Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'msrgghh' = '%WINDIR%\msrgghh.exe'
- %TEMP%\fje253ioiooihgw6_5hg6.exe
- %TEMP%\2ui9osighgfjah_asgfuire5.txt
- %WINDIR%\msrgghh.exe
- http://ip##pi.com/json/
- http://hf####2.2ihsfa.com/api/fbtime
- DNS ASK ip##pi.com
- DNS ASK fa###ook.com
- DNS ASK hf####2.2ihsfa.com
- '%TEMP%\fje253ioiooihgw6_5hg6.exe' /scookiestxt %TEMP%\2UI9osighGfjaH_ASgfuire5.txt
- '%TEMP%\fje253ioiooihgw6_5hg6.exe' /scookiestxt %TEMP%\2UI9osighGfjaH_ASgfuire5.txt' (with hidden window)