Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'bpk' = '<SYSTEM32>\bpk.exe'
- '<SYSTEM32>\bpk.exe'
- '%TEMP%\12Sky2 Moken Hack Update April 2014.exe'
- '%TEMP%\RarSFX0\rinst.exe'
- Handler for all processes: <SYSTEM32>\bpkhk.dll
- firefox.exe
- opera.exe
- chrome.exe
- iexplore.exe
- ClassName: 'RegmonClass' WindowName: '(null)'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: '(null)'
- ClassName: 'FilemonClass' WindowName: '(null)'
- <SYSTEM32>\dt\2014-04-22_16-08-11-293640
- <SYSTEM32>\dt\2014-04-22_16-08-12-294593
- <SYSTEM32>\dt\2014-04-22_16-08-10-292593
- <SYSTEM32>\dt\2014-04-22_16-08-07-289718
- <SYSTEM32>\dt\2014-04-22_16-08-09-291671
- <SYSTEM32>\dt\2014-04-22_16-08-13-295812
- <SYSTEM32>\dt\2014-04-22_16-08-21-303796
- <SYSTEM32>\dt\2014-04-22_16-08-23-305781
- <SYSTEM32>\dt\2014-04-22_16-08-19-301765
- <SYSTEM32>\dt\2014-04-22_16-08-15-298218
- <SYSTEM32>\dt\2014-04-22_16-08-17-299875
- <SYSTEM32>\dt\2014-04-22_16-08-05-287718
- <SYSTEM32>\dt\2014-04-22_16-07-55-277609
- <SYSTEM32>\dt\2014-04-22_16-07-56-278609
- <SYSTEM32>\dt\2014-04-22_16-07-54-276593
- <SYSTEM32>\dt\2014-04-22_16-07-52-274578
- <SYSTEM32>\dt\2014-04-22_16-07-53-275578
- <SYSTEM32>\dt\2014-04-22_16-07-57-279609
- <SYSTEM32>\dt\2014-04-22_16-08-02-284687
- <SYSTEM32>\dt\2014-04-22_16-08-04-286671
- <SYSTEM32>\dt\2014-04-22_16-08-01-283640
- <SYSTEM32>\dt\2014-04-22_16-07-58-280671
- <SYSTEM32>\dt\2014-04-22_16-08-00-282625
- <SYSTEM32>\dt\2014-04-22_16-08-56-338765
- <SYSTEM32>\dt\2014-04-22_16-08-58-340765
- <SYSTEM32>\dt\2014-04-22_16-08-54-336734
- <SYSTEM32>\dt\2014-04-22_16-08-50-332796
- <SYSTEM32>\dt\2014-04-22_16-08-52-334843
- <SYSTEM32>\dt\2014-04-22_16-09-00-342765
- <SYSTEM32>\dt\2014-04-22_16-09-08-350718
- <SYSTEM32>\dt\2014-04-22_16-09-10-352812
- <SYSTEM32>\dt\2014-04-22_16-09-06-348875
- <SYSTEM32>\dt\2014-04-22_16-09-02-344828
- <SYSTEM32>\dt\2014-04-22_16-09-04-346890
- <SYSTEM32>\dt\2014-04-22_16-08-48-330875
- <SYSTEM32>\dt\2014-04-22_16-08-31-313765
- <SYSTEM32>\dt\2014-04-22_16-08-33-315968
- <SYSTEM32>\dt\2014-04-22_16-08-29-311687
- <SYSTEM32>\dt\2014-04-22_16-08-25-307640
- <SYSTEM32>\dt\2014-04-22_16-08-27-309703
- <SYSTEM32>\dt\2014-04-22_16-08-36-318718
- <SYSTEM32>\dt\2014-04-22_16-08-44-326796
- <SYSTEM32>\dt\2014-04-22_16-08-46-328843
- <SYSTEM32>\dt\2014-04-22_16-08-42-324796
- <SYSTEM32>\dt\2014-04-22_16-08-38-320718
- <SYSTEM32>\dt\2014-04-22_16-08-40-322765
- <SYSTEM32>\dt\2014-04-22_16-07-51-273593
- <SYSTEM32>\temporary.bmp
- <SYSTEM32>\dt\2014-04-22_16-07-14-237312
- <SYSTEM32>\pk.bin_back
- <SYSTEM32>\inst.dat
- <SYSTEM32>\rinst.exe
- <SYSTEM32>\dt\2014-04-22_16-07-16-238578
- <SYSTEM32>\dt\2014-04-22_16-07-22-244562
- <SYSTEM32>\dt\2014-04-22_16-07-23-245593
- <SYSTEM32>\dt\2014-04-22_16-07-21-243578
- <SYSTEM32>\dt\2014-04-22_16-07-18-240640
- <SYSTEM32>\dt\2014-04-22_16-07-20-242500
- <SYSTEM32>\bpkwb.dll
- %TEMP%\RarSFX0\bpkwb.dll
- %TEMP%\RarSFX0\12Sky2 Moken Hack Update April 2014.exe
- %TEMP%\RarSFX0\bpkhk.dll
- %TEMP%\RarSFX0\pk.bin
- %TEMP%\RarSFX0\inst.dat
- %TEMP%\RarSFX0\bpk.exe
- <SYSTEM32>\bpk.exe
- <SYSTEM32>\bpkhk.dll
- <SYSTEM32>\pk.bin
- %TEMP%\RarSFX0\rinst.exe
- %TEMP%\12Sky2 Moken Hack Update April 2014.exe
- <SYSTEM32>\dt\2014-04-22_16-07-40-262578
- <SYSTEM32>\dt\2014-04-22_16-07-41-263796
- <SYSTEM32>\dt\2014-04-22_16-07-39-261656
- <SYSTEM32>\dt\2014-04-22_16-07-36-258515
- <SYSTEM32>\dt\2014-04-22_16-07-37-259906
- <SYSTEM32>\dt\2014-04-22_16-07-43-265671
- <SYSTEM32>\dt\2014-04-22_16-07-47-269687
- <SYSTEM32>\dt\2014-04-22_16-07-49-271671
- <SYSTEM32>\dt\2014-04-22_16-07-46-268640
- <SYSTEM32>\dt\2014-04-22_16-07-44-266640
- <SYSTEM32>\dt\2014-04-22_16-07-45-267671
- <SYSTEM32>\dt\2014-04-22_16-07-35-257562
- <SYSTEM32>\dt\2014-04-22_16-07-27-249640
- <SYSTEM32>\dt\2014-04-22_16-07-28-250578
- <SYSTEM32>\dt\2014-04-22_16-07-26-248562
- <SYSTEM32>\dt\2014-04-22_16-07-24-246578
- <SYSTEM32>\dt\2014-04-22_16-07-25-247593
- <SYSTEM32>\dt\2014-04-22_16-07-29-251546
- <SYSTEM32>\dt\2014-04-22_16-07-33-255593
- <SYSTEM32>\dt\2014-04-22_16-07-34-256562
- <SYSTEM32>\dt\2014-04-22_16-07-32-254578
- <SYSTEM32>\dt\2014-04-22_16-07-30-252609
- <SYSTEM32>\dt\2014-04-22_16-07-31-253578
- %TEMP%\RarSFX0\12Sky2 Moken Hack Update April 2014.exe
- %TEMP%\RarSFX0\rinst.exe
- <SYSTEM32>\temporary.bmp
- <SYSTEM32>\pk.bin_back
- %TEMP%\RarSFX0\inst.dat
- %TEMP%\RarSFX0\bpk.exe
- %TEMP%\RarSFX0\pk.bin
- %TEMP%\RarSFX0\bpkwb.dll
- %TEMP%\RarSFX0\bpkhk.dll
- from <SYSTEM32>\rinst.exe to <SYSTEM32>\bpkr.exe
- 'sm##.mail.com':587
- DNS ASK sm##.mail.com
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'RichEdit20A' WindowName: '(null)'
- ClassName: 'MButtonClass' WindowName: '(null)'
- ClassName: 'Button' WindowName: 'ICQ'
- ClassName: '(null)' WindowName: 'PKL Window'
- ClassName: '(null)' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: '18467-41' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'