%TEMP%\_mei25162\importlib_metadata-8.7.1.dist-info\licenses\license
%TEMP%\_mei25162\importlib_metadata-8.7.1.dist-info\top_level.txt
%TEMP%\_mei25162\libcrypto-1_1.dll
%TEMP%\_mei25162\libffi-7.dll
%TEMP%\_mei25162\libssl-1_1.dll
%TEMP%\_mei25162\pyexpat.pyd
%TEMP%\_mei25162\python3.dll
%TEMP%\_mei25162\python310.dll
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\installer
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\metadata
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\record
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\wheel
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\licenses\authors
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\licenses\license
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\top_level.txt
%TEMP%\_mei25162\select.pyd
%TEMP%\_mei25162\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei25162\sqlite3.dll
%TEMP%\_mei25162\ucrtbase.dll
%TEMP%\_mei25162\unicodedata.pyd
%TEMP%\_mei25162\windows\__init__.py
%TEMP%\_mei25162\windows\alpc.py
%TEMP%\_mei25162\windows\com.py
%TEMP%\_mei25162\windows\crypto\__init__.py
%TEMP%\_mei25162\windows\crypto\binary_string_conversion.py
%TEMP%\_mei25162\windows\crypto\catalog.py
%TEMP%\_mei25162\windows\crypto\certificate.py
%TEMP%\_mei25162\windows\crypto\cryptmsg.py
%TEMP%\_mei25162\windows\crypto\dpapi.py
%TEMP%\_mei25162\windows\crypto\encrypt_decrypt.py
%TEMP%\_mei25162\windows\crypto\generation.py
%TEMP%\_mei25162\windows\crypto\sign_verify.py
%TEMP%\_mei25162\windows\dbgprint.py
%TEMP%\_mei25162\windows\debug\__init__.py
%TEMP%\_mei25162\windows\debug\breakpoints.py
%TEMP%\_mei25162\windows\debug\debugger.py
%TEMP%\_mei25162\windows\debug\localdbg.py
%TEMP%\_mei25162\windows\debug\symboldbg.py
%TEMP%\_mei25162\windows\debug\symbols.py
%TEMP%\_mei25162\windows\generated_def\__init__.py
%TEMP%\_mei25162\windows\generated_def\auto_doc_tst.py
%TEMP%\_mei25162\windows\generated_def\flag.py
%TEMP%\_mei25162\windows\generated_def\interfaces.py
%TEMP%\_mei25162\windows\generated_def\meta.py
%TEMP%\_mei25162\windows\generated_def\ntstatus.py
%TEMP%\_mei25162\windows\generated_def\windef.py
%TEMP%\_mei25162\windows\generated_def\winerror.py
%TEMP%\_mei25162\windows\generated_def\winfuncs.py
%TEMP%\_mei25162\windows\generated_def\winstructs.py
%TEMP%\_mei25162\windows\hooks.py
%TEMP%\_mei25162\windows\injection.py
%TEMP%\_mei25162\windows\native_exec\__init__.py
%TEMP%\_mei25162\windows\native_exec\cpuid.py
%TEMP%\_mei25162\windows\native_exec\native_function.py
%TEMP%\_mei25162\windows\native_exec\nativeutils.py
%TEMP%\_mei25162\windows\native_exec\simple_arm64.py
%TEMP%\_mei25162\windows\native_exec\simple_x64.py
%TEMP%\_mei25162\windows\native_exec\simple_x86.py
%TEMP%\_mei25162\windows\pe_parse.py
%TEMP%\_mei25162\windows\pipe.py
%TEMP%\_mei25162\windows\pycompat.py
%TEMP%\_mei25162\windows\remotectypes.py
%TEMP%\_mei25162\windows\rpc\__init__.py
%TEMP%\_mei25162\windows\rpc\client.py
%TEMP%\_mei25162\windows\rpc\epmapper.py
%TEMP%\_mei25162\windows\rpc\ndr.py
%TEMP%\_mei25162\windows\rpc\stubborn.py
%TEMP%\_mei25162\windows\security.py
%TEMP%\_mei25162\windows\syswow64.py
%TEMP%\_mei25162\windows\test.py
%TEMP%\_mei25162\windows\utils\__init__.py
%TEMP%\_mei25162\windows\utils\improved_buffer.py
%TEMP%\_mei25162\windows\utils\pythonutils.py
%TEMP%\_mei25162\windows\utils\winutils.py
%TEMP%\_mei25162\windows\winobject\apisetmap.py
%TEMP%\_mei25162\windows\winobject\bits.py
%TEMP%\_mei25162\windows\winobject\device_manager.py
%TEMP%\_mei25162\windows\winobject\event_log.py
%TEMP%\_mei25162\windows\winobject\event_trace.py
%TEMP%\_mei25162\windows\winobject\exception.py
%TEMP%\_mei25162\windows\winobject\file.py
%TEMP%\_mei25162\windows\winobject\handle.py
%TEMP%\_mei25162\windows\winobject\hyperv.py
%TEMP%\_mei25162\windows\winobject\network.py
%TEMP%\_mei25162\windows\winobject\object_manager.py
%TEMP%\_mei25162\windows\winobject\process.py
%TEMP%\_mei25162\windows\winobject\registry.py
%TEMP%\_mei25162\windows\winobject\service.py
%TEMP%\_mei25162\windows\winobject\system.py
%TEMP%\_mei25162\windows\winobject\system_module.py
%TEMP%\_mei25162\windows\winobject\task_scheduler.py
%TEMP%\_mei25162\windows\winobject\token.py
%TEMP%\_mei25162\windows\winobject\volume.py
%TEMP%\_mei25162\windows\winobject\wmi.py
%TEMP%\_mei25162\windows\winproxy\__init__.py
%TEMP%\_mei25162\windows\winproxy\apiproxy.py
%TEMP%\_mei25162\windows\winproxy\apis\__init__.py
%TEMP%\_mei25162\windows\winproxy\apis\advapi32.py
%TEMP%\_mei25162\windows\winproxy\apis\cfgmgr32.py
%TEMP%\_mei25162\windows\winproxy\apis\crypt32.py
%TEMP%\_mei25162\windows\winproxy\apis\cryptui.py
%TEMP%\_mei25162\windows\winproxy\apis\dbghelp.py
%TEMP%\_mei25162\windows\winproxy\apis\dnsapi.py
%TEMP%\_mei25162\windows\winproxy\apis\iphlpapi.py
%TEMP%\_mei25162\windows\winproxy\apis\kernel32.py
%TEMP%\_mei25162\windows\winproxy\apis\ktmw32.py
%TEMP%\_mei25162\windows\winproxy\apis\ncrypt.py
%TEMP%\_mei25162\windows\winproxy\apis\netapi32.py
%TEMP%\_mei25162\windows\winproxy\apis\ntdll.py
%TEMP%\_mei25162\windows\winproxy\apis\ole32.py
%TEMP%\_mei25162\windows\winproxy\apis\oleacc.py
%TEMP%\_mei25162\windows\winproxy\apis\oleaut32.py
%TEMP%\_mei25162\windows\winproxy\apis\psapi.py
%TEMP%\_mei25162\windows\winproxy\apis\setupapi.py
%TEMP%\_mei25162\windows\winproxy\apis\shell32.py
%TEMP%\_mei25162\windows\winproxy\apis\shlwapi.py
%TEMP%\_mei25162\windows\winproxy\apis\tdh.py
%TEMP%\_mei25162\windows\winproxy\apis\user32.py
%TEMP%\_mei25162\windows\winproxy\apis\version.py
%TEMP%\_mei25162\windows\winproxy\apis\virtdisk.py
%TEMP%\_mei25162\windows\winproxy\apis\wevtapi.py
%TEMP%\_mei25162\windows\winproxy\apis\winhttp.py
%TEMP%\_mei25162\windows\winproxy\apis\wininet.py
%TEMP%\_mei25162\windows\winproxy\apis\wintrust.py
%TEMP%\_mei25162\windows\winproxy\apis\ws2_32.py
%TEMP%\_mei25162\windows\winproxy\error.py
%TEMP%\_mei25162\windows\wintrust.py
%TEMP%\edge_login_copy.db
%TEMP%\edge_webdata_copy.db
%TEMP%\browser_results_1772410713.txt
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69a4d767-117c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69a4d76a-1754.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal

Deletes following files that it created itself

%TEMP%\edge_login_copy.db
%TEMP%\edge_webdata_copy.db
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%TEMP%\_mei25162\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei25162\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei25162\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei25162\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei25162\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei25162\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei25162\base_library.zip
%TEMP%\_mei25162\certifi\cacert.pem
%TEMP%\_mei25162\charset_normalizer\md.cp310-win_amd64.pyd
%TEMP%\_mei25162\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
%TEMP%\_mei25162\crypto\cipher\_arc4.pyd
%TEMP%\_mei25162\crypto\cipher\_chacha20.pyd
%TEMP%\_mei25162\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_des.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei25162\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei25162\crypto\cipher\_salsa20.pyd
%TEMP%\_mei25162\crypto\hash\_blake2b.pyd
%TEMP%\_mei25162\crypto\hash\_blake2s.pyd
%TEMP%\_mei25162\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei25162\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei25162\crypto\hash\_keccak.pyd
%TEMP%\_mei25162\crypto\hash\_md2.pyd
%TEMP%\_mei25162\crypto\hash\_md4.pyd
%TEMP%\_mei25162\crypto\hash\_md5.pyd
%TEMP%\_mei25162\crypto\hash\_poly1305.pyd
%TEMP%\_mei25162\crypto\hash\_ripemd160.pyd
%TEMP%\_mei25162\crypto\hash\_sha1.pyd
%TEMP%\_mei25162\crypto\hash\_sha224.pyd
%TEMP%\_mei25162\crypto\hash\_sha256.pyd
%TEMP%\_mei25162\crypto\hash\_sha384.pyd
%TEMP%\_mei25162\crypto\hash\_sha512.pyd
%TEMP%\_mei25162\crypto\math\_modexp.pyd
%TEMP%\_mei25162\crypto\protocol\_scrypt.pyd
%TEMP%\_mei25162\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei25162\crypto\publickey\_ed25519.pyd
%TEMP%\_mei25162\crypto\publickey\_ed448.pyd
%TEMP%\_mei25162\crypto\publickey\_x25519.pyd
%TEMP%\_mei25162\crypto\util\_cpuid_c.pyd
%TEMP%\_mei25162\crypto\util\_strxor.pyd
%TEMP%\_mei25162\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\installer
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\licenses\license
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\licenses\license.apache
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\licenses\license.bsd
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\metadata
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\record
%TEMP%\_mei25162\cryptography-44.0.3.dist-info\wheel
%TEMP%\_mei25162\importlib_metadata-8.7.1.dist-info\installer
%TEMP%\_mei25162\importlib_metadata-8.7.1.dist-info\licenses\license
%TEMP%\_mei25162\importlib_metadata-8.7.1.dist-info\metadata
%TEMP%\_mei25162\importlib_metadata-8.7.1.dist-info\record
%TEMP%\_mei25162\importlib_metadata-8.7.1.dist-info\top_level.txt
%TEMP%\_mei25162\importlib_metadata-8.7.1.dist-info\wheel
%TEMP%\_mei25162\libcrypto-1_1.dll
%TEMP%\_mei25162\libffi-7.dll
%TEMP%\_mei25162\libssl-1_1.dll
%TEMP%\_mei25162\pyexpat.pyd
%TEMP%\_mei25162\python3.dll
%TEMP%\_mei25162\python310.dll
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\installer
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\licenses\authors
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\licenses\license
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\metadata
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\record
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\top_level.txt
%TEMP%\_mei25162\pythonforwindows-1.0.4.dist-info\wheel
%TEMP%\_mei25162\select.pyd
%TEMP%\_mei25162\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei25162\sqlite3.dll
%TEMP%\_mei25162\ucrtbase.dll
%TEMP%\_mei25162\unicodedata.pyd
%TEMP%\_mei25162\vcruntime140.dll
%TEMP%\_mei25162\windows\alpc.py
%TEMP%\_mei25162\windows\com.py
%TEMP%\_mei25162\windows\crypto\binary_string_conversion.py
%TEMP%\_mei25162\windows\crypto\catalog.py
%TEMP%\_mei25162\windows\crypto\certificate.py
%TEMP%\_mei25162\windows\crypto\cryptmsg.py
%TEMP%\_mei25162\windows\crypto\dpapi.py
%TEMP%\_mei25162\windows\crypto\encrypt_decrypt.py
%TEMP%\_mei25162\windows\crypto\generation.py
%TEMP%\_mei25162\windows\crypto\sign_verify.py
%TEMP%\_mei25162\windows\crypto\__init__.py
%TEMP%\_mei25162\windows\dbgprint.py
%TEMP%\_mei25162\windows\debug\breakpoints.py
%TEMP%\_mei25162\windows\debug\debugger.py
%TEMP%\_mei25162\windows\debug\localdbg.py
%TEMP%\_mei25162\windows\debug\symboldbg.py
%TEMP%\_mei25162\windows\debug\symbols.py
%TEMP%\_mei25162\windows\debug\__init__.py
%TEMP%\_mei25162\windows\generated_def\auto_doc_tst.py
%TEMP%\_mei25162\windows\generated_def\flag.py
%TEMP%\_mei25162\windows\generated_def\interfaces.py
%TEMP%\_mei25162\windows\generated_def\meta.py
%TEMP%\_mei25162\windows\generated_def\ntstatus.py
%TEMP%\_mei25162\windows\generated_def\windef.py
%TEMP%\_mei25162\windows\generated_def\winerror.py
%TEMP%\_mei25162\windows\generated_def\winfuncs.py
%TEMP%\_mei25162\windows\generated_def\winstructs.py
%TEMP%\_mei25162\windows\generated_def\__init__.py
%TEMP%\_mei25162\windows\hooks.py
%TEMP%\_mei25162\windows\injection.py
%TEMP%\_mei25162\windows\native_exec\cpuid.py
%TEMP%\_mei25162\windows\native_exec\nativeutils.py
%TEMP%\_mei25162\windows\native_exec\native_function.py
%TEMP%\_mei25162\windows\native_exec\simple_arm64.py
%TEMP%\_mei25162\windows\native_exec\simple_x64.py
%TEMP%\_mei25162\windows\native_exec\simple_x86.py
%TEMP%\_mei25162\windows\native_exec\__init__.py
%TEMP%\_mei25162\windows\pe_parse.py
%TEMP%\_mei25162\windows\pipe.py
%TEMP%\_mei25162\windows\pycompat.py
%TEMP%\_mei25162\windows\remotectypes.py
%TEMP%\_mei25162\windows\rpc\client.py
%TEMP%\_mei25162\windows\rpc\epmapper.py
%TEMP%\_mei25162\windows\rpc\ndr.py
%TEMP%\_mei25162\windows\rpc\stubborn.py
%TEMP%\_mei25162\windows\rpc\__init__.py
%TEMP%\_mei25162\windows\security.py
%TEMP%\_mei25162\windows\syswow64.py
%TEMP%\_mei25162\windows\test.py
%TEMP%\_mei25162\windows\utils\improved_buffer.py
%TEMP%\_mei25162\windows\utils\pythonutils.py
%TEMP%\_mei25162\windows\utils\winutils.py
%TEMP%\_mei25162\windows\utils\__init__.py
%TEMP%\_mei25162\windows\winobject\apisetmap.py
%TEMP%\_mei25162\windows\winobject\bits.py
%TEMP%\_mei25162\windows\winobject\device_manager.py
%TEMP%\_mei25162\windows\winobject\event_log.py
%TEMP%\_mei25162\windows\winobject\event_trace.py
%TEMP%\_mei25162\windows\winobject\exception.py
%TEMP%\_mei25162\windows\winobject\file.py
%TEMP%\_mei25162\windows\winobject\handle.py
%TEMP%\_mei25162\windows\winobject\hyperv.py
%TEMP%\_mei25162\windows\winobject\network.py
%TEMP%\_mei25162\windows\winobject\object_manager.py
%TEMP%\_mei25162\windows\winobject\process.py
%TEMP%\_mei25162\windows\winobject\registry.py
%TEMP%\_mei25162\windows\winobject\service.py
%TEMP%\_mei25162\windows\winobject\system.py
%TEMP%\_mei25162\windows\winobject\system_module.py
%TEMP%\_mei25162\windows\winobject\task_scheduler.py
%TEMP%\_mei25162\windows\winobject\token.py
%TEMP%\_mei25162\windows\winobject\volume.py
%TEMP%\_mei25162\windows\winobject\wmi.py
%TEMP%\_mei25162\windows\winproxy\apiproxy.py
%TEMP%\_mei25162\windows\winproxy\apis\advapi32.py
%TEMP%\_mei25162\windows\winproxy\apis\cfgmgr32.py
%TEMP%\_mei25162\windows\winproxy\apis\crypt32.py
%TEMP%\_mei25162\windows\winproxy\apis\cryptui.py
%TEMP%\_mei25162\windows\winproxy\apis\dbghelp.py
%TEMP%\_mei25162\windows\winproxy\apis\dnsapi.py
%TEMP%\_mei25162\windows\winproxy\apis\iphlpapi.py
%TEMP%\_mei25162\windows\winproxy\apis\kernel32.py
%TEMP%\_mei25162\windows\winproxy\apis\ktmw32.py
%TEMP%\_mei25162\windows\winproxy\apis\ncrypt.py
%TEMP%\_mei25162\windows\winproxy\apis\netapi32.py
%TEMP%\_mei25162\windows\winproxy\apis\ntdll.py
%TEMP%\_mei25162\windows\winproxy\apis\ole32.py
%TEMP%\_mei25162\windows\winproxy\apis\oleacc.py
%TEMP%\_mei25162\windows\winproxy\apis\oleaut32.py
%TEMP%\_mei25162\windows\winproxy\apis\psapi.py
%TEMP%\_mei25162\windows\winproxy\apis\setupapi.py
%TEMP%\_mei25162\windows\winproxy\apis\shell32.py
%TEMP%\_mei25162\windows\winproxy\apis\shlwapi.py
%TEMP%\_mei25162\windows\winproxy\apis\tdh.py
%TEMP%\_mei25162\windows\winproxy\apis\user32.py
%TEMP%\_mei25162\windows\winproxy\apis\version.py
%TEMP%\_mei25162\windows\winproxy\apis\virtdisk.py
%TEMP%\_mei25162\windows\winproxy\apis\wevtapi.py
%TEMP%\_mei25162\windows\winproxy\apis\winhttp.py
%TEMP%\_mei25162\windows\winproxy\apis\wininet.py
%TEMP%\_mei25162\windows\winproxy\apis\wintrust.py
%TEMP%\_mei25162\windows\winproxy\apis\ws2_32.py
%TEMP%\_mei25162\windows\winproxy\apis\__init__.py
%TEMP%\_mei25162\windows\winproxy\error.py
%TEMP%\_mei25162\windows\winproxy\__init__.py
%TEMP%\_mei25162\windows\wintrust.py
%TEMP%\_mei25162\windows\__init__.py
%TEMP%\_mei25162\_asyncio.pyd
%TEMP%\_mei25162\_bz2.pyd
%TEMP%\_mei25162\_cffi_backend.cp310-win_amd64.pyd
%TEMP%\_mei25162\_ctypes.pyd
%TEMP%\_mei25162\_decimal.pyd
%TEMP%\_mei25162\_hashlib.pyd
%TEMP%\_mei25162\_lzma.pyd
%TEMP%\_mei25162\_multiprocessing.pyd
%TEMP%\_mei25162\_overlapped.pyd
%TEMP%\_mei25162\_queue.pyd
%TEMP%\_mei25162\_socket.pyd
%TEMP%\_mei25162\_sqlite3.pyd
%TEMP%\_mei25162\_ssl.pyd
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69a4d767-117c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69a4d76a-1754.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001

Moves the following files

from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%TEMP%\.ses
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG

Network activity

UDP

DNS ASK dr##box.com
DNS ASK ap#.##legram.org
DNS ASK co####.edge.skype.com
DNS ASK google.com

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c "ver"
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.dropbox.com/scl/fi/y6mstg8xx4q9o4j7dnm68/scan_2026-02-19_14-24-24_1.pdf?rlkey=wow3kav7rl6zlsswf04066p7j&st=t36d0p77&dl=1
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.dropbox.com/scl/fi/y6mstg8xx4q9o4j7dnm68/scan_2026-02-19_14-24-24_1.pdf?rlkey=wow3kav7rl6zlsswf04066p7j&st=t36d0p77&dl=...
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,6477112125147360009,7718692600408072153,131072 --lang=en-US --service-sandbox-type=none --mojo-p...
'<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.dropbox.com/scl/fi/y6mstg8xx4q9o4j7dnm68/scan_2026-02-19_14-24-24_1.pdf?rlkey=wow3kav7rl6zlsswf04066p7j&st=t36d0p77&dl=...' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial