Technical Information
- gnfryto.exe process, Amsi.dll module
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- 'ch####p.dyndns.org':80
- 're####freegeoip.org':443
- 'bp#.com.mx':587
- 're####freegeoip.org':443
- 'bp#.com.mx':587
- DNS ASK ch####p.dyndns.org
- DNS ASK re####freegeoip.org
- DNS ASK bp#.com.mx