Technical Information
- %TEMP%\jfiag3g_gg.exe
- %TEMP%\fj4ghga23_fsa.txt
- %TEMP%\jfiag3g_gg.exe
- %TEMP%\fj4ghga23_fsa.txt
- %TEMP%\jfiag3g_gg.exe
- %TEMP%\fj4ghga23_fsa.txt
- 'ip##pi.com':80
- 'fa###ook.com':443
- http://uy####e.2ihsfa.com/api/fbtime
- 'fa###ook.com':443
- DNS ASK ip##pi.com
- DNS ASK fa###ook.com
- DNS ASK uy####e.2ihsfa.com
- '%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt
- '%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt' (with hidden window)