Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowsupdate.vbs
Modifies file system
Creates the following files
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\package.json
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\index.js
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\darwin_arm64\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\darwin_x64\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\freebsd_arm64\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\freebsd_ia32\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\freebsd_x64\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\linux_armhf\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\linux_arm64\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\linux_ia32\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\linux_loong64\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\linux_riscv64d\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\linux_x64\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\openbsd_ia32\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\openbsd_x64\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\win32_arm64\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\win32_ia32\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\win32_x64\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\musl_arm64\koffi.node
- %TEMP%\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\musl_x64\koffi.node
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\package.json
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\binding.gyp
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\dist\index.js
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\dist\index.d.ts
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\src\dpapi_addon.h
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\src\dpapi_not_supported.cpp
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\src\dpapi_win.cpp
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\src\main.cpp
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\test\dpapi.spec.ts
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-arm64\@primno+dpapi.node
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-arm64\@primno+dpapi.node.bak
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
- %TEMP%\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node.bak
- %TEMP%\etilqs_jxxi3d9nnpwmshz
- %TEMP%\etilqs_vdobk4q2ozdwd55
Network activity
UDP
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Ocorreu um erro no sistema!', 'Erro', [System.Windows.Fo...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Ocorreu um erro no sistema!', 'Erro', [System.Windows.Forms.MessageBoxButtons...
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Ocorreu um erro no sistema!', 'Erro', [System.Windows.Fo...' (with hidden window)
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' --disable-field-trial-config --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-back-forward-cache --disable-breakpad --dis...' (with hidden window)
