Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Classes\proctortrack\shell\open\command\] '' = '"%APPDATA%\Verificient\Proctortrack\Proctortrack.exe" "%1"'
Modifies file system
Creates the following files
- %TEMP%\is-jkvd1.tmp\<File name>.tmp
- %APPDATA%\verificient\proctortrack\playlistformats\is-apbak.tmp
- %APPDATA%\verificient\proctortrack\platforms\is-p3cds.tmp
- %APPDATA%\verificient\proctortrack\mediaservice\is-f6etp.tmp
- %APPDATA%\verificient\proctortrack\mediaservice\is-t6bn7.tmp
- %APPDATA%\verificient\proctortrack\mediaservice\is-ba3jv.tmp
- %APPDATA%\verificient\proctortrack\imageformats\is-n6ogb.tmp
- %APPDATA%\verificient\proctortrack\imageformats\is-m5ip9.tmp
- %APPDATA%\verificient\proctortrack\imageformats\is-l27la.tmp
- %APPDATA%\verificient\proctortrack\imageformats\is-0eu06.tmp
- %APPDATA%\verificient\proctortrack\imageformats\is-2bu3d.tmp
- %APPDATA%\verificient\proctortrack\styles\is-vm6ni.tmp
- %APPDATA%\verificient\proctortrack\imageformats\is-4oer9.tmp
- %APPDATA%\verificient\proctortrack\imageformats\is-4lv7h.tmp
- %APPDATA%\verificient\proctortrack\imageformats\is-6hsi9.tmp
- %APPDATA%\verificient\proctortrack\iconengines\is-6me62.tmp
- %APPDATA%\verificient\proctortrack\bearer\is-sih5s.tmp
- %APPDATA%\verificient\proctortrack\audio\is-0hl69.tmp
- %APPDATA%\verificient\proctortrack\audio\is-oe1s7.tmp
- %APPDATA%\verificient\proctortrack\is-tqhvr.tmp
- %APPDATA%\verificient\proctortrack\is-d4h6r.tmp
- %APPDATA%\verificient\proctortrack\is-ek4kg.tmp
- %APPDATA%\verificient\proctortrack\is-t53it.tmp
- %APPDATA%\verificient\proctortrack\imageformats\is-cgqb4.tmp
- %APPDATA%\verificient\proctortrack\translations\is-vso4q.tmp
- %LOCALAPPDATA%\proctortrack\dumps\3b97e335-4dc6-4a3d-afac-b91a85c7adbd.dmp
- %APPDATA%\verificient\proctortrack\translations\is-8knfu.tmp
- %LOCALAPPDATA%\proctortrack\tempfile.json
- %LOCALAPPDATA%\proctortrack\logs\proctortrack_log_2020-10-02-20_40_07_003.txt
- %APPDATA%\verificient\proctortrack\unins000.dat
- %APPDATA%\verificient\proctortrack\translations\is-fgqt7.tmp
- %APPDATA%\verificient\proctortrack\translations\is-54jrl.tmp
- %APPDATA%\verificient\proctortrack\translations\is-2sr6d.tmp
- %APPDATA%\verificient\proctortrack\translations\is-kndej.tmp
- %APPDATA%\verificient\proctortrack\translations\is-bmp8f.tmp
- %APPDATA%\verificient\proctortrack\translations\is-thjva.tmp
- %APPDATA%\verificient\proctortrack\translations\is-c39ch.tmp
- %APPDATA%\verificient\proctortrack\is-i1138.tmp
- %APPDATA%\verificient\proctortrack\translations\is-e2f97.tmp
- %APPDATA%\verificient\proctortrack\translations\is-mqafv.tmp
- %APPDATA%\verificient\proctortrack\translations\is-49tur.tmp
- %APPDATA%\verificient\proctortrack\translations\is-7pu9f.tmp
- %APPDATA%\verificient\proctortrack\translations\is-g715f.tmp
- %APPDATA%\verificient\proctortrack\translations\is-l8nnt.tmp
- %APPDATA%\verificient\proctortrack\translations\is-0jail.tmp
- %APPDATA%\verificient\proctortrack\translations\is-6lfjl.tmp
- %APPDATA%\verificient\proctortrack\translations\is-vaghm.tmp
- %APPDATA%\verificient\proctortrack\translations\is-jm65b.tmp
- %APPDATA%\verificient\proctortrack\translations\is-ndsh4.tmp
- %APPDATA%\verificient\proctortrack\translations\is-8msai.tmp
- %APPDATA%\verificient\proctortrack\translations\is-r6f4o.tmp
- %APPDATA%\verificient\proctortrack\is-09gev.tmp
- %APPDATA%\verificient\proctortrack\is-8om0o.tmp
- %APPDATA%\verificient\proctortrack\is-ur58h.tmp
- %APPDATA%\verificient\proctortrack\is-6j8et.tmp
- %APPDATA%\verificient\proctortrack\is-rm30r.tmp
- %APPDATA%\verificient\proctortrack\is-63jj9.tmp
- %APPDATA%\verificient\proctortrack\is-3hv81.tmp
- %APPDATA%\verificient\proctortrack\is-gk46k.tmp
- %APPDATA%\verificient\proctortrack\is-0rfkj.tmp
- %APPDATA%\verificient\proctortrack\is-0s5jr.tmp
- %APPDATA%\verificient\proctortrack\is-2mb2b.tmp
- %APPDATA%\verificient\proctortrack\is-7i1q3.tmp
- %APPDATA%\verificient\proctortrack\is-9c58s.tmp
- %APPDATA%\verificient\proctortrack\is-lj049.tmp
- %APPDATA%\verificient\proctortrack\is-qii6n.tmp
- %APPDATA%\verificient\proctortrack\is-as7vi.tmp
- %APPDATA%\verificient\proctortrack\is-31116.tmp
- %APPDATA%\verificient\proctortrack\is-2plcb.tmp
- %APPDATA%\verificient\proctortrack\is-5iuoe.tmp
- %APPDATA%\verificient\proctortrack\is-57tha.tmp
- %APPDATA%\verificient\proctortrack\is-50ogh.tmp
- %APPDATA%\verificient\proctortrack\is-sqd8q.tmp
- %TEMP%\is-melen.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-melen.tmp\_isetup\_setup64.tmp
- %APPDATA%\verificient\proctortrack\is-u0imp.tmp
- %APPDATA%\verificient\proctortrack\is-goqkp.tmp
- %APPDATA%\verificient\proctortrack\is-pu6df.tmp
- %APPDATA%\verificient\proctortrack\is-25q8k.tmp
- %APPDATA%\verificient\proctortrack\is-ccj4b.tmp
- %APPDATA%\verificient\proctortrack\is-och5c.tmp
- %APPDATA%\verificient\proctortrack\is-d6411.tmp
- %APPDATA%\verificient\proctortrack\is-79a1q.tmp
- %APPDATA%\verificient\proctortrack\is-r0f7e.tmp
- %APPDATA%\verificient\proctortrack\is-ct1c6.tmp
- %APPDATA%\verificient\proctortrack\is-4t2vq.tmp
- %APPDATA%\verificient\proctortrack\is-ops66.tmp
- %APPDATA%\verificient\proctortrack\is-c1stm.tmp
- %APPDATA%\verificient\proctortrack\is-ngqjl.tmp
- %APPDATA%\verificient\proctortrack\is-92u2b.tmp
- %APPDATA%\verificient\proctortrack\is-nmo1t.tmp
- %APPDATA%\verificient\proctortrack\is-amdcd.tmp
- %APPDATA%\verificient\proctortrack\is-p3bg0.tmp
- %APPDATA%\verificient\proctortrack\is-riaui.tmp
- %APPDATA%\verificient\proctortrack\is-6b5bu.tmp
- %APPDATA%\verificient\proctortrack\is-b55cr.tmp
- %APPDATA%\verificient\proctortrack\is-22ppf.tmp
- %APPDATA%\verificient\proctortrack\is-4l812.tmp
- %APPDATA%\verificient\proctortrack\is-o9gdq.tmp
- %APPDATA%\verificient\proctortrack\is-vl7c7.tmp
- %APPDATA%\verificient\proctortrack\is-sm4cb.tmp
- %APPDATA%\verificient\proctortrack\is-8otbq.tmp
- %LOCALAPPDATA%\proctortrack\dumps\3b97e335-4dc6-4a3d-afac-b91a85c7adbd.jsn
Deletes the following files
- %TEMP%\is-melen.tmp\_isetup\_setup64.tmp
- %TEMP%\is-melen.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-jkvd1.tmp\<File name>.tmp
Moves the following files
- from %APPDATA%\verificient\proctortrack\is-sqd8q.tmp to %APPDATA%\verificient\proctortrack\unins000.exe
- from %APPDATA%\verificient\proctortrack\mediaservice\is-t6bn7.tmp to %APPDATA%\verificient\proctortrack\mediaservice\qtmedia_audioengine.dll
- from %APPDATA%\verificient\proctortrack\mediaservice\is-ba3jv.tmp to %APPDATA%\verificient\proctortrack\mediaservice\dsengine.dll
- from %APPDATA%\verificient\proctortrack\imageformats\is-n6ogb.tmp to %APPDATA%\verificient\proctortrack\imageformats\qwebp.dll
- from %APPDATA%\verificient\proctortrack\imageformats\is-m5ip9.tmp to %APPDATA%\verificient\proctortrack\imageformats\qwbmp.dll
- from %APPDATA%\verificient\proctortrack\imageformats\is-l27la.tmp to %APPDATA%\verificient\proctortrack\imageformats\qtiff.dll
- from %APPDATA%\verificient\proctortrack\imageformats\is-0eu06.tmp to %APPDATA%\verificient\proctortrack\imageformats\qtga.dll
- from %APPDATA%\verificient\proctortrack\imageformats\is-2bu3d.tmp to %APPDATA%\verificient\proctortrack\imageformats\qsvg.dll
- from %APPDATA%\verificient\proctortrack\imageformats\is-4oer9.tmp to %APPDATA%\verificient\proctortrack\imageformats\qjpeg.dll
- from %APPDATA%\verificient\proctortrack\imageformats\is-cgqb4.tmp to %APPDATA%\verificient\proctortrack\imageformats\qico.dll
- from %APPDATA%\verificient\proctortrack\mediaservice\is-f6etp.tmp to %APPDATA%\verificient\proctortrack\mediaservice\wmfengine.dll
- from %APPDATA%\verificient\proctortrack\imageformats\is-4lv7h.tmp to %APPDATA%\verificient\proctortrack\imageformats\qicns.dll
- from %APPDATA%\verificient\proctortrack\iconengines\is-6me62.tmp to %APPDATA%\verificient\proctortrack\iconengines\qsvgicon.dll
- from %APPDATA%\verificient\proctortrack\bearer\is-sih5s.tmp to %APPDATA%\verificient\proctortrack\bearer\qgenericbearer.dll
- from %APPDATA%\verificient\proctortrack\audio\is-0hl69.tmp to %APPDATA%\verificient\proctortrack\audio\qtaudio_windows.dll
- from %APPDATA%\verificient\proctortrack\audio\is-oe1s7.tmp to %APPDATA%\verificient\proctortrack\audio\qtaudio_wasapi.dll
- from %APPDATA%\verificient\proctortrack\is-tqhvr.tmp to %APPDATA%\verificient\proctortrack\vcruntime140.dll
- from %APPDATA%\verificient\proctortrack\is-d4h6r.tmp to %APPDATA%\verificient\proctortrack\swscale-2.dll
- from %APPDATA%\verificient\proctortrack\is-ek4kg.tmp to %APPDATA%\verificient\proctortrack\qt5widgets.dll
- from %APPDATA%\verificient\proctortrack\is-t53it.tmp to %APPDATA%\verificient\proctortrack\qt5svg.dll
- from %APPDATA%\verificient\proctortrack\is-i1138.tmp to %APPDATA%\verificient\proctortrack\qt5network.dll
- from %APPDATA%\verificient\proctortrack\imageformats\is-6hsi9.tmp to %APPDATA%\verificient\proctortrack\imageformats\qgif.dll
- from %APPDATA%\verificient\proctortrack\translations\is-g715f.tmp to %APPDATA%\verificient\proctortrack\translations\qt_fr.qm
- from %APPDATA%\verificient\proctortrack\translations\is-54jrl.tmp to %APPDATA%\verificient\proctortrack\translations\qt_uk.qm
- from %APPDATA%\verificient\proctortrack\styles\is-vm6ni.tmp to %APPDATA%\verificient\proctortrack\styles\qwindowsvistastyle.dll
- from %APPDATA%\verificient\proctortrack\translations\is-2sr6d.tmp to %APPDATA%\verificient\proctortrack\translations\qt_sk.qm
- from %APPDATA%\verificient\proctortrack\translations\is-kndej.tmp to %APPDATA%\verificient\proctortrack\translations\qt_ru.qm
- from %APPDATA%\verificient\proctortrack\translations\is-bmp8f.tmp to %APPDATA%\verificient\proctortrack\translations\qt_pl.qm
- from %APPDATA%\verificient\proctortrack\translations\is-thjva.tmp to %APPDATA%\verificient\proctortrack\translations\qt_lv.qm
- from %APPDATA%\verificient\proctortrack\translations\is-c39ch.tmp to %APPDATA%\verificient\proctortrack\translations\qt_ko.qm
- from %APPDATA%\verificient\proctortrack\translations\is-e2f97.tmp to %APPDATA%\verificient\proctortrack\translations\qt_ja.qm
- from %APPDATA%\verificient\proctortrack\translations\is-vso4q.tmp to %APPDATA%\verificient\proctortrack\translations\qt_it.qm
- from %APPDATA%\verificient\proctortrack\translations\is-mqafv.tmp to %APPDATA%\verificient\proctortrack\translations\qt_hu.qm
- from %APPDATA%\verificient\proctortrack\translations\is-49tur.tmp to %APPDATA%\verificient\proctortrack\translations\qt_he.qm
- from %APPDATA%\verificient\proctortrack\is-09gev.tmp to %APPDATA%\verificient\proctortrack\qt5multimedia.dll
- from %APPDATA%\verificient\proctortrack\translations\is-7pu9f.tmp to %APPDATA%\verificient\proctortrack\translations\qt_gd.qm
- from %APPDATA%\verificient\proctortrack\translations\is-l8nnt.tmp to %APPDATA%\verificient\proctortrack\translations\qt_fi.qm
- from %APPDATA%\verificient\proctortrack\translations\is-0jail.tmp to %APPDATA%\verificient\proctortrack\translations\qt_es.qm
- from %APPDATA%\verificient\proctortrack\translations\is-6lfjl.tmp to %APPDATA%\verificient\proctortrack\translations\qt_en.qm
- from %APPDATA%\verificient\proctortrack\translations\is-vaghm.tmp to %APPDATA%\verificient\proctortrack\translations\qt_de.qm
- from %APPDATA%\verificient\proctortrack\translations\is-jm65b.tmp to %APPDATA%\verificient\proctortrack\translations\qt_da.qm
- from %APPDATA%\verificient\proctortrack\translations\is-ndsh4.tmp to %APPDATA%\verificient\proctortrack\translations\qt_cs.qm
- from %APPDATA%\verificient\proctortrack\translations\is-8knfu.tmp to %APPDATA%\verificient\proctortrack\translations\qt_ca.qm
- from %APPDATA%\verificient\proctortrack\translations\is-r6f4o.tmp to %APPDATA%\verificient\proctortrack\translations\qt_bg.qm
- from %APPDATA%\verificient\proctortrack\translations\is-8msai.tmp to %APPDATA%\verificient\proctortrack\translations\qt_ar.qm
- from %APPDATA%\verificient\proctortrack\platforms\is-p3cds.tmp to %APPDATA%\verificient\proctortrack\platforms\qwindows.dll
- from %APPDATA%\verificient\proctortrack\playlistformats\is-apbak.tmp to %APPDATA%\verificient\proctortrack\playlistformats\qtmultimedia_m3u.dll
- from %APPDATA%\verificient\proctortrack\is-92u2b.tmp to %APPDATA%\verificient\proctortrack\qt5gui.dll
- from %APPDATA%\verificient\proctortrack\is-25q8k.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-downlevel-advapi32-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-9c58s.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-string-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-ur58h.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-stdio-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-6j8et.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-runtime-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-rm30r.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-process-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-63jj9.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-private-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-3hv81.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-multibyte-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-gk46k.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-math-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-0rfkj.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-locale-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-0s5jr.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-heap-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-8otbq.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-time-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-2mb2b.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-filesystem-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-lj049.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-convert-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-u0imp.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-conio-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-qii6n.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-core-xstate-l2-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-as7vi.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-core-timezone-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-31116.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-core-synch-l1-2-0.dll
- from %APPDATA%\verificient\proctortrack\is-2plcb.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-core-processthreads-l1-1-1.dll
- from %APPDATA%\verificient\proctortrack\is-5iuoe.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-core-localization-l1-2-0.dll
- from %APPDATA%\verificient\proctortrack\is-57tha.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-core-file-l2-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-50ogh.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-core-file-l1-2-0.dll
- from %APPDATA%\verificient\proctortrack\is-7i1q3.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-environment-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-goqkp.tmp to %APPDATA%\verificient\proctortrack\avutil-51.dll
- from %APPDATA%\verificient\proctortrack\is-ccj4b.tmp to %APPDATA%\verificient\proctortrack\proctortrack.exe
- from %APPDATA%\verificient\proctortrack\is-sm4cb.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-downlevel-advapi32-l2-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-och5c.tmp to %APPDATA%\verificient\proctortrack\opengl32sw.dll
- from %APPDATA%\verificient\proctortrack\is-d6411.tmp to %APPDATA%\verificient\proctortrack\msvcr100.dll
- from %APPDATA%\verificient\proctortrack\is-79a1q.tmp to %APPDATA%\verificient\proctortrack\msvcp140.dll
- from %APPDATA%\verificient\proctortrack\is-r0f7e.tmp to %APPDATA%\verificient\proctortrack\msvcp100.dll
- from %APPDATA%\verificient\proctortrack\is-ct1c6.tmp to %APPDATA%\verificient\proctortrack\libssl-1_1.dll
- from %APPDATA%\verificient\proctortrack\is-4t2vq.tmp to %APPDATA%\verificient\proctortrack\libglesv2.dll
- from %APPDATA%\verificient\proctortrack\is-ops66.tmp to %APPDATA%\verificient\proctortrack\libegl.dll
- from %APPDATA%\verificient\proctortrack\is-c1stm.tmp to %APPDATA%\verificient\proctortrack\libcrypto-1_1.dll
- from %APPDATA%\verificient\proctortrack\is-ngqjl.tmp to %APPDATA%\verificient\proctortrack\d3dcompiler_47.dll
- from %APPDATA%\verificient\proctortrack\is-pu6df.tmp to %APPDATA%\verificient\proctortrack\qt5core.dll
- from %APPDATA%\verificient\proctortrack\is-nmo1t.tmp to %APPDATA%\verificient\proctortrack\concrt140.dll
- from %APPDATA%\verificient\proctortrack\is-amdcd.tmp to %APPDATA%\verificient\proctortrack\avformat-54.dll
- from %APPDATA%\verificient\proctortrack\is-p3bg0.tmp to %APPDATA%\verificient\proctortrack\avcodec-54.dll
- from %APPDATA%\verificient\proctortrack\is-riaui.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-downlevel-version-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-6b5bu.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-downlevel-user32-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-b55cr.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-downlevel-shlwapi-l2-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-22ppf.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-downlevel-shlwapi-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-4l812.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-downlevel-shell32-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-o9gdq.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-downlevel-ole32-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-vl7c7.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-downlevel-normaliz-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\is-8om0o.tmp to %APPDATA%\verificient\proctortrack\api-ms-win-crt-utility-l1-1-0.dll
- from %APPDATA%\verificient\proctortrack\translations\is-fgqt7.tmp to %APPDATA%\verificient\proctortrack\translations\qt_zh_tw.qm
Network activity
TCP
- 'sm##.gmail.com':465
UDP
- DNS ASK sm##.gmail.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-jkvd1.tmp\<File name>.tmp' /SL5="$B020E,28493415,122880,<Full path to file>"
- '%APPDATA%\verificient\proctortrack\proctortrack.exe'
