Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\FixMe.IT Client Service:103e0fe1-dc0f-40ed-9728-e9f2f7c58847] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\FixMe.IT Client Service:103e0fe1-dc0f-40ed-9728-e9f2f7c58847] 'ImagePath' = '"%TEMP%\Techinline\Ti16790\TiClientCoreLauncher.exe" -LaunchModuleAsSystem:1...
Creates the following services
- 'FixMe.IT Client Service:103e0fe1-dc0f-40ed-9728-e9f2f7c58847' "%TEMP%\Techinline\Ti16790\TiClientCoreLauncher.exe" -LaunchModuleAsSystem:1 -TiClientCore.exe https://fixme.it/client/application.aspx?package=1&eid=cf427d0c-853a-469f-a0c5-d503fde6dfaa 103e0f...
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\ticlientcontrol.dll
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\client_default_page[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\clientloading[1]
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- %WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
- %WINDIR%\temp\techinline_service\ticlienthelper.exe
- %WINDIR%\temp\techinline_service\103e0fe1-dc0f-40ed-9728-e9f2f7c58847\ticlientcoren.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %WINDIR%\temp\techinline_service\103e0fe1-dc0f-40ed-9728-e9f2f7c58847\ticlientcore.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\desktop.ini
- %WINDIR%\temp\techinline_service\103e0fe1-dc0f-40ed-9728-e9f2f7c58847\ticlientstandalone.exe
- %TEMP%\techinline\ti16790\ticlientcore.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\desktop.ini
- %WINDIR%\temp\techinline_service\103e0fe1-dc0f-40ed-9728-e9f2f7c58847\ticlientcorelauncher.exe
- %WINDIR%\temp\techinline_service\103e0fe1-dc0f-40ed-9728-e9f2f7c58847\ticlientunattendedservice.exe
- %WINDIR%\temp\techinline_service\103e0fe1-dc0f-40ed-9728-e9f2f7c58847\ticlientunattendedtray.exe
- %WINDIR%\temp\techinline_service\103e0fe1-dc0f-40ed-9728-e9f2f7c58847\ticlientcontrol.dll
- %WINDIR%\temp\techinline_service\103e0fe1-dc0f-40ed-9728-e9f2f7c58847\ticlientunattendedcredentialsprovider.dll
- %WINDIR%\temp\techinline_service\103e0fe1-dc0f-40ed-9728-e9f2f7c58847\ticlienthelperx64.exe
- %WINDIR%\temp\techinline_service\103e0fe1-dc0f-40ed-9728-e9f2f7c58847\ticlientcontrolx64.dll
- %WINDIR%\temp\techinline_service\103e0fe1-dc0f-40ed-9728-e9f2f7c58847\ticlientunattendedcredentialsproviderx64.dll
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\rcum8zzq\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\gru9mu35\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\7bpj1nbm\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\u74egjsm\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\36q2pcc3\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wyf8ml6k\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\6bnjvk9b\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\s136k2rx\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %TEMP%\rarsfx0\ticlientunattendedcredentialsprovider.dll
- %TEMP%\rarsfx0\ticlientunattendedcredentialsproviderx64.dll
- %TEMP%\rarsfx0\ticlientcore.exe
- %TEMP%\rarsfx0\ticlientcorelauncher.exe
- %TEMP%\rarsfx0\ticlienthelper.exe
- %TEMP%\rarsfx0\ticlienthelperx64.exe
- %TEMP%\rarsfx0\ticlientstandalone.exe
- %TEMP%\rarsfx0\ticlientunattendedservice.exe
- %TEMP%\rarsfx0\ticlientunattendedtray.exe
- %TEMP%\rarsfx0\tilauncher.exe
- %TEMP%\rarsfx0\client.url
- %TEMP%\techinline\ti16790\client.url
- %TEMP%\techinline\ti16790\ticlientcontrol.dll
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\low\index.dat
- %WINDIR%\temp\techinline_service\103e0fe1-dc0f-40ed-9728-e9f2f7c58847\ticlienthelper.exe
- %TEMP%\techinline\ti16790\ticlientcontrolx64.dll
- %TEMP%\techinline\ti16790\ticlienthelper.exe
- %TEMP%\techinline\ti16790\ticlienthelperx64.exe
- %TEMP%\techinline\ti16790\ticlientstandalone.exe
- %TEMP%\techinline\ti16790\ticlientunattendedcredentialsprovider.dll
- %TEMP%\techinline\ti16790\ticlientunattendedcredentialsproviderx64.dll
- %TEMP%\techinline\ti16790\ticlientunattendedservice.exe
- %TEMP%\techinline\ti16790\ticlientunattendedtray.exe
- %TEMP%\techinline\ti16790\tilauncher.exe
- %TEMP%\techinline\tilauncher.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %TEMP%\rarsfx0\ticlientcontrolx64.dll
- %TEMP%\techinline\ti16790\ticlientcorelauncher.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\s136k2rx\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\6bnjvk9b\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\36q2pcc3\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wyf8ml6k\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\rcum8zzq\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\gru9mu35\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\7bpj1nbm\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\u74egjsm\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\rarsfx0\client.url
- %TEMP%\rarsfx0\ticlientcontrol.dll
- %TEMP%\rarsfx0\ticlientcontrolx64.dll
- %TEMP%\rarsfx0\ticlientcore.exe
- %TEMP%\rarsfx0\ticlientcorelauncher.exe
- %TEMP%\rarsfx0\ticlienthelper.exe
- %TEMP%\rarsfx0\ticlienthelperx64.exe
- %TEMP%\rarsfx0\ticlientstandalone.exe
- %TEMP%\rarsfx0\ticlientunattendedcredentialsprovider.dll
- %TEMP%\rarsfx0\ticlientunattendedcredentialsproviderx64.dll
- %TEMP%\rarsfx0\ticlientunattendedservice.exe
- %TEMP%\rarsfx0\ticlientunattendedtray.exe
- %TEMP%\rarsfx0\tilauncher.exe
Network activity
Connects to
- 'fi##e.it':443
- 'fo###.#oogleapis.com':443
- 'pk#.goog':80
- 'fo###.gstatic.com':443
- 'co###.#echinline.net':443
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'fi##e.it':443
- 'fo###.#oogleapis.com':443
- 'fo###.gstatic.com':443
- 'co###.#echinline.net':443
UDP
- DNS ASK fi##e.it
- DNS ASK fo###.#oogleapis.com
- DNS ASK pk#.goog
- DNS ASK fo###.gstatic.com
- DNS ASK co###.#echinline.net
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'TechinlineLtd:TiHelperWindowClassx64' WindowName: ''
- ClassName: 'TechinlineLtd:TiHelperWindowClass' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\tilauncher.exe'
- '%TEMP%\techinline\tilauncher.exe' -re 16790
- '%TEMP%\techinline\ti16790\ticlientstandalone.exe' 16790
- '%TEMP%\techinline\ti16790\ticlientcorelauncher.exe' -ReLaunchAsService -TiClientCore.exe https://fixme.it/client/application.aspx?package=1&eid=cf427d0c-853a-469f-a0c5-d503fde6dfaa 103e0fe1-dc0f-40ed-9728-e9f2f7c58847&(null)&852348&comm3.techinl...
- '%TEMP%\techinline\ti16790\ticlientcorelauncher.exe' -LaunchModuleAsSystem:1 -TiClientCore.exe https://fixme.it/client/application.aspx?package=1&eid=cf427d0c-853a-469f-a0c5-d503fde6dfaa 103e0fe1-dc0f-40ed-9728-e9f2f7c58847&(null)&852348&comm3.te...
- '%TEMP%\techinline\ti16790\ticlientcore.exe' -system 103e0fe1-dc0f-40ed-9728-e9f2f7c58847&(null)&852348&comm3.techinline.net&/Client/&(null)&(null)&(null)&117287&0&
- '%TEMP%\techinline\ti16790\ticlientcore.exe' 103e0fe1-dc0f-40ed-9728-e9f2f7c58847&(null)&852348&comm3.techinline.net&/Client/&(null)&(null)&(null)&117287&0&
- '%TEMP%\techinline\ti16790\ticlienthelperx64.exe' 1712
- '%TEMP%\techinline\ti16790\ticlienthelper.exe' 1712
- '%TEMP%\techinline\ti16790\ticlienthelperx64.exe' 352
- '%TEMP%\techinline\ti16790\ticlienthelper.exe' 352
- '%TEMP%\techinline\ti16790\ticlientcorelauncher.exe' -ReLaunchAsService -TiClientCore.exe https://fixme.it/client/application.aspx?package=1&eid=cf427d0c-853a-469f-a0c5-d503fde6dfaa 103e0fe1-dc0f-40ed-9728-e9f2f7c58847&(null)&852348&comm3.techinl...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
