Technical Information
Malicious functions
Registers BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E6314C9A-F83D-4F7B-3429-628F9A306986}]
Modifies file system
Creates the following files
- %TEMP%\589f77f8\mj57.dat
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\guest\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\guest\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- <LS_APPDATA>\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- <LS_APPDATA>\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- <LS_APPDATA>\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- <LS_APPDATA>\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- <LS_APPDATA>\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- <LS_APPDATA>\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- <LS_APPDATA>\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- <LS_APPDATA>\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\administrator\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- <LS_APPDATA>\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- <LS_APPDATA>\torch\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- <LS_APPDATA>\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- <LS_APPDATA>\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- <LS_APPDATA>\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- <LS_APPDATA>\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- <LS_APPDATA>\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ui4dcmvc@oeoimkdr.net\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ui4dcmvc@oeoimkdr.net\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ui4dcmvc@oeoimkdr.net\content\bg.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ui4dcmvc@oeoimkdr.net\install.rdf
- %ProgramFiles(x86)%\praicechop\axg.dll
- %ProgramFiles(x86)%\praicechop\axg.tlb
- %ProgramFiles(x86)%\praicechop\axg.dat
- %ProgramFiles(x86)%\praicechop\axg.x64.dll
- %PROGRAMDATA%\praicechop\mj57.exe
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- <LS_APPDATA>\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- <LS_APPDATA>\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- %PROGRAMDATA%\praicechop\mj57.dat
- <LS_APPDATA>\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- %TEMP%\589f77f8\axg.tlb
- %TEMP%\589f77f8\axg.dll
- %TEMP%\589f77f8\ui4dcmvc@oeoimkdr.net\content\bg.js
- %TEMP%\589f77f8\ui4dcmvc@oeoimkdr.net\install.rdf
- %TEMP%\589f77f8\ui4dcmvc@oeoimkdr.net\chrome.manifest
- %TEMP%\589f77f8\ui4dcmvc@oeoimkdr.net\bootstrap.js
- %TEMP%\589f77f8\axg.x64.dll
- %TEMP%\589f77f8\oglbpechclebhbckgeaegfhoinlbcbpp\lsdb.js
- %TEMP%\589f77f8\oglbpechclebhbckgeaegfhoinlbcbpp\manifest.json
- %TEMP%\589f77f8\oglbpechclebhbckgeaegfhoinlbcbpp\background.html
- %TEMP%\589f77f8\oglbpechclebhbckgeaegfhoinlbcbpp\x.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- %TEMP%\589f77f8\oglbpechclebhbckgeaegfhoinlbcbpp\content.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- <LS_APPDATA>\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- <LS_APPDATA>\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- <LS_APPDATA>\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- <LS_APPDATA>\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- <LS_APPDATA>\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- <LS_APPDATA>\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- <LS_APPDATA>\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\x.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\background.html
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\content.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\oglbpechclebhbckgeaegfhoinlbcbpp\3.9\manifest.json
- %PROGRAMDATA%\bca5157807e959d2\{fdb962f0-b5b8-9460-d12f-7966e97baa43}.20191023234631
Deletes the following files
- %TEMP%\589f77f8\mj57.dat
- %TEMP%\589f77f8\axg.x64.dll
- %TEMP%\589f77f8\axg.tlb
- %TEMP%\589f77f8\axg.dll
- %TEMP%\589f77f8\ui4dcmvc@oeoimkdr.net\content\bg.js
- %TEMP%\589f77f8\ui4dcmvc@oeoimkdr.net\install.rdf
- %TEMP%\589f77f8\ui4dcmvc@oeoimkdr.net\chrome.manifest
- %TEMP%\589f77f8\ui4dcmvc@oeoimkdr.net\bootstrap.js
- %TEMP%\589f77f8\oglbpechclebhbckgeaegfhoinlbcbpp\lsdb.js
- %TEMP%\589f77f8\oglbpechclebhbckgeaegfhoinlbcbpp\content.js
- %TEMP%\589f77f8\oglbpechclebhbckgeaegfhoinlbcbpp\manifest.json
- %TEMP%\589f77f8\oglbpechclebhbckgeaegfhoinlbcbpp\background.html
- %TEMP%\589f77f8\oglbpechclebhbckgeaegfhoinlbcbpp\x.js
Substitutes the following files
- %PROGRAMDATA%\ntuser.pol
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\praicechop\aXG.x64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\praicechop\aXG.x64.dll"
- '<SYSTEM32>\raserver.exe' /offerraupdate
