Technical Information
Malicious functions
Patches code
in dll
- mzurx.exe process, KERNELBASE.dll module
- mzurx.exe process, KERNEL32.dll module
Registers BHO
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dff7d79d-df02-4701-a3d1-71235d3842aa}]
Modifies file system
Creates the following files
- %TEMP%\122d1480\txr1qildujmscrf.dat
- %TEMP%\122d1480\tvjwfvzxpukk6o.dll
- %TEMP%\122d1480\tvjwfvzxpukk6o.tlb
- %TEMP%\122d1480\tvjwfvzxpukk6o.x64.dll
- %TEMP%\122d1480\9j@wmv0xca.com\content\bg.js
- %TEMP%\122d1480\9j@wmv0xca.com\bootstrap.js
- %TEMP%\122d1480\9j@wmv0xca.com\chrome.manifest
- %TEMP%\122d1480\9j@wmv0xca.com\install.rdf
- %TEMP%\122d1480\emmmldachglonielcnddkcoffkgbfeld\xfnq4qs7x.js
- %TEMP%\122d1480\emmmldachglonielcnddkcoffkgbfeld\background.html
- %TEMP%\122d1480\emmmldachglonielcnddkcoffkgbfeld\manifest.json
- %TEMP%\122d1480\emmmldachglonielcnddkcoffkgbfeld\content.js
- %TEMP%\122d1480\emmmldachglonielcnddkcoffkgbfeld\lsdb.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\wdagutilityaccount\appdata\local\google\chrome\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\wdagutilityaccount\appdata\local\comodo\dragon\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\wdagutilityaccount\appdata\local\google\chrome sxs\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\administrator\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\administrator\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\guest\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\guest\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- %LOCALAPPDATA%\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- %LOCALAPPDATA%\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- %LOCALAPPDATA%\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- %LOCALAPPDATA%\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- %LOCALAPPDATA%\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\wdagutilityaccount\appdata\local\torch\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\defaultaccount\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\background.html
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\content.js
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\lsdb.js
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\manifest.json
- C:\users\wdagutilityaccount\appdata\local\chromatic browser\user data\default\extensions\emmmldachglonielcnddkcoffkgbfeld\2.0\xfnq4qs7x.js
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- <SYSTEM32>\grouppolicy\machine\registry.pol
- <SYSTEM32>\grouppolicy\gpt.ini
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions\staged\9j@wmv0xca.com\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions\staged\9j@wmv0xca.com\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions\staged\9j@wmv0xca.com\content\bg.js
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions\staged\9j@wmv0xca.com\install.rdf
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\extensions\staged\9j@wmv0xca.com\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\extensions\staged\9j@wmv0xca.com\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\extensions\staged\9j@wmv0xca.com\content\bg.js
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\extensions\staged\9j@wmv0xca.com\install.rdf
- %ProgramFiles(x86)%\gossave\tvjwfvzxpukk6o.dll
- %ProgramFiles(x86)%\gossave\tvjwfvzxpukk6o.tlb
- %ProgramFiles(x86)%\gossave\tvjwfvzxpukk6o.dat
- %ProgramFiles(x86)%\gossave\tvjwfvzxpukk6o.x64.dll
- %ALLUSERSPROFILE%\gossave\txr1qildujmscrf.exe
- %ALLUSERSPROFILE%\gossave\txr1qildujmscrf.dat
- %ALLUSERSPROFILE%\5d71f4506a58037a\{c87834eb-a2a0-b9d4-aa9a-c263d1191051}.20260301190538
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\local state
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
Miscellaneous
Executes the following
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s fhsvc
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -s WPDBusEnum
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\GOSSave\tvJwfVZxpUkK6o.x64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\GOSSave\tvJwfVZxpUkK6o.x64.dll"