Trojan.Siggen9.57226

• [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ayqcvogr' = '%APPDATA%\ayqcvogr.exe'

• <SYSTEM32>\tasks\nvngxupdatecheckdaily_{78821544-1544-1544-1544-788215441544}

• %TEMP%\4dd3.tmp
• %TEMP%\f3dc.tmp
• %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
• %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
• %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
• %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
• nul
• %APPDATA%\svchost.exe
• %TEMP%\7f5c.tmp.exe
• %APPDATA%\ayqcvogr.exe
• %TEMP%\746e.tmp.exe
• %TEMP%\6de5.tmp.exe
• %TEMP%\63f2.tmp.exe
• %TEMP%\5cec.tmp.exe
• %APPDATA%\awhtssf
• %APPDATA%\vtsfwbc
• %TEMP%\f3dc.tmp-shm
• %TEMP%\f45a.tmp

• %APPDATA%\vtsfwbc
• %APPDATA%\awhtssf

• %TEMP%\746e.tmp.exe
• %TEMP%\f3dc.tmp-shm
• %TEMP%\f3dc.tmp
• %TEMP%\f45a.tmp

'localhost':49678

'localhost':49676

'localhost':49603

'localhost':49673

'localhost':49671

'localhost':49669

'localhost':49667

'localhost':49599

'localhost':49591

'localhost':49663

'localhost':49661

'localhost':49659

'sc####deoblog.com':443

'localhost':49654

'localhost':49680

'localhost':49587

'localhost':49652

'localhost':49650

'localhost':49648

'localhost':49646

'localhost':49644

'localhost':49642

'localhost':49640

'localhost':49638

'localhost':49636

'localhost':49634

'localhost':49632

'al######selectrics.co.uk':443

'localhost':49657

'zo###ngdoms.com':443

'localhost':49682

'ma##.co.il':443

'localhost':49716

'localhost':49714

'sk##its.com':443

'bl###five.com':443

'localhost':49702

'tm##yal.com':443

'localhost':49643

'localhost':49619

'localhost':49655

'localhost':49651

'localhost':49660

'localhost':49647

'localhost':49635

'localhost':49639

'localhost':49627

'localhost':49623

'localhost':49700

'localhost':49698

'st###aday.org':443

'localhost':49695

'localhost':49613

'localhost':49693

'sa##.com.au':443

'na######deindustrial.com':443

'localhost':49691

'localhost':49689

'localhost':49687

'localhost':49685

'localhost':49595

'el##tra.org':443

'localhost':49556

'localhost':49590

'localhost':49584

'localhost':49582

'localhost':49580

'localhost':49578

'localhost':49576

'ge###onyv.com':443

'th####edep365.com':443

'bi######rkandschoolday.org':443

'localhost':49574

'localhost':49572

'al######egardenscapes.com':443

'localhost':49515

'localhost':49568

'localhost':49586

'ce###pro.com':443

'kn######cephotography.com':443

'wh####er-limo.com':443

'ws###house.com':443

'localhost':49519

'localhost':49566

'localhost':49564

'localhost':49562

'localhost':49560

'localhost':49557

'localhost':49509

'localhost':49555

'localhost':49553

'localhost':49551

'au#####lsfarmmarket.com':443

'cd######eeringsolutions.com':443

'bi##man.com':443

'localhost':49592

'localhost':49575

'localhost':49552

'localhost':49583

'localhost':49579

'localhost':49569

'localhost':49626

'localhost':49624

'localhost':49622

'localhost':49620

'localhost':49618

'localhost':49616

'localhost':49612

'yo######mericanhandyman.com':443

'localhost':49718

'cu###dloop.com':443

'localhost':49531

'localhost':49610

'localhost':49565

'localhost':49543

'localhost':49561

'localhost':49547

'localhost':49523

'localhost':49527

'localhost':49602

'localhost':49600

'localhost':49598

'localhost':49596

'localhost':49594

'localhost':49588

'localhost':49425

'cp###tif.com':443

'localhost':49722

'localhost':49836

'tm#s.ro':443

'localhost':49834

'localhost':49832

'st#####ethemartyr.ca':443

'cl####eadvisers.org':443

'localhost':49830

'localhost':49828

'localhost':49826

'localhost':49745

'localhost':49823

'localhost':49821

'localhost':49808

'localhost':49838

'de#####ideenergyinc.com':443

'go.##ewrap.com':443

'localhost':49779

'si####operties.com':443

'localhost':49775

'localhost':49771

'localhost':49791

'localhost':49787

'localhost':49783

'localhost':49759

'localhost':49767

'localhost':49763

'ra####rewers.com':443

'ep######orateconsulting.com':443

'st####ctuale.net':443

'localhost':49859

'localhost':49549

'fa###turk.net':443

'do###ils.com':443

'localhost':49884

'localhost':49882

'localhost':49880

'localhost':49878

'localhost':49876

'localhost':49874

'localhost':49872

'localhost':49870

'localhost':49807

'localhost':49867

'localhost':49865

'localhost':49863

'localhost':49753

'localhost':49861

'localhost':49857

'localhost':49855

'localhost':49853

'localhost':49851

'localhost':49849

'zi##c.org':443

'localhost':49847

're####sprogram.net':443

'localhost':49845

're###lb2b.com':443

'ca####.wpengine.com':443

'localhost':49803

'localhost':49842

'localhost':49840

'ac###-kkr.com':443

'localhost':49749

'localhost':49764

'localhost':49758

'localhost':49754

'localhost':49692

'localhost':49688

'localhost':49752

'localhost':49750

'localhost':49748

'localhost':49746

'localhost':49744

'localhost':49742

'th####rywebs.com':443

'by####ieduff.com':443

'mo##nc.com':443

'localhost':49760

'localhost':49740

'localhost':49736

'localhost':49734

'localhost':49683

'da####ickup.co.uk':443

'cl##lc.us':443

'de###ify.com':443

'localhost':49679

'localhost':49664

'localhost':49674

'localhost':49670

'tb##ico.com':443

'localhost':49726

'localhost':49724

'localhost':49738

'localhost':49720

'ca####agroup.com':443

'localhost':49766

'co###swan.com':443

'sh###riji.com':443

'localhost':49806

'localhost':49804

'localhost':49802

'localhost':49800

'localhost':49727

'localhost':49741

'localhost':49719

'localhost':49723

'localhost':49737

'localhost':49715

'localhost':49701

'th####denusa.com':443

'localhost':49697

'al######usinessgrants.ca':443

'localhost':49790

'localhost':49788

'localhost':49786

'localhost':49784

'localhost':49782

'localhost':49780

'localhost':49778

'localhost':49776

'localhost':49774

'localhost':49772

'localhost':49770

'localhost':49768

'localhost':49762

'localhost':49499

'localhost':49546

'localhost':49500

'localhost':49319

'localhost':49317

'localhost':49315

'localhost':49313

'localhost':49311

'localhost':49309

'fr##met.com':443

'localhost':49290

'localhost':49264

'localhost':49294

'localhost':49278

'ri#####.musicload.de':443

'localhost':49284

'al#####rferroofing.com':443

'localhost':49302

'localhost':49298

'localhost':49296

'localhost':49273

'localhost':49293

'localhost':49291

'localhost':49289

'localhost':49286

'localhost':49241

'localhost':49268

'al###glud.dk':443

'localhost':49283

'localhost':49281

'localhost':49256

'localhost':49300

'fb###ject.net':443

'localhost':49250

'localhost':49299

'localhost':49356

'localhost':49340

'localhost':49350

'za###ite.com':443

'ka#####medica.com.au':443

'ev###ngrace.com':443

'ti###necrm.com':443

'localhost':49332

'localhost':49336

'localhost':49247

'localhost':49324

'localhost':49348

'localhost':49346

'localhost':49260

'localhost':49320

'localhost':49343

'localhost':49341

'localhost':49339

'localhost':49337

'localhost':49335

'localhost':49333

'localhost':49331

'localhost':49329

'pr####yforest.org':443

'localhost':49316

'localhost':49312

'do###onkoss.com':443

'localhost':49303

'localhost':49321

'localhost':49323

'do####aguillard.com':443

'localhost':49231

'localhost':49225

'localhost':49223

'localhost':49200

'localhost':49204

'localhost':49219

'localhost':49217

'localhost':49215

'localhost':49213

'localhost':49211

'localhost':49209

'localhost':49207

'localhost':49205

'localhost':49203

'localhost':49199

'localhost':49227

'localhost':49197

'te##te.in':443

'n2.##jndad.ru':443

'localhost':49192

'bd#s.nu':443

'localhost':49190

'localhost':49189

'localhost':49187

'localhost':49184

'localhost':49181

'localhost':49178

'uu#.#hifink.ru':443

'qz.##pcurnet.ru':443

'localhost':49201

'localhost':49277

'localhost':49275

'localhost':49233

'localhost':49272

'localhost':49270

'localhost':49234

'localhost':49267

'localhost':49265

'localhost':49263

'localhost':49261

'localhost':49259

'su###vsjaj.hr':443

'localhost':49257

'localhost':49254

'my###row.com':443

'localhost':49220

'localhost':49229

'localhost':49252

'localhost':49248

'bi###sgh.com':443

'ro#####epredictor.eu':443

'localhost':49246

'localhost':49244

'localhost':49226

'localhost':49230

'de#######-skoliosezentrum.de':443

'localhost':49240

'localhost':49238

'localhost':49216

'localhost':49208

'localhost':49212

'localhost':49251

'tb###lanet.com':443

'localhost':49886

'localhost':49363

'localhost':49494

'localhost':49492

'gl#####olunteers.org':443

'localhost':49490

'localhost':49488

'localhost':49486

'localhost':49483

'localhost':49444

'localhost':49481

'localhost':49479

'localhost':49477

'localhost':49475

'localhost':49473

'localhost':49496

'localhost':49471

'localhost':49467

'eg###dern.com':443

'ta####fnawab.com':443

'ka####inefalkmd.com':443

'bl####ltcapital.com':443

'localhost':49434

'localhost':49438

'localhost':49430

'localhost':49426

'localhost':49422

'localhost':49460

'localhost':49458

'localhost':49456

'localhost':49469

'localhost':49522

'localhost':49361

'localhost':49461

'localhost':49542

'localhost':49540

'localhost':49495

'localhost':49487

'localhost':49503

'localhost':49474

'localhost':49491

'localhost':49482

'localhost':49478

'localhost':49470

'localhost':49530

'localhost':49528

'localhost':49526

'localhost':49454

'localhost':49524

'localhost':49520

'in######eappealletter.com':443

'localhost':49518

'localhost':49516

'localhost':49514

'localhost':49512

'localhost':49508

'localhost':49448

'localhost':49457

'localhost':49506

'localhost':49502

'ce####podium.com':443

'localhost':49452

'localhost':49498

'localhost':49359

'localhost':49406

'so#####utstudios.com':443

'su###rrie.com':443

'localhost':49405

'localhost':49403

'localhost':49400

'localhost':49382

'localhost':49398

'localhost':49366

'localhost':49395

'localhost':49393

'uc###one.com':443

'localhost':49374

'localhost':49378

'localhost':49370

'dj###one.org':443

'localhost':49362

'localhost':49357

'localhost':49349

'localhost':49385

'localhost':49383

'localhost':49381

'localhost':49379

'localhost':49377

'localhost':49375

'localhost':49373

'localhost':49371

'localhost':49369

'localhost':49367

'localhost':49365

'jo#######tituteforfamilies.org':443

'localhost':49544

'localhost':49449

'localhost':49401

'localhost':49447

'localhost':49445

'ol#####kokbangers.org':443

'localhost':49441

'localhost':49412

'localhost':49416

'localhost':49439

'localhost':49437

'wa#####oneassociate.com':443

'localhost':49435

'localhost':49433

'localhost':49431

'localhost':49429

'localhost':49451

'localhost':49427

'localhost':49423

'localhost':49421

'localhost':49419

'wi####majority.com':443

'ul####teyinzer.com':443

'mi##ire.com':443

'localhost':49344

'localhost':49396

'localhost':49415

'sw#####irthyvasan.com':443

'localhost':49413

'localhost':49411

'localhost':49407

'localhost':49386

'localhost':49888

• DNS ASK 10###########lder1002002131-service1002.space
• DNS ASK na######deindustrial.com
• DNS ASK ma##.co.il
• DNS ASK tm##yal.com
• DNS ASK fi####enporn.com
• DNS ASK de###ify.com
• DNS ASK lo######leduilawyers.com
• DNS ASK cr####eventgps.com
• DNS ASK ne######firm.wpengine.com
• DNS ASK cl##lc.us
• DNS ASK bl###five.com
• DNS ASK cp###tif.com
• DNS ASK tb##ico.com
• DNS ASK ma####echeri.com.au
• DNS ASK la##rma.com
• DNS ASK mo##nc.com
• DNS ASK st###aday.org
• DNS ASK al######egardenscapes.com
• DNS ASK sa##.com.au
• DNS ASK ca####-dining.com
• DNS ASK bi######rkandschoolday.org
• DNS ASK pe####ndkevin.com
• DNS ASK ge###onyv.com
• DNS ASK cu###dloop.com
• DNS ASK bi##man.com
• DNS ASK cd######eeringsolutions.com
• DNS ASK be###vuegp.com
• DNS ASK yo######mericanhandyman.com
• DNS ASK co######ventionlatam.com
• DNS ASK al######selectrics.co.uk
• DNS ASK el##tra.org
• DNS ASK zo###ngdoms.com
• DNS ASK sk##its.com
• DNS ASK ti##wa.com
• DNS ASK sc####deoblog.com
• DNS ASK pl#####-restaurant.com
• DNS ASK ce###pro.com
• DNS ASK da####ickup.co.uk
• DNS ASK ac###-kkr.com
• DNS ASK tm#s.ro
• DNS ASK ay##n.co
• DNS ASK zi##c.org
• DNS ASK do###ils.com
• DNS ASK yo###est.com
• DNS ASK ce###strap.com
• DNS ASK uc###one.com
• DNS ASK bi###shing.com
• DNS ASK em###onrg.com
• DNS ASK li###eaf.com
• DNS ASK de####ageking.com
• DNS ASK ki#####buildervideo.com
• DNS ASK he###ayhub.com
• DNS ASK fu####ionhorus.com
• DNS ASK st#####okkidscenter.com
• DNS ASK ca####.wpengine.com
• DNS ASK th####rywebs.com
• DNS ASK by####ieduff.com
• DNS ASK cl####eadvisers.org
• DNS ASK ra####rewers.com
• DNS ASK th####denusa.com
• DNS ASK ep######orateconsulting.com
• DNS ASK go.##ewrap.com
• DNS ASK si####operties.com
• DNS ASK ca####agroup.com
• DNS ASK sh###riji.com
• DNS ASK co###swan.com
• DNS ASK re####sprogram.net
• DNS ASK st####ctuale.net
• DNS ASK de#####ideenergyinc.com
• DNS ASK st#####ethemartyr.ca
• DNS ASK tb###lanet.com
• DNS ASK fa###turk.net
• DNS ASK al######usinessgrants.ca
• DNS ASK re###lb2b.com
• DNS ASK th####edep365.com
• DNS ASK kn######cephotography.com
• DNS ASK ep###esearch.ch
• DNS ASK my###row.com
• DNS ASK gr###nitamy.com
• DNS ASK sa####harts.info
• DNS ASK la####apeviet.com
• DNS ASK ca###atgc.com
• DNS ASK al###glud.dk
• DNS ASK ig#####.brokentoys.org
• DNS ASK ha#####letattoos.co.za
• DNS ASK da###itar.org
• DNS ASK cy####amarcinek.com
• DNS ASK ri#####.musicload.de
• DNS ASK do###onkoss.com
• DNS ASK fr##met.com
• DNS ASK pr####yforest.org
• DNS ASK bi###sgh.com
• DNS ASK al#####rferroofing.com
• DNS ASK de#######-skoliosezentrum.de
• DNS ASK be###rothers.nl
• DNS ASK 10###########lder1002002231-service1002.space
• DNS ASK 10##########older3100231-service1002.space
• DNS ASK 10###########lder1002002431-service1002.space
• DNS ASK 10###########lder1002002531-service1002.space
• DNS ASK 10##########older33417-01242510022020.space
• DNS ASK 10############5831-service1002012510022020.space
• DNS ASK 10############6831-service1002012510022020.space
• DNS ASK 10############7831-service1002012510022020.space
• DNS ASK qz.##pcurnet.ru
• DNS ASK uu#.#hifink.ru
• DNS ASK k6###847.lib
• DNS ASK bd#s.nu
• DNS ASK n2.##jndad.ru
• DNS ASK te##te.in
• DNS ASK ca#######ealestateoftopsail.com
• DNS ASK ro#####epredictor.eu
• DNS ASK ti###necrm.com
• DNS ASK su###vsjaj.hr
• DNS ASK ka#####medica.com.au
• DNS ASK pu#####ealthlibrary.org
• DNS ASK fa###rfox.com
• DNS ASK eg###dern.com
• DNS ASK gl#####olunteers.org
• DNS ASK qu###tion.cloud
• DNS ASK ce####podium.com
• DNS ASK da###mpieza.com
• DNS ASK pe#####edscatsex.com
• DNS ASK in######eappealletter.com
• DNS ASK ne###ldjon.com
• DNS ASK ws###house.com
• DNS ASK au#####lsfarmmarket.com
• DNS ASK wh####er-limo.com
• DNS ASK tu###hoice.com
• DNS ASK bl####ltcapital.com
• DNS ASK wi####majority.com
• DNS ASK ta####fnawab.com
• DNS ASK ka####inefalkmd.com
• DNS ASK wa#####oneassociate.com
• DNS ASK fb###ject.net
• DNS ASK za###ite.com
• DNS ASK do####aguillard.com
• DNS ASK jo#######tituteforfamilies.org
• DNS ASK ca###rep.com
• DNS ASK bc#o.ca
• DNS ASK ol#####kokbangers.org
• DNS ASK hu###arden.se
• DNS ASK mg##b.co.uk
• DNS ASK bu###tstudio.pl
• DNS ASK ul####teyinzer.com
• DNS ASK su###rrie.com
• DNS ASK so#####utstudios.com
• DNS ASK dj###one.org
• DNS ASK lu##a.dp.ua
• DNS ASK mi##ire.com
• DNS ASK ev###ngrace.com
• DNS ASK sw#####irthyvasan.com
• DNS ASK st#####tyhealthcare.com

• '%TEMP%\5cec.tmp.exe'
• '%TEMP%\63f2.tmp.exe'
• '%TEMP%\6de5.tmp.exe'
• '%TEMP%\746e.tmp.exe'
• '%TEMP%\7f5c.tmp.exe'
• '%APPDATA%\ayqcvogr.exe'
• '%APPDATA%\svchost.exe'

• '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w -n 1 -w3000 > Nul & Del /f /q "%TEMP%\746E.tmp.exe"/f /q "(null)"
• '%WINDIR%\syswow64\explorer.exe'
• '%WINDIR%\explorer.exe'
• '%WINDIR%\syswow64\ping.exe' 1.1.1.1 -n 1 -w -n 1 -w3000
• '%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'