Technical Information
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\tmp4920.tmp
- %TEMP%\tmp4aa1.tmp
- %TEMP%\tmp4aa0.tmp
- %TEMP%\tmp4a9f.tmp
- %TEMP%\tmp4a9e.tmp
- %TEMP%\tmp4a9d.tmp
- %TEMP%\tmp4a9c.tmp
- %TEMP%\tmp4a8b.tmp
- %TEMP%\tmp4a8a.tmp
- %TEMP%\tmp4a89.tmp
- %TEMP%\tmp4a88.tmp
- %TEMP%\tmp4a87.tmp
- %TEMP%\tmp4a86.tmp
- %TEMP%\tmp4a76.tmp
- %TEMP%\tmp4a75.tmp
- %TEMP%\tmp4a74.tmp
- %TEMP%\tmp4a73.tmp
- %TEMP%\tmp4a62.tmp
- %TEMP%\tmp4a61.tmp
- %TEMP%\tmp4a60.tmp
- %TEMP%\tmp4a5f.tmp
- %TEMP%\tmp4a5e.tmp
- %TEMP%\tmp4a4d.tmp
- %TEMP%\tmp4a4e.tmp
- %TEMP%\tmp4ab2.tmp
- %TEMP%\tmp4ab3.tmp
- %TEMP%\tmp4b17.tmp
- %TEMP%\tmp4b06.tmp
- %TEMP%\tmp4b05.tmp
- %TEMP%\tmp4b04.tmp
- %TEMP%\tmp4af3.tmp
- %TEMP%\tmp4af2.tmp
- %TEMP%\tmp4af1.tmp
- %TEMP%\tmp4af0.tmp
- %TEMP%\tmp4aef.tmp
- %TEMP%\tmp4adf.tmp
- %TEMP%\tmp4add.tmp
- %TEMP%\tmp4a0f.tmp
- %TEMP%\tmp4adc.tmp
- %TEMP%\tmp4adb.tmp
- %TEMP%\tmp4aca.tmp
- %TEMP%\tmp4ac9.tmp
- %TEMP%\tmp4ac8.tmp
- %TEMP%\tmp4ac7.tmp
- %TEMP%\tmp4ab7.tmp
- %TEMP%\tmp4ab6.tmp
- %TEMP%\tmp4ab5.tmp
- %TEMP%\tmp4ab4.tmp
- %TEMP%\tmp4a4c.tmp
- %TEMP%\tmp4a4b.tmp
- %TEMP%\tmp4a4a.tmp
- %TEMP%\tmp49c0.tmp
- %TEMP%\tmp49bf.tmp
- %TEMP%\tmp49be.tmp
- %TEMP%\tmp49ae.tmp
- %TEMP%\tmp49ad.tmp
- %TEMP%\tmp49ac.tmp
- %TEMP%\tmp49ab.tmp
- %TEMP%\tmp499a.tmp
- %TEMP%\tmp4999.tmp
- %TEMP%\tmp4998.tmp
- %TEMP%\tmp4988.tmp
- %TEMP%\tmp4977.tmp
- %TEMP%\tmp4976.tmp
- %TEMP%\tmp4975.tmp
- %TEMP%\tmp4964.tmp
- %TEMP%\tmp4963.tmp
- %TEMP%\tmp4962.tmp
- %TEMP%\tmp4961.tmp
- %TEMP%\tmp4951.tmp
- %TEMP%\tmp4931.tmp
- %TEMP%\tmp49d2.tmp
- %TEMP%\tmp49d3.tmp
- %TEMP%\tmp49c1.tmp
- %TEMP%\tmp49d4.tmp
- %TEMP%\tmp4a39.tmp
- %TEMP%\tmp49d5.tmp
- %TEMP%\tmp4a38.tmp
- %TEMP%\tmp4a37.tmp
- %TEMP%\tmp4a36.tmp
- %TEMP%\tmp4a25.tmp
- %TEMP%\tmp4a24.tmp
- %TEMP%\tmp4a23.tmp
- %TEMP%\tmp4a22.tmp
- %TEMP%\tmp4a12.tmp
- %TEMP%\tmp4a11.tmp
- %TEMP%\tmp4ade.tmp
- %TEMP%\tmp4b27.tmp
- %TEMP%\tmp4a0e.tmp
- %TEMP%\tmp49fd.tmp
- %TEMP%\tmp49fc.tmp
- %TEMP%\tmp49fb.tmp
- %TEMP%\tmp49fa.tmp
- %TEMP%\tmp49ea.tmp
- %TEMP%\tmp49e9.tmp
- %TEMP%\tmp49e8.tmp
- %TEMP%\tmp49e7.tmp
- %TEMP%\tmp49e6.tmp
- %TEMP%\tmp4a10.tmp
- %TEMP%\tmp4b28.tmp
Deletes the following files
- %TEMP%\tmp4931.tmp
- %TEMP%\tmp4a74.tmp
- %TEMP%\tmp4a76.tmp
- %TEMP%\tmp4a87.tmp
- %TEMP%\tmp4a89.tmp
- %TEMP%\tmp4a8b.tmp
- %TEMP%\tmp4a9d.tmp
- %TEMP%\tmp4a9f.tmp
- %TEMP%\tmp4aa1.tmp
- %TEMP%\tmp4ab3.tmp
- %TEMP%\tmp4a60.tmp
- %TEMP%\tmp4a62.tmp
- %TEMP%\tmp4ab5.tmp
- %TEMP%\tmp4aca.tmp
- %TEMP%\tmp4adc.tmp
- %TEMP%\tmp4ade.tmp
- %TEMP%\tmp4aef.tmp
- %TEMP%\tmp4af1.tmp
- %TEMP%\tmp4af3.tmp
- %TEMP%\tmp4b05.tmp
- %TEMP%\tmp4b06.tmp
- %TEMP%\tmp4b17.tmp
- %TEMP%\tmp4ab7.tmp
- %TEMP%\tmp4ac8.tmp
- %TEMP%\tmp4a5e.tmp
- %TEMP%\tmp4a4d.tmp
- %TEMP%\tmp4a4b.tmp
- %TEMP%\tmp4963.tmp
- %TEMP%\tmp4975.tmp
- %TEMP%\tmp4977.tmp
- %TEMP%\tmp4998.tmp
- %TEMP%\tmp499a.tmp
- %TEMP%\tmp49ac.tmp
- %TEMP%\tmp49ae.tmp
- %TEMP%\tmp49bf.tmp
- %TEMP%\tmp49c1.tmp
- %TEMP%\tmp49d3.tmp
- %TEMP%\tmp4961.tmp
- %TEMP%\tmp49d5.tmp
- %TEMP%\tmp49e9.tmp
- %TEMP%\tmp49fa.tmp
- %TEMP%\tmp49fc.tmp
- %TEMP%\tmp4a0e.tmp
- %TEMP%\tmp4a10.tmp
- %TEMP%\tmp4a12.tmp
- %TEMP%\tmp4a23.tmp
- %TEMP%\tmp4a25.tmp
- %TEMP%\tmp4a37.tmp
- %TEMP%\tmp4a39.tmp
- %TEMP%\tmp49e7.tmp
- %TEMP%\tmp4b27.tmp
- %TEMP%\tmp4b28.tmp
Network activity
Connects to
- '91.##4.11.188':1725
- 'ap#.ip.sb':443
- 'wh###.iana.org':43
- 'WH###.RIPE.NET':43
TCP
HTTP POST requests
- http://91.###.11.188:1725/ via 91.##4.11.188
UDP
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
