Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- <Current directory>\imgui.ini
Deletes the following files
- %WINDIR%\Prefetch\42.0.2311.135_CHROME_INSTALLE-7FD75326.pf
- %WINDIR%\Prefetch\ACRORDRDC1501020056_EN_US.EXE-3B58C109.pf
- %WINDIR%\Prefetch\AgAppLaunch.db
- %WINDIR%\Prefetch\AgGlFaultHistory.db
- %WINDIR%\Prefetch\AgGlFgAppHistory.db
- %WINDIR%\Prefetch\AgGlGlobalHistory.db
- %WINDIR%\prefetch\agrobust.db
- %WINDIR%\Prefetch\ASPNET_REGIIS.EXE-75651A3C.pf
- %WINDIR%\Prefetch\ASPNET_REGIIS.EXE-86915B5A.pf
- %WINDIR%\Prefetch\BCSSYNC.EXE-3F6C64A2.pf
- %WINDIR%\Prefetch\BFSVC.EXE-9C7A4DEE.pf
- %WINDIR%\Prefetch\BSPATCH.EXE-DD9E5E46.pf
- %WINDIR%\Prefetch\CHROME.EXE-5617A1BF.pf
- %WINDIR%\Prefetch\CLRGC.EXE-5D5B90F5.pf
- %WINDIR%\Prefetch\CMD.EXE-4A81B364.pf
- %WINDIR%\Prefetch\CMD.EXE-AC113AA8.pf
- %WINDIR%\Prefetch\CONHOST.EXE-1F3E9D7E.pf
- %WINDIR%\Prefetch\DEFAULT-BROWSER-AGENT.EXE-01C82E17.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-5E46FA0D.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-766398D2.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-B2EB1806.pf
- %WINDIR%\Prefetch\DOTNETFX35.EXE-852DD91F.pf
- %WINDIR%\Prefetch\DOTNETFX35SETUP.EXE-506819A6.pf
- %WINDIR%\Prefetch\DOTNETFX40_FULL_X86_X64.EXE-D34AC1BF.pf
- %WINDIR%\Prefetch\DRVINST.EXE-4CB4314A.pf
- %WINDIR%\Prefetch\FIREFOX SETUP 78.0.2 (X64).EX-D6C4EFE8.pf
- %WINDIR%\Prefetch\FIREFOX.EXE-A606B53C.pf
- %WINDIR%\Prefetch\IE4UINIT.EXE-8B333E8B.pf
- %WINDIR%\Prefetch\INSTALL.EXE-3B270E29.pf
- %WINDIR%\Prefetch\INSTALLER.EXE-58BA519F.pf
- %WINDIR%\Prefetch\INSTALLER.EXE-6C3AB888.pf
- %WINDIR%\Prefetch\JAUREG.EXE-2358F266.pf
- %WINDIR%\Prefetch\JAVAW.EXE-DCCF0AB8.pf
- %WINDIR%\Prefetch\JAVAWS.EXE-ED58C697.pf
- %WINDIR%\Prefetch\JP2LAUNCHER.EXE-7DCCD1B9.pf
- %WINDIR%\Prefetch\JRE-8U45-WINDOWS-X64.EXE-61CC34B3.pf
- %WINDIR%\Prefetch\LODCTR.EXE-3CCE0534.pf
- %WINDIR%\Prefetch\LODCTR.EXE-72CD50D0.pf
- %WINDIR%\Prefetch\MOFCOMP.EXE-8FE3D558.pf
- %WINDIR%\Prefetch\MOFCOMP.EXE-FDE76EFC.pf
- %WINDIR%\Prefetch\MSCORSVW.EXE-245ED79E.pf
- %WINDIR%\Prefetch\MSCORSVW.EXE-57D17DAF.pf
- %WINDIR%\Prefetch\MSCORSVW.EXE-90526FAC.pf
- %WINDIR%\Prefetch\MSCORSVW.EXE-C3C515BD.pf
- %WINDIR%\Prefetch\MSIEXEC.EXE-A2D55CB6.pf
- %WINDIR%\Prefetch\MSIEXEC.EXE-E09A077A.pf
- %WINDIR%\Prefetch\NDP48-X86-X64-ALLOS-ENU.EXE-54656820.pf
- %WINDIR%\Prefetch\NETSH.EXE-F1B6DA12.pf
- %WINDIR%\Prefetch\NGEN.EXE-AE594A6B.pf
- %WINDIR%\Prefetch\NGEN.EXE-EC3F9239.pf
- %WINDIR%\Prefetch\NTOSBOOT-B00DFAAD.pf
- %WINDIR%\Prefetch\OPERA_29.0.1795.47_SETUP.EXE-839F60FD.pf
- %WINDIR%\Prefetch\OPERA_29.0.1795.47_SETUP.EXE-9C628850.pf
- %WINDIR%\Prefetch\OSE.EXE-51C16F0E.pf
- %WINDIR%\Prefetch\OSE00000.EXE-2A4EFDBF.pf
- %WINDIR%\Prefetch\PfSvPerfStats.bin
- %WINDIR%\Prefetch\PING.EXE-7E94E73E.pf
- %WINDIR%\Prefetch\RDRSERVICESUPDATER.EXE-3D26E665.pf
- %WINDIR%\Prefetch\ReadyBoot\Trace1.fx
- %WINDIR%\prefetch\ReadyBoot\trace2.fx
- %WINDIR%\Prefetch\REGSVR32.EXE-8461DBEE.pf
- %WINDIR%\Prefetch\REGTLIBV12.EXE-B7C4F383.pf
- %WINDIR%\Prefetch\REGTLIBV12.EXE-D3A27E55.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-038E6267.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-36DAC103.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-7438E4D5.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-860C49A4.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-DB187FD1.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-E6258EDF.pf
- %WINDIR%\Prefetch\RUNONCE.EXE-0E293DD6.pf
- %WINDIR%\Prefetch\RUNONCE.EXE-D0649312.pf
- %WINDIR%\Prefetch\SC.EXE-945D79AE.pf
- %WINDIR%\Prefetch\SEARCHFILTERHOST.EXE-77482212.pf
- %WINDIR%\Prefetch\SEARCHINDEXER.EXE-4A6353B9.pf
- %WINDIR%\Prefetch\SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf
- %WINDIR%\Prefetch\SERVICEMODELREG.EXE-1F42B3E3.pf
- %WINDIR%\Prefetch\SERVICEMODELREG.EXE-AFDDD121.pf
- %WINDIR%\Prefetch\SETUP.EXE-04541C92.pf
- %WINDIR%\Prefetch\SETUP.EXE-0A445B9B.pf
- %WINDIR%\Prefetch\SETUP.EXE-45DC58C7.pf
- %WINDIR%\Prefetch\SETUP.EXE-77FE9137.pf
- %WINDIR%\Prefetch\SETUP.EXE-7C026C7F.pf
- %WINDIR%\Prefetch\SETUP.EXE-B4850DF7.pf
- %WINDIR%\Prefetch\SETUP.EXE-D498D406.pf
- %WINDIR%\Prefetch\SETUP.EXE-EA68F294.pf
- %WINDIR%\Prefetch\SETUP.EXE-F9915F9F.pf
- %WINDIR%\Prefetch\SETUPUTILITY.EXE-81395DE3.pf
- %WINDIR%\Prefetch\SETX.EXE-A7E52BF4.pf
- %WINDIR%\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf
- %WINDIR%\Prefetch\SPPSVC.EXE-B0F8131B.pf
- %WINDIR%\Prefetch\STEAMSERVICE.EXE-57E215D3.pf
- %WINDIR%\Prefetch\STEAMSETUP_2.10.91.91.EXE-91D3EED3.pf
- %WINDIR%\Prefetch\SVCHOST.EXE-007FEA55.pf
- %WINDIR%\Prefetch\SVCHOST.EXE-05F624AB.pf
- %WINDIR%\Prefetch\SVCHOST.EXE-7CFEDEA3.pf
- %WINDIR%\Prefetch\TASKHOST.EXE-7238F31D.pf
- %WINDIR%\Prefetch\THUNDERBIRD SETUP 78.9.1 (X64-07C878F8.pf
- %WINDIR%\Prefetch\THUNDERBIRD.EXE-5119524C.pf
- %WINDIR%\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf
- %WINDIR%\Prefetch\TSETUP.1.4.3.EXE-EF3D6F27.pf
- %WINDIR%\Prefetch\TSETUP.1.4.3.TMP-D1AA1547.pf
- %WINDIR%\Prefetch\UNINSTALL.EXE-A11D6B07.pf
- %WINDIR%\Prefetch\UNLODCTR.EXE-531FACC7.pf
- %WINDIR%\Prefetch\UNLODCTR.EXE-A3D4DEEB.pf
- %WINDIR%\Prefetch\UNPACK200.EXE-BB96DA5F.pf
- %WINDIR%\Prefetch\VCREDIST_X64.EXE-24AEA5D8.pf
- %WINDIR%\Prefetch\VCREDIST_X64.EXE-8227A7EF.pf
- %WINDIR%\Prefetch\VCREDIST_X64.EXE-A53F124B.pf
- %WINDIR%\Prefetch\VCREDIST_X86.EXE-163EFD5C.pf
- %WINDIR%\Prefetch\VCREDIST_X86.EXE-73B7FF73.pf
- %WINDIR%\Prefetch\VCREDIST_X86.EXE-96CF69CF.pf
- %WINDIR%\Prefetch\VCREDIST_X86.EXE-C622F3EF.pf
- %WINDIR%\Prefetch\VC_REDIST.X64.EXE-2C3B2083.pf
- %WINDIR%\Prefetch\VC_REDIST.X64.EXE-442857D9.pf
- %WINDIR%\Prefetch\VC_REDIST.X64.EXE-5C158F2F.pf
- %WINDIR%\Prefetch\VC_REDIST.X64.EXE-89C170F2.pf
- %WINDIR%\Prefetch\VC_REDIST.X64.EXE-B0C890FD.pf
- %WINDIR%\Prefetch\VC_REDIST.X64.EXE-C0CD3F70.pf
- %WINDIR%\Prefetch\VC_REDIST.X64.EXE-D3A3C549.pf
- %WINDIR%\Prefetch\VC_REDIST.X86.EXE-1C5672A5.pf
- %WINDIR%\Prefetch\VC_REDIST.X86.EXE-1DCB7807.pf
- %WINDIR%\Prefetch\VC_REDIST.X86.EXE-35B8AF5D.pf
- %WINDIR%\Prefetch\VC_REDIST.X86.EXE-4DA5E6B3.pf
- %WINDIR%\Prefetch\VC_REDIST.X86.EXE-92EB15BB.pf
- %WINDIR%\Prefetch\VC_REDIST.X86.EXE-D6410970.pf
- %WINDIR%\Prefetch\VC_REDIST.X86.EXE-E8257B7C.pf
- %WINDIR%\Prefetch\VSSVC.EXE-B8AFC319.pf
- %WINDIR%\Prefetch\WERMGR.EXE-0F2AC88C.pf
- %WINDIR%\Prefetch\WEVTUTIL.EXE-400D93E8.pf
- %WINDIR%\Prefetch\WEVTUTIL.EXE-EF5861C4.pf
- %WINDIR%\Prefetch\WINRAR-X64-531.EXE-91D4B934.pf
- %WINDIR%\Prefetch\WMIADAP.EXE-F8DFDFA2.pf
- %WINDIR%\Prefetch\WMIPRVSE.EXE-1628051C.pf
- %WINDIR%\Prefetch\WUAUCLT.EXE-70318591.pf
- %WINDIR%\Prefetch\WUSA.EXE-A8D5906C.pf
- %WINDIR%\Prefetch\WUSA.EXE-F04B35C8.pf
- %WINDIR%\Prefetch\XCOPY.EXE-41E6513F.pf
- %WINDIR%\softwaredistribution\download\08840accd53c266d48fc81b0ccf07018\cbshandler\state
- %WINDIR%\softwaredistribution\download\7b6d74016eaebfd601d93340c4f35d8f\cbshandler\state
- %WINDIR%\softwaredistribution\download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state
Deletes itself.
Network activity
Connects to
- 'localhost':49179
- 'vi#.#23pan.cn':443
TCP
Other
- 'localhost':49179
- 'localhost':49180
- 'vi#.#23pan.cn':443
UDP
- DNS ASK vi#.#23pan.cn
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\cmd.exe' /c rd /s /q %WINDIR%\Prefetch
- '<SYSTEM32>\cmd.exe' /c rd /s /q %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent
- '<SYSTEM32>\cmd.exe' /c rd /s /q %USERPROFILE%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
- '<SYSTEM32>\cmd.exe' /c rd /s /q %USERPROFILE%\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
- '<SYSTEM32>\cmd.exe' /c rd /s /q %USERPROFILE%\AppData\Local\Microsoft\Windows\Caches
- '<SYSTEM32>\cmd.exe' /c rd /s /q %USERPROFILE%\AppData\Local\Microsoft\Windows\Explorer\RecentSearch
- '<SYSTEM32>\cmd.exe' /c rd /s /q %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Cache
- '<SYSTEM32>\cmd.exe' /c rd /s /q %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data
- '<SYSTEM32>\cmd.exe' /c rd /s /q %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\Default\Cache
- '<SYSTEM32>\cmd.exe' /c rd /s /q %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data
- '<SYSTEM32>\cmd.exe' /c rd /s /q %USERPROFILE%\AppData\Local\Mozilla\Firefox\Profiles\*.default-release\cache2
- '<SYSTEM32>\cmd.exe' /c rd /s /q %USERPROFILE%\AppData\Local\Temp
- '<SYSTEM32>\cmd.exe' /c rd /s /q %WINDIR%\SoftwareDistribution\Download
- '<SYSTEM32>\cmd.exe' /c del /q %USERPROFILE%\AppData\Local\Microsoft\Windows\Explorer\thumbnails*.db
- '<SYSTEM32>\cmd.exe' /c cls
