Technical Information
Modifies file system
Creates the following files
- <Full path to file>.dll
- %TEMP%\jgztkhk.tmp
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\lv\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\es_419\messages.json
- %TEMP%\dotnetfxsdk.log
- %LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db-journal
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\fi\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_metadata\verified_contents.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\manifest.json
- %TEMP%\cvrc867.tmp.cvr
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sv\messages.json
- %TEMP%\user.bmp
- %LOCALAPPDATA%\google\chrome\user data\safe browsing extension blacklist
- %LOCALAPPDATA%\adobe\acrobat\dc\shareddataevents
- %LOCALAPPDATA%\google\chrome\user data\default\extension state\lock
- %LOCALAPPDATA%\google\chrome\user data\default\extension state\log.old
- %TEMP%\rgi8564.tmp-tmp
- %LOCALAPPDATA%\google\chrome\user data\default\cache\f_000006
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\hi\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\lt\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\uk\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\16.png
- %LOCALAPPDATA%\adobe\color\acecache11.lst
- %LOCALAPPDATA%\google\chrome\user data\safe browsing download
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\zh_tw\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\no\messages.json
- %TEMP%\dotnetfx.log
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ms\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\hr\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\vi\messages.json
- %TEMP%\adobe_admlogs\adobe_adm.log
- %TEMP%\dd_setuputility.txt
Modifies multiple files.
Deletes itself.
Network activity
Connects to
- '18#.#5.51.183':443
- '18#.#5.51.175':443
- '19#.#10.198.12':443
- '18#.#5.51.180':443
TCP
Other
- '19#.#10.198.12':443
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\rundll32.exe' <Current directory>\YLBNTT~1.DLL,Z <Full path to file>' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' <Current directory>\YLBNTT~1.DLL,Z <Full path to file>
- '%WINDIR%\syswow64\rundll32.exe' <Current directory>\YLBNTT~1.DLL,WiczjBwpAw==
