Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\c__sqieu_<File name>.exe
Modifies file system
Creates the following files
- %TEMP%\macrorit data wiper.msi
- %TEMP%\macrorit data wiper.x64.msi
- %TEMP%\shia950.tmp
- %TEMP%\msia9fd.tmp
- %TEMP%\msiae44.tmp
- %TEMP%\msib123.tmp
- %TEMP%\ai_extui_bin_5172\dialog.jpg
- %TEMP%\ai_extui_bin_5172\completi
- %TEMP%\ai_extui_bin_5172\custicon
- %TEMP%\ai_extui_bin_5172\exclamic
- %TEMP%\ai_extui_bin_5172\info
- %TEMP%\ai_extui_bin_5172\insticon
- %TEMP%\ai_extui_bin_5172\removico
- %TEMP%\ai_extui_bin_5172\repairic
- %TEMP%\ai_extui_bin_5172\up
- %TEMP%\ai_extui_bin_5172\new
- %TEMP%\ai_extui_bin_5172\banner.jpg
- %TEMP%\ai_extui_bin_5172\tabback
- %TEMP%\ai_extui_bin_5172\cmdlinkarrow
- %TEMP%\ai_extui_bin_5172\dialog.scale125.jpg
- %TEMP%\ai_extui_bin_5172\banner.svg
- %TEMP%\ai_extui_bin_5172\lzmaextractor.dll
- %TEMP%\ai_extui_bin_5172\dialog.svg
- %TEMP%\ai_extui_bin_5172\banner.scale125.jpg
- %TEMP%\ai_extui_bin_5172\banner.scale150.jpg
- %TEMP%\ai_extui_bin_5172\banner.scale200.jpg
- %TEMP%\ai_extui_bin_5172\dialog.scale150.jpg
- %TEMP%\ai_extui_bin_5172\dialog.scale200.jpg
- %TEMP%\msib56a.tmp
- %TEMP%\data wiper\mwiper-pro-setup.exe
- %TEMP%\nsic371.tmp
- %TEMP%\nscc3a0.tmp\system.dll
- %ProgramFiles%\macrorit\data wiper\core.dll
- %ProgramFiles%\macrorit\data wiper\core2.dll
- %ProgramFiles%\macrorit\data wiper\languages\arj.lng
- %ProgramFiles%\macrorit\data wiper\languages\bgr.lng
- %ProgramFiles%\macrorit\data wiper\languages\cat.lng
- %ProgramFiles%\macrorit\data wiper\languages\chs.lng
- %ProgramFiles%\macrorit\data wiper\languages\cht.lng
- %ProgramFiles%\macrorit\data wiper\languages\csy.lng
- %ProgramFiles%\macrorit\data wiper\languages\deu.lng
- %ProgramFiles%\macrorit\data wiper\languages\ell.lng
- %ProgramFiles%\macrorit\data wiper\languages\eng.lng
- %ProgramFiles%\macrorit\data wiper\languages\esp.lng
- %ProgramFiles%\macrorit\data wiper\languages\fin.lng
- %ProgramFiles%\macrorit\data wiper\languages\fra.lng
- %ProgramFiles%\macrorit\data wiper\languages\heb.lng
- %ProgramFiles%\macrorit\data wiper\languages\hrv.lng
- %ProgramFiles%\macrorit\data wiper\languages\hun.lng
- %ProgramFiles%\macrorit\data wiper\languages\ita.lng
- %ProgramFiles%\macrorit\data wiper\languages\jpn.lng
- %ProgramFiles%\macrorit\data wiper\languages\kor.lng
- %ProgramFiles%\macrorit\data wiper\languages\nld.lng
- %ProgramFiles%\macrorit\data wiper\languages\nor.lng
- %ProgramFiles%\macrorit\data wiper\languages\plk.lng
- %ProgramFiles%\macrorit\data wiper\languages\ptg.lng
- %ProgramFiles%\macrorit\data wiper\languages\rom.lng
- %ProgramFiles%\macrorit\data wiper\languages\rus.lng
- %ProgramFiles%\macrorit\data wiper\languages\slv.lng
- %ProgramFiles%\macrorit\data wiper\languages\sve.lng
- %ProgramFiles%\macrorit\data wiper\languages\trk.lng
- %ProgramFiles%\macrorit\data wiper\languages\ukr.lng
- %ProgramFiles%\macrorit\data wiper\dm.api
- %ProgramFiles%\macrorit\data wiper\dm.wiper.exe
- %ProgramFiles%\macrorit\data wiper\pro.api
- %ProgramFiles%\macrorit\data wiper\website.url
- %APPDATA%\microsoft\windows\start menu\programs\macrorit data wiper pro\website.lnk
- %APPDATA%\microsoft\windows\start menu\programs\macrorit data wiper pro\uninstall.lnk
- %APPDATA%\microsoft\windows\start menu\programs\macrorit data wiper pro\macrorit data wiper pro.lnk
- %HOMEPATH%\desktop\macrorit data wiper pro.lnk
- %ProgramFiles%\macrorit\data wiper\uninst.exe
- %TEMP%\msie0ef.tmp
- %TEMP%\pree64f.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a3f1d7e-16c8.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a3f1d83-bf0.pma
- %TEMP%\macrorit data wiper1.cab
- %WINDIR%\temp\~dfc017505ddde1e7b7.tmp
- %WINDIR%\installer\sourcehash{1ce758e6-e843-4a4e-b26b-2392a806c73e}
- %WINDIR%\temp\~df6b38605270ef76c2.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %WINDIR%\temp\~df5c445d5cdd20a653.tmp
- %WINDIR%\temp\~dfc12429e261858016.tmp
- %ProgramFiles%\macrorit\data wiper\mdw.lkeys
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %WINDIR%\temp\~df3839abcb7ea77b74.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %WINDIR%\temp\~dfcb80c7cd1c5d7300.tmp
- %WINDIR%\temp\~dfe21bddd4c6af0d91.tmp
- %WINDIR%\temp\~df1b197976a984161b.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %WINDIR%\temp\~df71f9de66431cb821.tmp
- %WINDIR%\temp\~df58418a7172de7b3a.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %WINDIR%\temp\~dfcf84de8f4abbddef.tmp
- %WINDIR%\temp\~df802af0a85ab5f6c5.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %TEMP%\exe2c72.bat
- %TEMP%\exe304b.bat
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5890cb60c3954f0c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c7c10f7155c34215_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a304517f99f23492_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8a9daaa297a85918_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a7ec654cfe2644be_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\70a5d2211cb70ff2_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\entityextraction\extractable_domains.pb
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\entityextraction\domains_config.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %TEMP%\c0ac68da-63b2-4d7f-84dc-99064cd4cdab.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
Sets the 'hidden' attribute to the following files
- %ProgramFiles%\macrorit\data wiper\pro.api
Deletes following files that it created itself
- %TEMP%\shia950.tmp
- %TEMP%\msia9fd.tmp
- %TEMP%\msiae44.tmp
- %TEMP%\msib123.tmp
- %TEMP%\msib56a.tmp
- <SYSTEM32>\tasks\c__sqieu_<File name>.exe
- %TEMP%\nscc3a0.tmp\system.dll
- %TEMP%\msie0ef.tmp
- %TEMP%\pree64f.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %TEMP%\macrorit data wiper.msi
- %TEMP%\macrorit data wiper1.cab
- %TEMP%\data wiper\mwiper-pro-setup.exe
- %TEMP%\ai_extui_bin_5172\dialog.jpg
- %TEMP%\ai_extui_bin_5172\completi
- %TEMP%\ai_extui_bin_5172\custicon
- %TEMP%\ai_extui_bin_5172\exclamic
- %TEMP%\ai_extui_bin_5172\info
- %TEMP%\ai_extui_bin_5172\insticon
- %TEMP%\ai_extui_bin_5172\removico
- %TEMP%\ai_extui_bin_5172\repairic
- %TEMP%\ai_extui_bin_5172\up
- %TEMP%\ai_extui_bin_5172\new
- %TEMP%\ai_extui_bin_5172\banner.jpg
- %TEMP%\ai_extui_bin_5172\tabback
- %TEMP%\ai_extui_bin_5172\cmdlinkarrow
- %TEMP%\ai_extui_bin_5172\dialog.scale125.jpg
- %TEMP%\ai_extui_bin_5172\banner.svg
- %TEMP%\ai_extui_bin_5172\lzmaextractor.dll
- %TEMP%\ai_extui_bin_5172\dialog.svg
- %TEMP%\ai_extui_bin_5172\banner.scale125.jpg
- %TEMP%\ai_extui_bin_5172\banner.scale150.jpg
- %TEMP%\ai_extui_bin_5172\banner.scale200.jpg
- %TEMP%\ai_extui_bin_5172\dialog.scale150.jpg
- %TEMP%\ai_extui_bin_5172\dialog.scale200.jpg
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a3f1d7e-16c8.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a3f1d83-bf0.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
Moves the following files
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons
- %TEMP%\.ses
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Network activity
Connects to
- 'co####.edge.skype.com':443
- 'ma###rit.com':443
- 'ss#.####le-a###ytics.com':443
TCP
Other
- 'co####.edge.skype.com':443
- 'ma###rit.com':443
- 'ss#.####le-a###ytics.com':443
UDP
- DNS ASK co####.edge.skype.com
- DNS ASK ma###rit.com
- DNS ASK ss#.####le-a###ytics.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Creates and executes the following
- '%TEMP%\data wiper\mwiper-pro-setup.exe' /S
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://macrorit.com/partition-magic-manager/installation-successful.html?mdw
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\Macrorit Data Wiper.x64.msi" AI_SETUPEXEPATH=<Full path to file> SETUPEXEDIR=<Current directory>\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1782520302 " AI_EUIMSI="" AI_M...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://macrorit.com/partition-magic-manager/installation-successful.html?mdw
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\EXE2C72.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\EXE304B.bat" "
- '%WINDIR%\syswow64\attrib.exe' -r "\\?\%TEMP%\MACROR~2.MSI"
- '%WINDIR%\syswow64\attrib.exe' -r "%TEMP%\EXE2C72.bat"
- '%WINDIR%\syswow64\attrib.exe' -r "%TEMP%\EXE304B.bat"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" del "%TEMP%\EXE2C72.bat" "
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" cls"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" del "%TEMP%\EXE304B.bat" "
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,8879152651947614016,13317183907904122183,131072 --lang=en-US --service-sandbox-type=none --mojo-...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://macrorit.com/partition-magic-manager/installation-successful.html?mdw' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\EXE2C72.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\EXE304B.bat" "' (with hidden window)
