Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CoreWorker_YSrwQyiIAENnYSq' = '%LOCALAPPDATA%\MpDefenderCoreFolder\CoreWorker_YSrwQyiIAENnYSq.exe'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CoreWorker_YSrwQyiIAENnYSq' = '%LOCALAPPDATA%\MpDefenderCoreFolder\CoreWorker_YSrwQyiIAENnYSq.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windows repair.lnk
- <SYSTEM32>\tasks\coreworker_ysrwqyiiaennysq-4095
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\MpDefenderCoreFolder'"
Patches code
in AMSI dll
- 05e63bd588df.exe process, Amsi.dll module
in NTDLL dll
- 05e63bd588df.exe process, ntdll.dll module
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\svc_ba14840a.log
- %TEMP%\05e63bd588df.exe
- %TEMP%\0225sb3k.4c4\crashpad\settings.dat
- %TEMP%\0225sb3k.4c4\crashpad\throttle_store.dat
- %TEMP%\0225sb3k.4c4\crashpadmetrics-active.pma
- %TEMP%\0225sb3k.4c4\browsermetrics\browsermetrics-6a4ee233-141c.pma
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\index
- %TEMP%\0225sb3k.4c4\last version
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\data_0
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\data_1
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\data_2
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\data_3
- %TEMP%\0225sb3k.4c4\82ccc60e-b98f-4706-9a4b-26802d2e630a.tmp
- %TEMP%\0225sb3k.4c4\5b2dbcf6-a81f-4b98-939c-eacca9b8b931.tmp
- %TEMP%\0225sb3k.4c4\browsermetrics\browsermetrics-6a4ee23b-8d8.pma
- %TEMP%\0225sb3k.4c4\default\readme
- %TEMP%\0225sb3k.4c4\default\history-journal
- %TEMP%\0225sb3k.4c4\default\code cache\wasm\index
- %TEMP%\0225sb3k.4c4\default\code cache\js\index
- %TEMP%\0225sb3k.4c4\default\site characteristics database\manifest-000001
- %TEMP%\0225sb3k.4c4\default\login data-journal
- %TEMP%\0225sb3k.4c4\default\web data-journal
- %TEMP%\0225sb3k.4c4\default\sync data\leveldb\manifest-000001
- %TEMP%\0225sb3k.4c4\default\sync data\leveldb\000001.dbtmp
- %TEMP%\0225sb3k.4c4\first run
- %TEMP%\0225sb3k.4c4\default\media history-journal
- %TEMP%\0225sb3k.4c4\default\site characteristics database\000001.dbtmp
- %TEMP%\0225sb3k.4c4\firstlaunchafterinstallation
- %TEMP%\0225sb3k.4c4\grshadercache\gpucache\index
- %TEMP%\0225sb3k.4c4\default\local storage\leveldb\manifest-000001
- %TEMP%\0225sb3k.4c4\default\local storage\leveldb\000001.dbtmp
- %TEMP%\0225sb3k.4c4\grshadercache\gpucache\data_0
- %TEMP%\0225sb3k.4c4\grshadercache\gpucache\data_1
- %TEMP%\0225sb3k.4c4\default\sync data\leveldb\log
- %TEMP%\0225sb3k.4c4\grshadercache\gpucache\data_2
- %TEMP%\0225sb3k.4c4\functional data-journal
- %TEMP%\0225sb3k.4c4\grshadercache\gpucache\data_3
- %TEMP%\0225sb3k.4c4\default\history
- %TEMP%\0225sb3k.4c4\default\local storage\leveldb\log
- %TEMP%\0225sb3k.4c4\default\sync data\leveldb\000003.log
- %TEMP%\0225sb3k.4c4\default\web data
- %TEMP%\0225sb3k.4c4\default\site characteristics database\log
- %TEMP%\0225sb3k.4c4\default\site characteristics database\000003.log
- %TEMP%\0225sb3k.4c4\default\login data
- %TEMP%\0225sb3k.4c4\default\media history
- %TEMP%\0225sb3k.4c4\default\favicons-journal
- %TEMP%\0225sb3k.4c4\functional data
- %TEMP%\0225sb3k.4c4\default\favicons
- %TEMP%\0225sb3k.4c4\functional data-wal
- %TEMP%\0225sb3k.4c4\functional san data-journal
- %TEMP%\0225sb3k.4c4\functional san data
- %TEMP%\0225sb3k.4c4\default\b6a95739-f153-48f1-8ed8-70d37a91fbfd.tmp
- %TEMP%\0225sb3k.4c4\functional san data-wal
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\code cache\js\index
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\code cache\wasm\index
- %TEMP%\0225sb3k.4c4\default\efdbbe92-04f0-440b-9487-41d09e1d735d.tmp
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\local storage\leveldb\manifest-000001
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\local storage\leveldb\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\local storage\leveldb\log
- %TEMP%\0225sb3k.4c4\default\top sites-journal
- %TEMP%\0225sb3k.4c4\default\gpucache\index
- %TEMP%\0225sb3k.4c4\default\gpucache\data_0
- %TEMP%\0225sb3k.4c4\default\top sites
- %TEMP%\0225sb3k.4c4\default\gpucache\data_1
- %TEMP%\0225sb3k.4c4\default\gpucache\data_2
- %TEMP%\0225sb3k.4c4\default\gpucache\data_3
- %TEMP%\0225sb3k.4c4\default\cookies-journal
- %TEMP%\0225sb3k.4c4\default\cookies
- %TEMP%\0225sb3k.4c4\a080117d-f19c-47e1-941c-7351c448bdb5.tmp
- %TEMP%\0225sb3k.4c4\default\008f72e8-477c-455c-8bef-6554c92914ff.tmp
- %TEMP%\0225sb3k.4c4\default\visited links
- %TEMP%\0225sb3k.4c4\default\code cache\js\index-dir\temp-index
- %TEMP%\0225sb3k.4c4\default\code cache\wasm\index-dir\temp-index
- %TEMP%\0225sb3k.4c4\default\platform notifications\manifest-000001
- %TEMP%\0225sb3k.4c4\default\platform notifications\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\code cache\wasm\index-dir\temp-index
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\platform notifications\manifest-000001
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\code cache\js\index-dir\temp-index
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\platform notifications\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\gpucache\index
- %TEMP%\0225sb3k.4c4\default\platform notifications\log
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\platform notifications\log
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\gpucache\data_0
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\gpucache\data_1
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\gpucache\data_2
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\gpucache\data_3
- %TEMP%\0225sb3k.4c4\default\8744b78b-b73b-43c5-b6f2-0370d36d3577.tmp
- %TEMP%\0225sb3k.4c4\default\e8296b2c-ddb9-4f7d-851b-26a5c3e22f61.tmp
- %TEMP%\0225sb3k.4c4\default\74bef998-24c8-4fc4-855c-8c59bc9e2a93.tmp
- %TEMP%\0225sb3k.4c4\default\microsoft edge.lnk
- %TEMP%\0225sb3k.4c4\default\cache\index
- %TEMP%\0225sb3k.4c4\default\cache\data_0
- %TEMP%\0225sb3k.4c4\default\cache\data_1
- %TEMP%\0225sb3k.4c4\default\cache\data_2
- %TEMP%\0225sb3k.4c4\default\cache\data_3
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\microsoft edge (2).lnk
- %LOCALAPPDATA%\mpdefendercorefolder\coreworker_ysrwqyiiaennysq.exe
- %TEMP%\0225sb3k.4c4\default\local extension settings\jdiccldimpdaibmpdkjnbmckianbfold\manifest-000001
- %TEMP%\0225sb3k.4c4\default\local extension settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\local extension settings\jdiccldimpdaibmpdkjnbmckianbfold\log
- %TEMP%\0225sb3k.4c4\default\extension state\manifest-000001
- %TEMP%\0225sb3k.4c4\default\extension state\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\extension state\log
- %TEMP%\0225sb3k.4c4\default\extension state\000003.log
- %TEMP%\0225sb3k.4c4\default\reporting and nel-journal
- %TEMP%\0225sb3k.4c4\default\reporting and nel
- %TEMP%\0225sb3k.4c4\285894d9-f387-415d-9476-d8f9fbbdd5b8.tmp
- %TEMP%\0225sb3k.4c4\default\2f20e389-1c0f-465c-ae7e-0270995c173c.tmp
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\9a0b6914-e511-4107-a337-4ea859d15bd7.tmp
- %TEMP%\615c0298-d660-4161-955e-5341f529c8b5.tmp
- %TEMP%\40009808-9617-4d2a-9266-dbaa01a65646.tmp
- %TEMP%\6e5e841f-96af-4af9-8014-008f406b4629.tmp
- %TEMP%\3c58cc93-973c-4f74-946f-dcb72a5d10b6.tmp
- %TEMP%\0225sb3k.4c4\default\48cd6f67-6d34-4b04-9ef6-7c222fa823ce.tmp
- %TEMP%\0225sb3k.4c4\default\session storage\manifest-000001
- %TEMP%\0225sb3k.4c4\default\session storage\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\session storage\log
- %TEMP%\0225sb3k.4c4\default\session storage\000003.log
- %TEMP%\0225sb3k.4c4\d1757d67-da8f-4226-a2a3-78851db254ff.tmp
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\session storage\manifest-000001
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\session storage\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\session storage\log
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\session storage\000003.log
- %TEMP%\0225sb3k.4c4\default\heavy_ad_intervention_opt_out.db-journal
- %TEMP%\0225sb3k.4c4\default\data_reduction_proxy_leveldb\manifest-000001
- %TEMP%\0225sb3k.4c4\default\data_reduction_proxy_leveldb\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\data_reduction_proxy_leveldb\manifest-000002
- %TEMP%\0225sb3k.4c4\default\heavy_ad_intervention_opt_out.db
- %TEMP%\0225sb3k.4c4\default\data_reduction_proxy_leveldb\000002.dbtmp
- %TEMP%\0225sb3k.4c4\default\data_reduction_proxy_leveldb\log
- %TEMP%\0225sb3k.4c4\default\previews_opt_out.db-journal
- %TEMP%\0225sb3k.4c4\default\previews_opt_out.db
- %TEMP%\0225sb3k.4c4\default\shortcuts-journal
- %TEMP%\0225sb3k.4c4\default\network action predictor-journal
- %TEMP%\0225sb3k.4c4\default\b6aa897e-8f5a-41ce-8345-76f6b36248ab.tmp
- %TEMP%\0225sb3k.4c4\default\shortcuts
- %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\9d0fc2db-86ed-4a82-9f67-6e760eca8c8e.tmp
- %TEMP%\0225sb3k.4c4\default\network action predictor
- %TEMP%\0225sb3k.4c4\last browser
- %TEMP%\0225sb3k.4c4\default\preferredapps
- %TEMP%\0225sb3k.4c4\default\budgetdatabase\manifest-000001
- %TEMP%\0225sb3k.4c4\default\budgetdatabase\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\budgetdatabase\log
- %TEMP%\0225sb3k.4c4\default\feature engagement tracker\eventdb\manifest-000001
- %TEMP%\0225sb3k.4c4\default\feature engagement tracker\eventdb\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\feature engagement tracker\eventdb\log
- %TEMP%\0225sb3k.4c4\default\feature engagement tracker\availabilitydb\manifest-000001
- %TEMP%\0225sb3k.4c4\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\feature engagement tracker\availabilitydb\log
- %TEMP%\0225sb3k.4c4\ad blocking\d99b01e4-22f8-4d1a-82ce-98c085df5ad7.tmp
- %TEMP%\0225sb3k.4c4\default\autofillstrikedatabase\manifest-000001
- %TEMP%\0225sb3k.4c4\default\autofillstrikedatabase\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\shared_proto_db\metadata\manifest-000001
- %TEMP%\0225sb3k.4c4\default\shared_proto_db\metadata\000001.dbtmp
- %TEMP%\0225sb3k.4c4\default\autofillstrikedatabase\log
- %TEMP%\0225sb3k.4c4\default\shared_proto_db\metadata\log
- %TEMP%\0225sb3k.4c4\default\shared_proto_db\metadata\000003.log
- %TEMP%\0225sb3k.4c4\default\feature engagement tracker\availabilitydb\000003.log
- %TEMP%\0225sb3k.4c4\default\5519c18b-8ea7-4bf0-a06d-fb39897d60c4.tmp
- %TEMP%\0225sb3k.4c4\browsermetrics-spare.pma.tmp
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\mpdefendercorefolder\coreworker_ysrwqyiiaennysq.exe
Deletes following files that it created itself
- %TEMP%\0225sb3k.4c4\browsermetrics\browsermetrics-6a4ee233-141c.pma
- %TEMP%\0225sb3k.4c4\browsermetrics\browsermetrics-6a4ee23b-8d8.pma
- %TEMP%\0225sb3k.4c4\crashpad\settings.dat
- %TEMP%\0225sb3k.4c4\crashpad\throttle_store.dat
- %TEMP%\0225sb3k.4c4\crashpadmetrics.pma
- %TEMP%\0225sb3k.4c4\last version
- %TEMP%\0225sb3k.4c4\local state
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\data_0
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\data_1
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\data_2
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\data_3
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\index
- %TEMP%\0225sb3k.4c4\functional data-journal
- %TEMP%\0225sb3k.4c4\functional san data-journal
- %TEMP%\0225sb3k.4c4\default\efdbbe92-04f0-440b-9487-41d09e1d735d.tmp
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\microsoft edge (2).lnk
- %TEMP%\0225sb3k.4c4\default\data_reduction_proxy_leveldb\manifest-000001
Moves the following files
- from %TEMP%\0225sb3k.4c4\82ccc60e-b98f-4706-9a4b-26802d2e630a.tmp to %TEMP%\0225sb3k.4c4\local state
- from %TEMP%\0225sb3k.4c4\crashpadmetrics-active.pma to %TEMP%\0225sb3k.4c4\crashpadmetrics.pma
- from %TEMP%\0225sb3k.4c4\default\sync data\leveldb\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\sync data\leveldb\current
- from %TEMP%\0225sb3k.4c4\default\local storage\leveldb\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\local storage\leveldb\current
- from %TEMP%\0225sb3k.4c4\default\site characteristics database\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\site characteristics database\current
- from %TEMP%\0225sb3k.4c4\default\b6a95739-f153-48f1-8ed8-70d37a91fbfd.tmp to %TEMP%\0225sb3k.4c4\default\network persistent state
- from %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\local storage\leveldb\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\local storage\leveldb\current
- from %TEMP%\0225sb3k.4c4\default\code cache\js\index-dir\temp-index to %TEMP%\0225sb3k.4c4\default\code cache\js\index-dir\the-real-index
- from %TEMP%\0225sb3k.4c4\default\code cache\wasm\index-dir\temp-index to %TEMP%\0225sb3k.4c4\default\code cache\wasm\index-dir\the-real-index
- from %TEMP%\0225sb3k.4c4\default\008f72e8-477c-455c-8bef-6554c92914ff.tmp to %TEMP%\0225sb3k.4c4\default\secure preferences
- from %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\code cache\wasm\index-dir\temp-index to %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\code cache\wasm\index-dir\the-real-index
- from %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\code cache\js\index-dir\temp-index to %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\code cache\js\index-dir\the-real-index
- from %TEMP%\0225sb3k.4c4\default\platform notifications\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\platform notifications\current
- from %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\platform notifications\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\platform notifications\current
- from %TEMP%\0225sb3k.4c4\default\8744b78b-b73b-43c5-b6f2-0370d36d3577.tmp to %TEMP%\0225sb3k.4c4\default\preferences
- from %TEMP%\0225sb3k.4c4\default\local extension settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\local extension settings\jdiccldimpdaibmpdkjnbmckianbfold\current
- from %TEMP%\0225sb3k.4c4\default\extension state\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\extension state\current
- from %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\9a0b6914-e511-4107-a337-4ea859d15bd7.tmp to %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\network persistent state
- from %TEMP%\0225sb3k.4c4\default\session storage\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\session storage\current
- from %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\session storage\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\session storage\current
- from %TEMP%\0225sb3k.4c4\default\data_reduction_proxy_leveldb\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\data_reduction_proxy_leveldb\current
- from %TEMP%\0225sb3k.4c4\default\budgetdatabase\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\budgetdatabase\current
- from %TEMP%\0225sb3k.4c4\default\feature engagement tracker\eventdb\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\feature engagement tracker\eventdb\current
- from %TEMP%\0225sb3k.4c4\default\feature engagement tracker\availabilitydb\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\feature engagement tracker\availabilitydb\current
- from %TEMP%\0225sb3k.4c4\ad blocking\d99b01e4-22f8-4d1a-82ce-98c085df5ad7.tmp to %TEMP%\0225sb3k.4c4\ad blocking\blocklist
- from %TEMP%\0225sb3k.4c4\default\autofillstrikedatabase\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\autofillstrikedatabase\current
- from %TEMP%\0225sb3k.4c4\default\shared_proto_db\metadata\000001.dbtmp to %TEMP%\0225sb3k.4c4\default\shared_proto_db\metadata\current
- from %TEMP%\0225sb3k.4c4\browsermetrics-spare.pma.tmp to %TEMP%\0225sb3k.4c4\browsermetrics-spare.pma
Modifies the following files
- %TEMP%\.ses
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %TEMP%\msedge_installer.log
- %LOCALAPPDATA%\microsoft\edge\user data\crashpad\settings.dat
- %APPDATA%\microsoft\internet explorer\quick launch\microsoft edge.lnk
Substitutes the following files
- %TEMP%\0225sb3k.4c4\crashpadmetrics-active.pma
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\index
- %TEMP%\0225sb3k.4c4\last version
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\data_0
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\data_1
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\data_2
- %TEMP%\0225sb3k.4c4\shadercache\gpucache\data_3
- %TEMP%\0225sb3k.4c4\local state
Network activity
Connects to
- '95.##.238.163':5558
- 'ip##pi.com':80
- '95.##.238.163':5555
- 'localhost':49696
- 'co####.edge.skype.com':443
TCP
HTTP GET requests
- http://ip##pi.com/json/
Other
- '95.##.238.163':5558
- '95.##.238.163':5555
- 'co####.edge.skype.com':443
UDP
- DNS ASK ip##pi.com
- DNS ASK co####.edge.skype.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\0225sb3k.4c4'
Creates and executes the following
- '%TEMP%\05e63bd588df.exe'
- '%LOCALAPPDATA%\mpdefendercorefolder\coreworker_ysrwqyiiaennysq.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute '%LOCALAPPDATA%\MpDefenderCoreFolder\CoreWorker_YSrwQyiIAENnYSq.exe...
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%TEMP%\0225sb3k.4c4" --app=http://127.0.0.1:49696
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%TEMP%\0225sb3k.4c4" --app=http://127.0.0.1:49696 --flag-switches-begin --flag-switches-end --do-not-de-elevate
- '<SYSTEM32>\cmd.exe' /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\MpDefenderCoreFolder'"
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\installer\setup.exe' --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,1720388900152378460,8708256882103599595,131072 --lang=en-US --service-sandbox-type=none --user-d...
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\installer\setup.exe' --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=ch...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%TEMP%\0225sb3k.4c4" --app=http://127.0.0.1:49696 --flag-switches-begin --flag-switches-end --do-not-de-elevate' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute '%LOCALAPPDATA%\MpDefenderCoreFolder\CoreWorker_YSrwQyiIAENnYSq.exe...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\MpDefenderCoreFolder'"' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\installer\setup.exe' --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings' (with hidden window)
