Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Classes\proctortrack\shell\open\command\] '' = '"%APPDATA%\Verificient\ProctortrackFullOffline.exe" "%1"'
Malicious functions
Searches for windows to
detect virtual machines:
- ClassName: 'VBoxTrayToolWndClass', WindowName: ''
- ClassName: '', WindowName: 'VBoxTrayToolWnd'
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\setup.ex_
- %APPDATA%\verificient\imageformats\is-stj1v.tmp
- %APPDATA%\verificient\imageformats\is-hhqkf.tmp
- %APPDATA%\verificient\imageformats\is-7fehd.tmp
- %APPDATA%\verificient\imageformats\is-pns91.tmp
- %APPDATA%\verificient\imageformats\is-i5iik.tmp
- %APPDATA%\verificient\imageformats\is-0lf3j.tmp
- %APPDATA%\verificient\imageformats\is-ilo11.tmp
- %APPDATA%\verificient\imageformats\is-gvsmc.tmp
- %APPDATA%\verificient\imageformats\is-ts309.tmp
- %APPDATA%\verificient\imageformats\is-1d2et.tmp
- %APPDATA%\verificient\imageformats\is-rsd69.tmp
- %APPDATA%\verificient\imageformats\is-u6jo1.tmp
- %APPDATA%\verificient\imageformats\is-9qcl7.tmp
- %APPDATA%\verificient\imageformats\is-rhebn.tmp
- %APPDATA%\verificient\imageformats\is-gcb5f.tmp
- %APPDATA%\verificient\imageformats\is-ah5l8.tmp
- %APPDATA%\verificient\imageformats\is-mt1vl.tmp
- %APPDATA%\verificient\imageformats\is-gu0sp.tmp
- %APPDATA%\verificient\imageformats\is-njt09.tmp
- %APPDATA%\verificient\platforms\is-1p543.tmp
- %APPDATA%\verificient\imageformats\is-ijk83.tmp
- %APPDATA%\verificient\platforms\is-5k75v.tmp
- %APPDATA%\verificient\platforms\is-m4oj7.tmp
- %APPDATA%\verificient\platforms\is-e4303.tmp
- %APPDATA%\verificient\platforms\is-nhpb4.tmp
- %APPDATA%\verificient\platforms\is-p81hj.tmp
- %APPDATA%\verificient\platforms\is-rma0h.tmp
- %APPDATA%\verificient\platforms\is-48j4v.tmp
- %APPDATA%\verificient\platforms\is-fr82a.tmp
- %APPDATA%\verificient\mediaservice\is-a2ia1.tmp
- %APPDATA%\verificient\mediaservice\is-4r4jk.tmp
- %APPDATA%\verificient\mediaservice\is-lg27p.tmp
- %APPDATA%\verificient\mediaservice\is-i1tls.tmp
- %APPDATA%\verificient\mediaservice\is-q1juh.tmp
- %APPDATA%\verificient\mediaservice\is-v6c2n.tmp
- %APPDATA%\verificient\mediaservice\is-rvlpq.tmp
- %APPDATA%\verificient\mediaservice\is-vepm2.tmp
- %APPDATA%\verificient\mediaservice\is-2hhic.tmp
- %APPDATA%\verificient\imageformats\is-ob836.tmp
- %APPDATA%\verificient\imageformats\is-rrgn5.tmp
- %APPDATA%\verificient\imageformats\is-gae6o.tmp
- %APPDATA%\verificient\is-dujo5.tmp
- %APPDATA%\verificient\is-r831g.tmp
- %APPDATA%\verificient\is-uj9f2.tmp
- %APPDATA%\verificient\is-nelo7.tmp
- %APPDATA%\verificient\is-3lh4a.tmp
- %APPDATA%\verificient\is-9sr8p.tmp
- %APPDATA%\verificient\is-e79dt.tmp
- %APPDATA%\verificient\is-msjfp.tmp
- %APPDATA%\verificient\is-djeud.tmp
- %APPDATA%\verificient\is-nfb46.tmp
- %APPDATA%\verificient\is-p0idj.tmp
- %APPDATA%\verificient\is-t34h4.tmp
- %APPDATA%\verificient\is-su7ag.tmp
- %APPDATA%\verificient\is-gd100.tmp
- %TEMP%\is-smotc.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-smotc.tmp\_isetup\_setup64.tmp
- %TEMP%\is-458v2.tmp\setup.tmp
- %TEMP%\7zipsfx.000\setuptrigger.exe
- %APPDATA%\verificient\is-2ctut.tmp
- %APPDATA%\verificient\is-84klp.tmp
- %APPDATA%\verificient\imageformats\is-sfhhs.tmp
- %APPDATA%\verificient\is-ke563.tmp
- %APPDATA%\verificient\imageformats\is-jlaik.tmp
- %APPDATA%\verificient\imageformats\is-uhjme.tmp
- %APPDATA%\verificient\imageformats\is-ld43e.tmp
- %APPDATA%\verificient\imageformats\is-aoo23.tmp
- %APPDATA%\verificient\imageformats\is-qc0b9.tmp
- %APPDATA%\verificient\imageformats\is-cls4p.tmp
- %APPDATA%\verificient\imageformats\is-m106t.tmp
- %APPDATA%\verificient\imageformats\is-koiaj.tmp
- %APPDATA%\verificient\imageformats\is-gpdic.tmp
- %APPDATA%\verificient\imageformats\is-s0d60.tmp
- %APPDATA%\verificient\imageformats\is-5aaav.tmp
- %APPDATA%\verificient\audio\is-e6f9j.tmp
- %APPDATA%\verificient\audio\is-3eq16.tmp
- %APPDATA%\verificient\audio\is-jkjib.tmp
- %APPDATA%\verificient\is-3c9qr.tmp
- %APPDATA%\verificient\is-i121c.tmp
- %APPDATA%\verificient\is-cqr4u.tmp
- %APPDATA%\verificient\imageformats\is-fj39a.tmp
- %APPDATA%\verificient\unins000.dat
Deletes the following files
- %TEMP%\7zipsfx.000\setup.exe
- %TEMP%\is-smotc.tmp\_isetup\_setup64.tmp
- %TEMP%\is-smotc.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-458v2.tmp\setup.tmp
Moves the following files
- from %TEMP%\7zipsfx.000\setup.ex_ to %TEMP%\7zipsfx.000\setup.exe
- from %APPDATA%\verificient\imageformats\is-stj1v.tmp to %APPDATA%\verificient\imageformats\qwbmpd.dll
- from %APPDATA%\verificient\imageformats\is-hhqkf.tmp to %APPDATA%\verificient\imageformats\qwbmp.dll
- from %APPDATA%\verificient\imageformats\is-7fehd.tmp to %APPDATA%\verificient\imageformats\qtiffd.pdb
- from %APPDATA%\verificient\imageformats\is-pns91.tmp to %APPDATA%\verificient\imageformats\qtiffd.dll
- from %APPDATA%\verificient\imageformats\is-i5iik.tmp to %APPDATA%\verificient\imageformats\qtiff.dll
- from %APPDATA%\verificient\imageformats\is-0lf3j.tmp to %APPDATA%\verificient\imageformats\qtgad.pdb
- from %APPDATA%\verificient\imageformats\is-ilo11.tmp to %APPDATA%\verificient\imageformats\qtgad.dll
- from %APPDATA%\verificient\imageformats\is-ts309.tmp to %APPDATA%\verificient\imageformats\qsvgd.pdb
- from %APPDATA%\verificient\imageformats\is-rrgn5.tmp to %APPDATA%\verificient\imageformats\qwebp.dll
- from %APPDATA%\verificient\imageformats\is-1d2et.tmp to %APPDATA%\verificient\imageformats\qsvgd.dll
- from %APPDATA%\verificient\imageformats\is-rsd69.tmp to %APPDATA%\verificient\imageformats\qsvg.dll
- from %APPDATA%\verificient\imageformats\is-u6jo1.tmp to %APPDATA%\verificient\imageformats\qmngd.pdb
- from %APPDATA%\verificient\imageformats\is-9qcl7.tmp to %APPDATA%\verificient\imageformats\qmngd.dll
- from %APPDATA%\verificient\imageformats\is-rhebn.tmp to %APPDATA%\verificient\imageformats\qmng.dll
- from %APPDATA%\verificient\imageformats\is-gcb5f.tmp to %APPDATA%\verificient\imageformats\qjpegd.pdb
- from %APPDATA%\verificient\imageformats\is-gvsmc.tmp to %APPDATA%\verificient\imageformats\qtga.dll
- from %APPDATA%\verificient\imageformats\is-m106t.tmp to %APPDATA%\verificient\imageformats\qgifd.dll
- from %APPDATA%\verificient\imageformats\is-njt09.tmp to %APPDATA%\verificient\imageformats\qwebpd.dll
- from %APPDATA%\verificient\platforms\is-m4oj7.tmp to %APPDATA%\verificient\platforms\qwindows.dll
- from %APPDATA%\verificient\platforms\is-e4303.tmp to %APPDATA%\verificient\platforms\qoffscreend.pdb
- from %APPDATA%\verificient\platforms\is-nhpb4.tmp to %APPDATA%\verificient\platforms\qoffscreend.dll
- from %APPDATA%\verificient\platforms\is-p81hj.tmp to %APPDATA%\verificient\platforms\qoffscreen.dll
- from %APPDATA%\verificient\platforms\is-rma0h.tmp to %APPDATA%\verificient\platforms\qminimald.pdb
- from %APPDATA%\verificient\platforms\is-48j4v.tmp to %APPDATA%\verificient\platforms\qminimald.dll
- from %APPDATA%\verificient\platforms\is-fr82a.tmp to %APPDATA%\verificient\platforms\qminimal.dll
- from %APPDATA%\verificient\imageformats\is-ah5l8.tmp to %APPDATA%\verificient\imageformats\qjpegd.dll
- from %APPDATA%\verificient\imageformats\is-gu0sp.tmp to %APPDATA%\verificient\imageformats\qwbmpd.pdb
- from %APPDATA%\verificient\mediaservice\is-lg27p.tmp to %APPDATA%\verificient\mediaservice\wmfengine.dll
- from %APPDATA%\verificient\mediaservice\is-i1tls.tmp to %APPDATA%\verificient\mediaservice\qtmedia_audioengined.pdb
- from %APPDATA%\verificient\mediaservice\is-q1juh.tmp to %APPDATA%\verificient\mediaservice\qtmedia_audioengined.dll
- from %APPDATA%\verificient\mediaservice\is-v6c2n.tmp to %APPDATA%\verificient\mediaservice\qtmedia_audioengine.dll
- from %APPDATA%\verificient\mediaservice\is-rvlpq.tmp to %APPDATA%\verificient\mediaservice\dsengined.pdb
- from %APPDATA%\verificient\mediaservice\is-vepm2.tmp to %APPDATA%\verificient\mediaservice\dsengined.dll
- from %APPDATA%\verificient\mediaservice\is-2hhic.tmp to %APPDATA%\verificient\mediaservice\dsengine.dll
- from %APPDATA%\verificient\mediaservice\is-4r4jk.tmp to %APPDATA%\verificient\mediaservice\wmfengined.dll
- from %APPDATA%\verificient\imageformats\is-ijk83.tmp to %APPDATA%\verificient\imageformats\qwebpd.pdb
- from %APPDATA%\verificient\imageformats\is-mt1vl.tmp to %APPDATA%\verificient\imageformats\qjpeg.dll
- from %APPDATA%\verificient\imageformats\is-ob836.tmp to %APPDATA%\verificient\imageformats\qjp2d.pdb
- from %APPDATA%\verificient\imageformats\is-gae6o.tmp to %APPDATA%\verificient\imageformats\qjp2d.dll
- from %APPDATA%\verificient\is-e79dt.tmp to %APPDATA%\verificient\libeay32.dll
- from %APPDATA%\verificient\is-dujo5.tmp to %APPDATA%\verificient\qt5multimediawidgets.dll
- from %APPDATA%\verificient\is-2ctut.tmp to %APPDATA%\verificient\qt5multimedia.dll
- from %APPDATA%\verificient\is-r831g.tmp to %APPDATA%\verificient\qt5gui.dll
- from %APPDATA%\verificient\is-uj9f2.tmp to %APPDATA%\verificient\qt5core.dll
- from %APPDATA%\verificient\is-nelo7.tmp to %APPDATA%\verificient\proctortrackfulloffline.exe
- from %APPDATA%\verificient\is-3lh4a.tmp to %APPDATA%\verificient\msvcr100.dll
- from %APPDATA%\verificient\platforms\is-5k75v.tmp to %APPDATA%\verificient\platforms\qwindowsd.dll
- from %APPDATA%\verificient\is-ke563.tmp to %APPDATA%\verificient\qt5opengl.dll
- from %APPDATA%\verificient\is-msjfp.tmp to %APPDATA%\verificient\icuuc52.dll
- from %APPDATA%\verificient\is-djeud.tmp to %APPDATA%\verificient\icuin52.dll
- from %APPDATA%\verificient\is-nfb46.tmp to %APPDATA%\verificient\icudt52.dll
- from %APPDATA%\verificient\is-p0idj.tmp to %APPDATA%\verificient\avutil-51.dll
- from %APPDATA%\verificient\is-t34h4.tmp to %APPDATA%\verificient\avformat-54.dll
- from %APPDATA%\verificient\is-su7ag.tmp to %APPDATA%\verificient\avcodec-54.dll
- from %APPDATA%\verificient\is-gd100.tmp to %APPDATA%\verificient\unins000.exe
- from %APPDATA%\verificient\is-9sr8p.tmp to %APPDATA%\verificient\msvcp100.dll
- from %APPDATA%\verificient\mediaservice\is-a2ia1.tmp to %APPDATA%\verificient\mediaservice\wmfengined.pdb
- from %APPDATA%\verificient\is-cqr4u.tmp to %APPDATA%\verificient\qt5widgets.dll
- from %APPDATA%\verificient\audio\is-jkjib.tmp to %APPDATA%\verificient\audio\qtaudio_windows.dll
- from %APPDATA%\verificient\is-i121c.tmp to %APPDATA%\verificient\ssleay32.dll
- from %APPDATA%\verificient\imageformats\is-fj39a.tmp to %APPDATA%\verificient\imageformats\qjp2.dll
- from %APPDATA%\verificient\imageformats\is-sfhhs.tmp to %APPDATA%\verificient\imageformats\qicod.pdb
- from %APPDATA%\verificient\imageformats\is-jlaik.tmp to %APPDATA%\verificient\imageformats\qicod.dll
- from %APPDATA%\verificient\imageformats\is-uhjme.tmp to %APPDATA%\verificient\imageformats\qico.dll
- from %APPDATA%\verificient\imageformats\is-ld43e.tmp to %APPDATA%\verificient\imageformats\qicnsd.pdb
- from %APPDATA%\verificient\imageformats\is-aoo23.tmp to %APPDATA%\verificient\imageformats\qicnsd.dll
- from %APPDATA%\verificient\is-3c9qr.tmp to %APPDATA%\verificient\swscale-2.dll
- from %APPDATA%\verificient\imageformats\is-qc0b9.tmp to %APPDATA%\verificient\imageformats\qicns.dll
- from %APPDATA%\verificient\is-84klp.tmp to %APPDATA%\verificient\qt5network.dll
- from %APPDATA%\verificient\imageformats\is-koiaj.tmp to %APPDATA%\verificient\imageformats\qgif.dll
- from %APPDATA%\verificient\imageformats\is-gpdic.tmp to %APPDATA%\verificient\imageformats\qddsd.pdb
- from %APPDATA%\verificient\imageformats\is-s0d60.tmp to %APPDATA%\verificient\imageformats\qddsd.dll
- from %APPDATA%\verificient\imageformats\is-5aaav.tmp to %APPDATA%\verificient\imageformats\qdds.dll
- from %APPDATA%\verificient\audio\is-e6f9j.tmp to %APPDATA%\verificient\audio\qtaudio_windowsd.pdb
- from %APPDATA%\verificient\audio\is-3eq16.tmp to %APPDATA%\verificient\audio\qtaudio_windowsd.dll
- from %APPDATA%\verificient\imageformats\is-cls4p.tmp to %APPDATA%\verificient\imageformats\qgifd.pdb
- from %APPDATA%\verificient\platforms\is-1p543.tmp to %APPDATA%\verificient\platforms\qwindowsd.pdb
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\setuptrigger.exe'
- '%TEMP%\7zipsfx.000\setup.exe' /SILENT /NOCANCEL
- '%TEMP%\is-458v2.tmp\setup.tmp' /SL5="$1D023E,26917773,60928,%TEMP%\7ZipSfx.000\Setup.exe" /SILENT /NOCANCEL
- '%APPDATA%\verificient\proctortrackfulloffline.exe'
- '%TEMP%\7zipsfx.000\setup.exe' /SILENT /NOCANCEL' (with hidden window)
