We checked up the file HPLJBFIG.DLL and found it hazardous.
The file HPLJBFIG.DLL must be deleted from the system immediately.
Kill the process HPLJBFIG.DLL and remove HPLJBFIG.DLL from the Windows startup.
Malware Analysis of HPLJBFIG.DLL
Full path on a computer: %Local Appdata%\YXPack\hpljbfig.dll
Detected by UnHackMe:
HPLJBFIG.DLL
Default location: %Local Appdata%\YXPack\hpljbfig.dll
Removal Results: Success
Number of reboot: 1
HPLJBFIG.DLL is known as:
Trojan.Themida
HPLJBFIG.DLL hash:
- MD5: 1f8a9ca93a843aa0ea666ee8c8637dca
The file tries to connect to the dangerous web site.
How to quickly detect HPLJBFIG.DLL presence?
![]( "Registry")
Registry:
![]( "Folders")
Folders:
![]( "Files")
Files:
Registry:- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\YXPack: “regsvr32.exe “%Local Appdata%\YXPack\hpljbfig.dll”"
Folders:- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}
- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}\components
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh\4.0.4
- %Local Appdata%\YXPack
Files:- %Appdata%\Microsoft\Protect\S-1-5-21-1659004503-1708537768-1801674531-500\4fcab022-4941-482e-b231-dfa45dfb8802
- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}\chrome.manifest
- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}\components\BroadcastEventService.js
- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}\install.rdf
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh\4.0.4\background.js
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh\4.0.4\content.js
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh\4.0.4\manifest.json
- %Local Appdata%\YXPack\hpljbfig.dll
- %Local Appdata%\YXPack\hpljbfig.txt
- %Temp%\rs.dat
- %Temp%\setup.dat
- %Temp%\xzntotzz.exe