Technical Information
- [<HKLM>\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'haleng' = '%HOMEPATH%\AppData'
- %WINDIR%\explorer.exe
- %TEMP%\jfiag3g_gg.exe
- %TEMP%\fj4ghga23_fsa.txt
- %TEMP%\haleng.exe
- %TEMP%\ecvc4a3.tmp
- %ProgramFiles%\UNP\Logs\UpdateNotificationPipeline.001.etl
- http://ip##pi.com/json/
- DNS ASK ip##pi.com
- DNS ASK share.microsoft.com
- DNS ASK fa###ook.com
- DNS ASK go.microsoft.com
- DNS ASK settings-win.data.microsoft.com
- DNS ASK maps.windows.com
- '%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt
- '%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt' (with hidden window)
- '<SYSTEM32>\devicecensus.exe' UserCxt