Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\user data\default\login data
- %LOCALAPPDATA%\user data\default\web data
- %LOCALAPPDATA%\user data\default\cookies
Modifies file system
Creates the following files
- %TEMP%\evb4357.tmp
- %LOCALAPPDATA%\user data\e0e4ccc8-9925-4ec2-9d3e-5f30eb7095d7.tmp
- %TEMP%\evb8358.tmp
- %TEMP%\evb82f9.tmp
- %TEMP%\evb829b.tmp
- %LOCALAPPDATA%\user data\default\web applications\_crx_odlameecjipmbmbejkplpemijjgpljce.ico.md5
- %LOCALAPPDATA%\user data\default\extension state\000003.log
- %LOCALAPPDATA%\user data\default\extension state\log
- %LOCALAPPDATA%\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\user data\default\visited links
- %LOCALAPPDATA%\user data\default\web applications\ae104ff4-4e23-4a27-8151-14e1e9d48def.tmp
- %LOCALAPPDATA%\user data\default\extension rules\log
- %LOCALAPPDATA%\user data\default\extension rules\000001.dbtmp
- %LOCALAPPDATA%\user data\default\extension rules\manifest-000001
- %LOCALAPPDATA%\user data\default\gpucache\data_3
- %LOCALAPPDATA%\user data\default\gpucache\data_2
- %LOCALAPPDATA%\user data\default\gpucache\data_1
- %LOCALAPPDATA%\user data\default\gpucache\data_0
- %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\user data\default\extension rules\000003.log
- %LOCALAPPDATA%\user data\default\gpucache\index
- %LOCALAPPDATA%\user data\default\dd79b042-6026-4c60-8bbe-62c1f7d0f1c6.tmp
- %LOCALAPPDATA%\user data\default\local storage\leveldb\000003.log
- %LOCALAPPDATA%\user data\53ec8e6b-5688-42e7-a2b3-a5e0784a2482.tmp
- %TEMP%\evb46f1.tmp
- %TEMP%\evb4117.tmp
- %TEMP%\evb3bd8.tmp
- %LOCALAPPDATA%\user data\default\b436f5f9-f474-441f-87bc-c707c4ddc831.tmp
- %LOCALAPPDATA%\user data\9c6526fd-cc74-47e1-bc8a-219d264ef575.tmp
- %TEMP%\evb15c4.tmp
- %TEMP%\evbf4e.tmp
- %TEMP%\evb992.tmp
- %LOCALAPPDATA%\user data\default\local storage\leveldb\manifest-000001
- %LOCALAPPDATA%\user data\default\dfd36fb7-0134-45c1-9d77-a0c03e16733b.tmp
- %LOCALAPPDATA%\user data\default\cache\data_3
- %LOCALAPPDATA%\user data\default\cache\data_2
- %LOCALAPPDATA%\user data\default\cache\data_1
- %LOCALAPPDATA%\user data\default\cache\data_0
- %LOCALAPPDATA%\user data\default\cache\index
- %LOCALAPPDATA%\user data\default\cookies
- %LOCALAPPDATA%\user data\default\cookies-journal
- %LOCALAPPDATA%\user data\default\local storage\leveldb\log
- %LOCALAPPDATA%\user data\default\local storage\leveldb\000001.dbtmp
- %LOCALAPPDATA%\user data\a38c3e01-3e93-46a4-9586-a60a298f4cd0.tmp
- %LOCALAPPDATA%\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\user data\shadercache\gpucache\data_3
- %LOCALAPPDATA%\user data\default\top sites-journal
- %LOCALAPPDATA%\user data\default\sync data\leveldb\000001.dbtmp
- %LOCALAPPDATA%\user data\default\sync data\leveldb\manifest-000001
- %LOCALAPPDATA%\user data\default\login data
- %LOCALAPPDATA%\user data\default\154b4953-2efd-4795-9219-141b6f4482c1.tmp
- %LOCALAPPDATA%\user data\default\login data-journal
- %LOCALAPPDATA%\user data\first run
- %LOCALAPPDATA%\user data\default\a4599280-80c8-4937-ae9a-8b91c648c7e5.tmp
- %LOCALAPPDATA%\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\user data\default\readme
- %TEMP%\evb61c0.tmp
- %TEMP%\evb5d6c.tmp
- %LOCALAPPDATA%\user data\stability\1132-1624503235561600.pma
- %LOCALAPPDATA%\user data\browsermetrics\browsermetrics-60d3f3ca-46c.pma
- %LOCALAPPDATA%\nwjs\user data\crashpad\settings.dat
- %LOCALAPPDATA%\nwjs\user data\crashpadmetrics-active.pma
- %TEMP%\evb51c8.tmp
- %TEMP%\evb4cdb.tmp
- %TEMP%\evb4828.tmp
- %TEMP%\evb6615.tmp
- %LOCALAPPDATA%\user data\shadercache\gpucache\index
- %LOCALAPPDATA%\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\user data\default\top sites
- %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %TEMP%\evb6b22.tmp
- %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\user data\default\download service\entrydb\log
- %LOCALAPPDATA%\user data\default\download service\entrydb\000001.dbtmp
- %LOCALAPPDATA%\user data\default\download service\entrydb\manifest-000001
- %TEMP%\evb7514.tmp
- %TEMP%\evb739c.tmp
- %LOCALAPPDATA%\user data\default\favicons
- %TEMP%\evb6f57.tmp
- %LOCALAPPDATA%\user data\default\favicons-journal
- %LOCALAPPDATA%\user data\shadercache\gpucache\data_0
- %LOCALAPPDATA%\user data\shadercache\gpucache\data_2
- %LOCALAPPDATA%\user data\default\history
- %LOCALAPPDATA%\user data\default\web data
- %LOCALAPPDATA%\user data\default\web data-journal
- %LOCALAPPDATA%\user data\default\history-journal
- %LOCALAPPDATA%\user data\shadercache\gpucache\data_1
- %LOCALAPPDATA%\user data\default\thumbnails\log
- %LOCALAPPDATA%\user data\default\thumbnails\000001.dbtmp
- %LOCALAPPDATA%\user data\default\thumbnails\manifest-000001
- %LOCALAPPDATA%\user data\default\70452e64-44b9-417c-8db1-2ea7fd88c28c.tmp
- %LOCALAPPDATA%\user data\browsermetrics-spare.pma.tmp
Deletes the following files
- %TEMP%\evb4357.tmp
- %TEMP%\evb992.tmp
- %TEMP%\evb15c4.tmp
- %LOCALAPPDATA%\user data\local state~rf13190c.tmp
- %LOCALAPPDATA%\user data\default\preferences~rf13192b.tmp
- %TEMP%\evb8358.tmp
- %TEMP%\evb82f9.tmp
- %TEMP%\evb829b.tmp
- %TEMP%\evb7514.tmp
- %TEMP%\evb739c.tmp
- %TEMP%\evb6f57.tmp
- %TEMP%\evbf4e.tmp
- %TEMP%\evb6b22.tmp
- %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\current~rf127686.tmp
- %LOCALAPPDATA%\user data\browsermetrics\browsermetrics-60d3f3ca-46c.pma
- %TEMP%\evb6615.tmp
- %TEMP%\evb61c0.tmp
- %TEMP%\evb5d6c.tmp
- %LOCALAPPDATA%\user data\default\154b4953-2efd-4795-9219-141b6f4482c1.tmp
- %TEMP%\evb51c8.tmp
- %TEMP%\evb4cdb.tmp
- %TEMP%\evb4828.tmp
- %LOCALAPPDATA%\user data\local state~rf12c2d1.tmp
- %LOCALAPPDATA%\user data\local state~rf135f9c.tmp
Moves the following files
- from %LOCALAPPDATA%\user data\default\a4599280-80c8-4937-ae9a-8b91c648c7e5.tmp to %LOCALAPPDATA%\user data\default\google profile.ico
- from %LOCALAPPDATA%\user data\local state to %LOCALAPPDATA%\user data\local state~rf135f9c.tmp
- from %LOCALAPPDATA%\user data\53ec8e6b-5688-42e7-a2b3-a5e0784a2482.tmp to %LOCALAPPDATA%\user data\local state
- from %LOCALAPPDATA%\user data\default\preferences to %LOCALAPPDATA%\user data\default\preferences~rf13192b.tmp
- from %LOCALAPPDATA%\user data\local state to %LOCALAPPDATA%\user data\local state~rf13190c.tmp
- from %LOCALAPPDATA%\user data\default\b436f5f9-f474-441f-87bc-c707c4ddc831.tmp to %LOCALAPPDATA%\user data\default\preferences
- from %LOCALAPPDATA%\user data\9c6526fd-cc74-47e1-bc8a-219d264ef575.tmp to %LOCALAPPDATA%\user data\local state
- from %LOCALAPPDATA%\user data\local state to %LOCALAPPDATA%\user data\local state~rf12c2d1.tmp
- from %LOCALAPPDATA%\user data\a38c3e01-3e93-46a4-9586-a60a298f4cd0.tmp to %LOCALAPPDATA%\user data\local state
- from %LOCALAPPDATA%\user data\default\local storage\leveldb\000001.dbtmp to %LOCALAPPDATA%\user data\default\local storage\leveldb\current
- from %LOCALAPPDATA%\user data\default\dfd36fb7-0134-45c1-9d77-a0c03e16733b.tmp to %LOCALAPPDATA%\user data\default\preferences
- from %LOCALAPPDATA%\user data\default\dd79b042-6026-4c60-8bbe-62c1f7d0f1c6.tmp to %LOCALAPPDATA%\user data\default\secure preferences
- from %LOCALAPPDATA%\user data\e0e4ccc8-9925-4ec2-9d3e-5f30eb7095d7.tmp to %LOCALAPPDATA%\user data\local state
- from %LOCALAPPDATA%\user data\default\web applications\ae104ff4-4e23-4a27-8151-14e1e9d48def.tmp to %LOCALAPPDATA%\user data\default\web applications\_crx_odlameecjipmbmbejkplpemijjgpljce.ico
- from %LOCALAPPDATA%\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\user data\default\extension state\current
- from %LOCALAPPDATA%\user data\default\extension rules\000001.dbtmp to %LOCALAPPDATA%\user data\default\extension rules\current
- from %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\current to %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\current~rf127686.tmp
- from %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\000002.dbtmp to %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\current
- from %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\current
- from %LOCALAPPDATA%\user data\default\download service\entrydb\000001.dbtmp to %LOCALAPPDATA%\user data\default\download service\entrydb\current
- from %LOCALAPPDATA%\user data\default\thumbnails\000001.dbtmp to %LOCALAPPDATA%\user data\default\thumbnails\current
- from %LOCALAPPDATA%\user data\default\sync data\leveldb\000001.dbtmp to %LOCALAPPDATA%\user data\default\sync data\leveldb\current
- from %LOCALAPPDATA%\user data\default\70452e64-44b9-417c-8db1-2ea7fd88c28c.tmp to %LOCALAPPDATA%\user data\default\network persistent state
- from %LOCALAPPDATA%\user data\browsermetrics-spare.pma.tmp to %LOCALAPPDATA%\user data\browsermetrics-spare.pma
Substitutes the following files
- %LOCALAPPDATA%\user data\default\data_reduction_proxy_leveldb\current
- %LOCALAPPDATA%\user data\local state
- %LOCALAPPDATA%\user data\default\preferences
Network activity
Connects to
- 'cd#.#ootcss.com':443
- 'gs##tic.com':443
TCP
Other
- 'cd#.#ootcss.com':443
- 'gs##tic.com':443
UDP
- DNS ASK cd#.#ootcss.com
- DNS ASK gs##tic.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\User Data'
