Technical Information
Malicious functions
Registers BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7FB63527-AD50-9FAD-43E5-F3C2243AF66D}]
Modifies file system
Creates the following files
- %TEMP%\6db379dc\kj1v6rd1.dat
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\guest\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\guest\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- %LOCALAPPDATA%\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- %LOCALAPPDATA%\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- %LOCALAPPDATA%\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\administrator\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- %LOCALAPPDATA%\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- %LOCALAPPDATA%\torch\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\cwdfoau@oqp-.edu\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\cwdfoau@oqp-.edu\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\cwdfoau@oqp-.edu\content\bg.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\cwdfoau@oqp-.edu\install.rdf
- %ProgramFiles(x86)%\goisavve\ckvaypl.dll
- %ProgramFiles(x86)%\goisavve\ckvaypl.tlb
- %ProgramFiles(x86)%\goisavve\ckvaypl.dat
- %ProgramFiles(x86)%\goisavve\ckvaypl.x64.dll
- %ALLUSERSPROFILE%\goisavve\kj1v6rd1.exe
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- %ALLUSERSPROFILE%\goisavve\kj1v6rd1.dat
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- %TEMP%\6db379dc\ckvaypl.tlb
- %TEMP%\6db379dc\ckvaypl.dll
- %TEMP%\6db379dc\cwdfoau@oqp-.edu\content\bg.js
- %TEMP%\6db379dc\cwdfoau@oqp-.edu\install.rdf
- %TEMP%\6db379dc\cwdfoau@oqp-.edu\chrome.manifest
- %TEMP%\6db379dc\cwdfoau@oqp-.edu\bootstrap.js
- %TEMP%\6db379dc\ckvaypl.x64.dll
- %TEMP%\6db379dc\boobleplcedfifabdjnclndmimchgeom\lsdb.js
- %TEMP%\6db379dc\boobleplcedfifabdjnclndmimchgeom\manifest.json
- %TEMP%\6db379dc\boobleplcedfifabdjnclndmimchgeom\background.html
- %TEMP%\6db379dc\boobleplcedfifabdjnclndmimchgeom\uqf4tfi4r.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- %TEMP%\6db379dc\boobleplcedfifabdjnclndmimchgeom\content.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\uqf4tfi4r.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\background.html
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\content.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\boobleplcedfifabdjnclndmimchgeom\2.0\manifest.json
- %ALLUSERSPROFILE%\ed7c87e580bfaeea\{c87834eb-a2a0-b9d4-aa9a-c263d1191051}.20220920214837
Deletes the following files
- %TEMP%\6db379dc\kj1v6rd1.dat
- %TEMP%\6db379dc\ckvaypl.x64.dll
- %TEMP%\6db379dc\ckvaypl.tlb
- %TEMP%\6db379dc\ckvaypl.dll
- %TEMP%\6db379dc\cwdfoau@oqp-.edu\content\bg.js
- %TEMP%\6db379dc\cwdfoau@oqp-.edu\install.rdf
- %TEMP%\6db379dc\cwdfoau@oqp-.edu\chrome.manifest
- %TEMP%\6db379dc\cwdfoau@oqp-.edu\bootstrap.js
- %TEMP%\6db379dc\boobleplcedfifabdjnclndmimchgeom\lsdb.js
- %TEMP%\6db379dc\boobleplcedfifabdjnclndmimchgeom\content.js
- %TEMP%\6db379dc\boobleplcedfifabdjnclndmimchgeom\manifest.json
- %TEMP%\6db379dc\boobleplcedfifabdjnclndmimchgeom\background.html
- %TEMP%\6db379dc\boobleplcedfifabdjnclndmimchgeom\uqf4tfi4r.js
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\local state
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
Substitutes the following files
- %ALLUSERSPROFILE%\ntuser.pol
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\GoiSavve\CKVAYPl.x64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\GoiSavve\CKVAYPl.x64.dll"
- '<SYSTEM32>\raserver.exe' /offerraupdate
