Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{Add-MpPreference -ExclusionPath '%TEMP%\w68fdfd8d' -ErrorAction SilentlyContinue}catch{};try{Add-MpPreference -ExclusionProcess '' -...
Executes the following
- '<SYSTEM32>\taskkill.exe' /PID 2856 /T /F
- '<SYSTEM32>\taskkill.exe' /PID 360 /T /F
- '<SYSTEM32>\taskkill.exe' /F /IM msedge.exe /T
- '<SYSTEM32>\taskkill.exe' /PID 3624 /T /F
- '<SYSTEM32>\taskkill.exe' /PID 2120 /T /F
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\w68fdfd8d\e3c3623c2d064b9e8e8bb080e082cec5.db
- %TEMP%\w68fdfd8d\6afd598c6c624b5cba88a19235c261c3.db
- %TEMP%\w68fdfd8d\dff60c765b32478fb2d29bbf335d2226.db
- %TEMP%\w68fdfd8d\bec29694f81e42f882cf171b11c4a925.db
- %TEMP%\w68fdfd8d\81e51a1abf3e468181749fe25a8ebf98.db
- %TEMP%\w68fdfd8d\4ff231c2dccd41a9b12cfd0ab5168aea.db
- %TEMP%\w68fdfd8d\a01883e04b9c49ee8afd562d3e2ce1df.db
- %TEMP%\w68fdfd8d\c7aaa28\local state
- %TEMP%\w68fdfd8d\c7aaa28\default\edge profile.ico
- %TEMP%\w68fdfd8d\c7aaa28\default\favicons
- %TEMP%\w68fdfd8d\c7aaa28\default\heavy_ad_intervention_opt_out.db
- %TEMP%\w68fdfd8d\c7aaa28\default\history
- %TEMP%\w68fdfd8d\c7aaa28\default\login data
- %TEMP%\w68fdfd8d\c7aaa28\default\media history
- %TEMP%\w68fdfd8d\c7aaa28\default\network persistent state
- %TEMP%\w68fdfd8d\c7aaa28\default\preferences
- %TEMP%\w68fdfd8d\c7aaa28\default\preferredapps
- %TEMP%\w68fdfd8d\c7aaa28\default\previews_opt_out.db
- %TEMP%\w68fdfd8d\c7aaa28\default\readme
- %TEMP%\w68fdfd8d\c7aaa28\default\secure preferences
- %TEMP%\w68fdfd8d\c7aaa28\default\top sites
- %TEMP%\w68fdfd8d\c7aaa28\default\visited links
- %TEMP%\w68fdfd8d\c7aaa28\default\web data
- %TEMP%\w68fdfd8d\c7aaa28\default\budgetdatabase\current
- %TEMP%\w68fdfd8d\c7aaa28\default\budgetdatabase\log
- %TEMP%\w68fdfd8d\c7aaa28\default\budgetdatabase\manifest-000001
- %TEMP%\w68fdfd8d\c7aaa28\default\data_reduction_proxy_leveldb\current
- %TEMP%\w68fdfd8d\c7aaa28\default\data_reduction_proxy_leveldb\log
- %TEMP%\w68fdfd8d\c7aaa28\default\data_reduction_proxy_leveldb\manifest-000002
- %TEMP%\w68fdfd8d\c7aaa28\default\local storage\leveldb\current
- %TEMP%\w68fdfd8d\c7aaa28\default\local storage\leveldb\log
- %TEMP%\w68fdfd8d\c7aaa28\default\local storage\leveldb\manifest-000001
- %TEMP%\w68fdfd8d\c7aaa28\default\platform notifications\current
- %TEMP%\w68fdfd8d\c7aaa28\default\platform notifications\log
- %TEMP%\w68fdfd8d\c7aaa28\default\platform notifications\manifest-000001
- %TEMP%\w68fdfd8d\c7aaa28\default\shared_proto_db\metadata\000003.log
- %TEMP%\w68fdfd8d\c7aaa28\default\shared_proto_db\metadata\current
- %TEMP%\w68fdfd8d\c7aaa28\default\shared_proto_db\metadata\log
- %TEMP%\w68fdfd8d\c7aaa28\default\shared_proto_db\metadata\manifest-000001
- %TEMP%\w68fdfd8d\c7aaa28\default\site characteristics database\000003.log
- %TEMP%\w68fdfd8d\c7aaa28\default\site characteristics database\current
- %TEMP%\w68fdfd8d\c7aaa28\default\site characteristics database\log
- %TEMP%\w68fdfd8d\c7aaa28\default\site characteristics database\log.old
- %TEMP%\w68fdfd8d\c7aaa28\default\site characteristics database\manifest-000001
- %TEMP%\w68fdfd8d\c7aaa28\default\sync data\leveldb\000003.log
- %TEMP%\w68fdfd8d\c7aaa28\default\sync data\leveldb\current
- %TEMP%\w68fdfd8d\c7aaa28\default\sync data\leveldb\log
- %TEMP%\w68fdfd8d\c7aaa28\default\sync data\leveldb\log.old
- %TEMP%\w68fdfd8d\c7aaa28\default\sync data\leveldb\manifest-000001
- %TEMP%\w68fdfd8d\c7aaa28\crashpad\settings.dat
- %TEMP%\w68fdfd8d\c7aaa28\crashpad\throttle_store.dat
- %TEMP%\w68fdfd8d\c7aaa28\crashpadmetrics-active.pma
- %TEMP%\w68fdfd8d\c7aaa28\default\gpucache\index
- %TEMP%\w68fdfd8d\c7aaa28\devtoolsactiveport
- %TEMP%\w68fdfd8d\c7aaa28\default\chrome_debug.log
- %TEMP%\w68fdfd8d\c7aaa28\default\gpucache\data_0
- %TEMP%\w68fdfd8d\c7aaa28\default\gpucache\data_1
- %TEMP%\w68fdfd8d\c7aaa28\default\gpucache\data_2
- %TEMP%\w68fdfd8d\c7aaa28\default\gpucache\data_3
- %TEMP%\w68fdfd8d\c7aaa28\default\code cache\wasm\index
- %TEMP%\w68fdfd8d\c7aaa28\default\code cache\js\index
- %TEMP%\w68fdfd8d\c7aaa28\default\code cache\wasm\index-dir\temp-index
- %TEMP%\w68fdfd8d\c7aaa28\default\code cache\js\index-dir\temp-index
- %TEMP%\w68fdfd8d\c7aaa28\default\cookies-journal
- %TEMP%\w68fdfd8d\c7aaa28\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\devtoolsactiveport
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\chrome_debug.log
- %TEMP%\w68fdfd8d\c8f432229ac4457ca1bd413846ea99fa.db
- %TEMP%\w68fdfd8d\a5c5f6bd9b384d3aa4bc2cc4c7ac36fc.db
- %TEMP%\w68fdfd8d\a11f767748274ad982a1093863b8d890.db
- %TEMP%\w68fdfd8d\db6e04e67b374a5681462329c10251c6.db
- %TEMP%\w68fdfd8d\logs\passwords.txt
- %TEMP%\w68fdfd8d\logs\cookies.txt
- %TEMP%\w68fdfd8d\logs\google_cookies.txt
- %TEMP%\w68fdfd8d\logs\cards.txt
- %TEMP%\w68fdfd8d\logs\mail_accounts.txt
- %TEMP%\w68fdfd8d\logs\mail_cookies.txt
- %TEMP%\w68fdfd8d\logs\roblox.txt
- %TEMP%\w68fdfd8d\logs\discord.txt
- %TEMP%\w68fdfd8d\logs\system.txt
- %TEMP%\w68fdfd8d\logs\wifi.txt
- %TEMP%\w68fdfd8d\logs\ftp.txt
- %TEMP%\w68fdfd8d\logs\minecraft.txt
- %TEMP%\w68fdfd8d\logs\desktop.png
- %TEMP%\w68fdfd8d\logs\report.json
- %TEMP%\w68fdfd8d\full_user_fnehqlnzj_20261022_200524.zip
- %TEMP%\w68fdfd8d\focus\passwords.txt
- %TEMP%\w68fdfd8d\focus\cookies.txt
- %TEMP%\w68fdfd8d\focus\google_cookies.txt
- %TEMP%\w68fdfd8d\accounts_user_fnehqlnzj_20261022_200524.zip
Deletes following files that it created itself
- %TEMP%\w68fdfd8d\e3c3623c2d064b9e8e8bb080e082cec5.db
- %TEMP%\w68fdfd8d\6afd598c6c624b5cba88a19235c261c3.db
- %TEMP%\w68fdfd8d\dff60c765b32478fb2d29bbf335d2226.db
- %TEMP%\w68fdfd8d\bec29694f81e42f882cf171b11c4a925.db
- %TEMP%\w68fdfd8d\81e51a1abf3e468181749fe25a8ebf98.db
- %TEMP%\w68fdfd8d\4ff231c2dccd41a9b12cfd0ab5168aea.db
- %TEMP%\w68fdfd8d\a01883e04b9c49ee8afd562d3e2ce1df.db
- %TEMP%\w68fdfd8d\c7aaa28\default\chrome_debug.log
- %TEMP%\w68fdfd8d\c7aaa28\crashpad\settings.dat
- %TEMP%\w68fdfd8d\c7aaa28\crashpad\throttle_store.dat
- %TEMP%\w68fdfd8d\c7aaa28\crashpadmetrics.pma
- %TEMP%\w68fdfd8d\c7aaa28\default\budgetdatabase\current
- %TEMP%\w68fdfd8d\c7aaa28\default\budgetdatabase\log
- %TEMP%\w68fdfd8d\c7aaa28\default\budgetdatabase\manifest-000001
- %TEMP%\w68fdfd8d\c7aaa28\default\code cache\js\index
- %TEMP%\w68fdfd8d\c7aaa28\default\code cache\js\index-dir\the-real-index
- %TEMP%\w68fdfd8d\c7aaa28\default\code cache\wasm\index
- %TEMP%\w68fdfd8d\c7aaa28\default\code cache\wasm\index-dir\the-real-index
- %TEMP%\w68fdfd8d\c7aaa28\default\cookies
- %TEMP%\w68fdfd8d\c7aaa28\default\cookies-journal
- %TEMP%\w68fdfd8d\c7aaa28\default\data_reduction_proxy_leveldb\current
- %TEMP%\w68fdfd8d\c7aaa28\default\data_reduction_proxy_leveldb\log
- %TEMP%\w68fdfd8d\c7aaa28\default\data_reduction_proxy_leveldb\manifest-000002
- %TEMP%\w68fdfd8d\c7aaa28\default\edge profile.ico
- %TEMP%\w68fdfd8d\c7aaa28\default\favicons
- %TEMP%\w68fdfd8d\c7aaa28\default\gpucache\data_0
- %TEMP%\w68fdfd8d\c7aaa28\default\gpucache\data_1
- %TEMP%\w68fdfd8d\c7aaa28\default\gpucache\data_2
- %TEMP%\w68fdfd8d\c7aaa28\default\gpucache\data_3
- %TEMP%\w68fdfd8d\c7aaa28\default\gpucache\index
- %TEMP%\w68fdfd8d\c7aaa28\default\heavy_ad_intervention_opt_out.db
- %TEMP%\w68fdfd8d\c7aaa28\default\history
- %TEMP%\w68fdfd8d\c7aaa28\default\local storage\leveldb\current
- %TEMP%\w68fdfd8d\c7aaa28\default\local storage\leveldb\log
- %TEMP%\w68fdfd8d\c7aaa28\default\local storage\leveldb\manifest-000001
- %TEMP%\w68fdfd8d\c7aaa28\default\login data
- %TEMP%\w68fdfd8d\c7aaa28\default\media history
- %TEMP%\w68fdfd8d\c7aaa28\default\network persistent state
- %TEMP%\w68fdfd8d\c7aaa28\default\platform notifications\current
- %TEMP%\w68fdfd8d\c7aaa28\default\platform notifications\log
- %TEMP%\w68fdfd8d\c7aaa28\default\platform notifications\manifest-000001
- %TEMP%\w68fdfd8d\c7aaa28\default\preferences
- %TEMP%\w68fdfd8d\c7aaa28\default\preferredapps
- %TEMP%\w68fdfd8d\c7aaa28\default\previews_opt_out.db
- %TEMP%\w68fdfd8d\c7aaa28\default\readme
- %TEMP%\w68fdfd8d\c7aaa28\default\secure preferences
- %TEMP%\w68fdfd8d\c7aaa28\default\shared_proto_db\metadata\000003.log
- %TEMP%\w68fdfd8d\c7aaa28\default\shared_proto_db\metadata\current
- %TEMP%\w68fdfd8d\c7aaa28\default\shared_proto_db\metadata\log
- %TEMP%\w68fdfd8d\c7aaa28\default\shared_proto_db\metadata\manifest-000001
- %TEMP%\w68fdfd8d\c7aaa28\default\site characteristics database\000003.log
- %TEMP%\w68fdfd8d\c7aaa28\default\site characteristics database\current
- %TEMP%\w68fdfd8d\c7aaa28\default\site characteristics database\log
- %TEMP%\w68fdfd8d\c7aaa28\default\site characteristics database\log.old
- %TEMP%\w68fdfd8d\c7aaa28\default\site characteristics database\manifest-000001
- %TEMP%\w68fdfd8d\c7aaa28\default\sync data\leveldb\000003.log
- %TEMP%\w68fdfd8d\c7aaa28\default\sync data\leveldb\current
- %TEMP%\w68fdfd8d\c7aaa28\default\sync data\leveldb\log
- %TEMP%\w68fdfd8d\c7aaa28\default\sync data\leveldb\log.old
- %TEMP%\w68fdfd8d\c7aaa28\default\sync data\leveldb\manifest-000001
- %TEMP%\w68fdfd8d\c7aaa28\default\top sites
- %TEMP%\w68fdfd8d\c7aaa28\default\visited links
- %TEMP%\w68fdfd8d\c7aaa28\default\web data
- %TEMP%\w68fdfd8d\c7aaa28\devtoolsactiveport
- %TEMP%\w68fdfd8d\c7aaa28\local state
- %LOCALAPPDATA%\microsoft\edge\user data\default\chrome_debug.log
- %TEMP%\w68fdfd8d\c8f432229ac4457ca1bd413846ea99fa.db
- %TEMP%\w68fdfd8d\a5c5f6bd9b384d3aa4bc2cc4c7ac36fc.db
- %TEMP%\w68fdfd8d\a11f767748274ad982a1093863b8d890.db
- %TEMP%\w68fdfd8d\db6e04e67b374a5681462329c10251c6.db
Moves the following files
- from %TEMP%\w68fdfd8d\c7aaa28\default\code cache\wasm\index-dir\temp-index to %TEMP%\w68fdfd8d\c7aaa28\default\code cache\wasm\index-dir\the-real-index
- from %TEMP%\w68fdfd8d\c7aaa28\default\code cache\js\index-dir\temp-index to %TEMP%\w68fdfd8d\c7aaa28\default\code cache\js\index-dir\the-real-index
- from %TEMP%\w68fdfd8d\c7aaa28\crashpadmetrics-active.pma to %TEMP%\w68fdfd8d\c7aaa28\crashpadmetrics.pma
Substitutes the following files
- %TEMP%\w68fdfd8d\c7aaa28\crashpadmetrics-active.pma
- %TEMP%\w68fdfd8d\c7aaa28\default\chrome_debug.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\chrome_debug.log
Network activity
Connects to
- 'ip##pi.com':80
- 'localhost':49697
- 'localhost':49706
- 'localhost':49711
- 'localhost':49717
- 'ap#.##legram.org':443
TCP
HTTP GET requests
- http://ip##pi.com/json/?fi#############################################
Other
- 'localhost':49702
- 'localhost':49703
- 'localhost':49708
- 'localhost':49709
- 'localhost':49714
- 'localhost':49715
- 'localhost':49720
- 'localhost':49721
UDP
- DNS ASK ip##pi.com
- DNS ASK ap#.##legram.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{Add-MpPreference -ExclusionPath '%TEMP%\w68fdfd8d' -ErrorAction SilentlyContinue}catch{};try{Add-MpPreference -Exclusi...
- '<SYSTEM32>\cmd.exe' /c cmd.exe /c attrib +h +s "%TEMP%\w68fdfd8d"
- '<SYSTEM32>\cmd.exe' /c attrib +h +s "%TEMP%\w68fdfd8d"
- '<SYSTEM32>\attrib.exe' +h +s "%TEMP%\w68fdfd8d"
- '<SYSTEM32>\robocopy.exe' "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default" "%TEMP%\w68fdfd8d\c7aaa28\Default" /E /NFL /NDL /NJH /NJS /NP /R:0 /W:0 /XD "Cache" "Code Cache" "GPUCache" "DawnCache" "DawnGraphiteCache" "Da...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%TEMP%\w68fdfd8d\c7aaa28" --profile-directory="Default" --remote-debugging-port=49697 --remote-allow-origins=* --headless=new --no-first-run --no-default-browser-check --disabl...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%TEMP%\w68fdfd8d\c7aaa28" --profile-directory="Default" --remote-debugging-port=49706 --remote-allow-origins=* --headless --no-first-run --no-default-browser-check --disable-gp...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%LOCALAPPDATA%\Microsoft\Edge\User Data" --profile-directory="Default" --remote-debugging-port=49711 --remote-allow-origins=* --headless=new --no-first-run --no-default-browser...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%LOCALAPPDATA%\Microsoft\Edge\User Data" --profile-directory="Default" --remote-debugging-port=49717 --remote-allow-origins=* --headless --no-first-run --no-default-browser-che...
- '<SYSTEM32>\cmdkey.exe' /list
- '<SYSTEM32>\netsh.exe' wlan show profiles
