Trojan.Generic.20013521_3e733861cf

Dynamic Analysis

Payload

Process activity

The Trojan creates the following process(es):

tqgb.exe:2772
WScript.exe:1884
src2011.tmp:3204
src2011.exe:3012
1819.exe:2816
rundll32.exe:2060
%original file name%.exe:2948
mm.exe:2928
regsvr32.exe:3384
regsvr32.exe:3208
xPiSs.exe:3932
mmc.exe:3004
guide.exe:2212
guide.exe:3788

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process WScript.exe:1884 makes changes in the file system.

The Trojan deletes the following file(s):

C:\Windows\1819.exe (0 bytes)
C:\Windows\tem.vbs (0 bytes)

The process src2011.tmp:3204 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\RLDataView.d (438 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-FAS25.tmp (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\is-CTDCH.tmp (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\DirectUI\is-MJGBG.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\jychromeex\res\is-0VP5H.tmp (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-OMIPG.tmp\ISTask.dll (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-J28MR.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\is-01FTN.tmp (57 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\jychromeex\_locales\en\is-VBM9M.tmp (294 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\jychromeex\is-UHB8T.tmp (230 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\jychromeex\is-NCP50.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-20T3A.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-02OSJ.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-C4M25.tmp (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\_metadata\is-TKHO0.tmp (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\jychromeex\is-ILCVQ.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\chrome\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\_metadata\is-1I0SD.tmp (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\jyueservice.exe (208 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\is-KSONF.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\is-HG2NG.tmp (230 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\chrome\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\res\is-CLNBN.tmp (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-O672V.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\chrome\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\_locales\en\is-E1EH3.tmp (294 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\is-4P1TV.tmp (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\jywebHelper. (376 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\chrome\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\_locales\zh_CN\is-9SRI3.tmp (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\chrome\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\is-KM7R2.tmp (230 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\jychromeex\_metadata\is-1CE92.tmp (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-C6MA6.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\chrome\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\is-FPP5R.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\res\is-669ON.tmp (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\jychromeex\res\is-UTB4B.tmp (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-OJM14.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\xmlconfig\is-HBL2N.tmp (663 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\jychromeex\is-PMUMK.tmp (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\_locales\en\is-UGJFV.tmp (294 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\is-42QG3.tmp (4185 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\res\is-R6K8A.tmp (88 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\chromeNativeClient\is-QCFIG.tmp (412 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\is-R4UO6.tmp (13800 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\is-3VJA0.tmp (56 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\chrome\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\is-AMVGA.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\is-Q7MA6.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\DirectUI\is-HJ25S.tmp (594 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\chrome\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\is-ITCRM.tmp (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\is-6G1GU.tmp (3361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\is-8NPD8.tmp (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\is-QPVIT.tmp (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\is-2BM18.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-O9BG9.tmp (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\chrome\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\is-IEEEV.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\jychromeex\_locales\zh_CN\is-8BCSI.tmp (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\is-UNSUO.tmp (11168 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\_metadata\is-2AIAO.tmp (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\is-4159G.tmp (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-I5T5P.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\jychromeex\is-K372N.tmp (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\is-E0HRH.tmp (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\is-AJCA6.tmp (3361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\chrome\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\is-MBJU2.tmp (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-OMIPG.tmp\_isetup\_shfoldr.dll (47 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\chromeNativeClient\is-GF3CF.tmp (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\is-VGUEH.tmp (2105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-BFJBC.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\jychromeex\_metadata\is-I1VK9.tmp (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-KTQ2I.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\xmlconfig\is-NNO2O.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\is-G8HVS.tmp (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\jychromeex\is-JRQE4.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\is-SIQ7T.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\chrome\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\res\is-IH47N.tmp (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\is-N6BD7.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\DirectUI\is-2SP90.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\resource\DirectUI\is-A29B6.tmp (594 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\int2\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\_locales\zh_CN\is-MD2UI.tmp (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\extensions\chrome\hohonaplgfolmdaaafoddgbiakognoal\4.0.2_0\_metadata\is-0H4IE.tmp (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\is-O0M9S.tmp (2321 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-OMIPG.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-OMIPG.tmp\ISTask.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-OMIPG.tmp\_isetup\_shfoldr.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\RLDataView.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-OMIPG.tmp\_isetup (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\473213\jywebHelper.dll (0 bytes)

The process src2011.exe:3012 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-AC6LT.tmp\src2011.tmp (1423 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-AC6LT.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-AC6LT.tmp\src2011.tmp (0 bytes)

The process 1819.exe:2816 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Windows\kBqJzF\MIJ.exe (108 bytes)
C:\Windows\Media\McIe.wav (17 bytes)
C:\Windows\Media\Mcfg.wav (1 bytes)
C:\Windows\tem.vbs (169 bytes)
C:\Windows\kBqJzF\BPp.exe (108 bytes)
C:\Windows\pcq.exe (108 bytes)
C:\Windows\onest.txt (1 bytes)
C:\Windows\kBqJzF\LiveUDHelper.dll (1 bytes)
C:\Windows\mcconfig.dat (2 bytes)
C:\Windows\kBqJzF\G57.exe (108 bytes)
C:\Windows\kBqJzF\PTR.exe (108 bytes)
C:\Windows\kBqJzF\xPiSs.exe (218 bytes)
C:\Windows\Media\hd.wav (1 bytes)
C:\Windows\kBqJzF\27e.exe (108 bytes)
C:\Windows\kBqJzF\Dqc.exe (108 bytes)
C:\Windows\kBqJzF\drH.exe (108 bytes)

The process rundll32.exe:2060 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\GameExplorer\{259407C2-8FA0-425C-9A68-FD1873827037}\PlayTasks\0\Play.lnk (756 bytes)

&with

&action

&action

&clientType&clientVersion

<><><><><><><><><><><><><><><><><>

<&<&>&&Iz....g7<<&F.t.V..3..w...4.o.m>&&&>

<<<>>>

<><><><><><><><><><><><><><><><><><><><><><>

&action

<><><><><><><><><><><><><><><><><><><><><><><><><><>

<><><><><><><><><><><><><><><><><><><><><><>

&action

<><><><><><><><><><><><><><><><><><><><><><><><><><>

<><><><><><><><><><><><><><><><><><><><><><>

&action

<><><><><><><><><><><><><><><><><><><><><><><><><><>

&mac&pid&did&mid

&mac&pid&did&mid

&action

&action

&<&&J..&><

<><><><><><><><><><><><>

&

<<<>>>

<<

<<<>>>

&locale&clientType&clientVersion

&clientType&clientVersion

&clientType&clientVersion

&version&source&uuid

&version&source&uuid

<<<>>>

&version&source&uuid

&url&url

&action

&action

>

<<<>>>

<><><><><><><>><><><><><><><><><>

<<<>>>

<><><><><><><>><><><><><><><><><>

<<<>>>

<&&&>>&&&<<&&&<

<<<>>>

&mac

&mac

&

&

&

&

&

&

&

&

&

&