Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM chrome.exe
Modifies file system
Creates the following files
- %TEMP%\nshd440.tmp
- %TEMP%\nsxd451.tmp\version.dll
- %TEMP%\nsxd451.tmp\usermgr.dll
- %TEMP%\nsxd451.tmp\ipconfig.dll
- %TEMP%\nsxd451.tmp\nsexec.dll
- %TEMP%\nsxd451.tmp\inetc.dll
- %LOCALAPPDATA%\roaming\installer\icon.ico
- %LOCALAPPDATA%\roaming\installer\uninstall.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\extension installer\uninstall extension installer.lnk
- %TEMP%\etilqs_r5dfazd9yhdvp4n
Deletes the following files
- %TEMP%\nsxd451.tmp\inetc.dll
- %TEMP%\nsxd451.tmp\ipconfig.dll
- %TEMP%\nsxd451.tmp\nsexec.dll
- %TEMP%\nsxd451.tmp\usermgr.dll
- %TEMP%\nsxd451.tmp\version.dll
Network activity
Connects to
- 'ap##.##tensionmedia.net':443
- 'microsoft.com':80
- 'clients4.google.com':443
- 'clients2.google.com':443
- 'tr######e.googleapis.com':443
- 'gs##tic.com':80
- 'clients3.google.com':443
- 'ap#.###tifyshield.com':443
- 'cd#.##delivr.net':443
- 'go#####agmanager.com':443
- 'go#####analytics.com':443
- 'gs##tic.com':443
TCP
- 'ap##.##tensionmedia.net':443
- 'clients4.google.com':443
- 'clients2.google.com':443
- 'go###eapis.com':443
- 'clients3.google.com':443
- 'ap#.###tifyshield.com':443
- 'google.com':443
- 'cd#.##delivr.net':443
- 'go#####agmanager.com':443
- 'go#####analytics.com':443
- 'gs##tic.com':443
UDP
- DNS ASK ap##.##tensionmedia.net
- DNS ASK microsoft.com
- DNS ASK clients2.google.com
- DNS ASK google.com
- DNS ASK clients4.google.com
- DNS ASK go##le.ru
- DNS ASK go###eapis.com
- DNS ASK tr######e.googleapis.com
- DNS ASK gs##tic.com
- DNS ASK clients3.google.com
- DNS ASK ap#.###tifyshield.com
- DNS ASK cd#.##delivr.net
- DNS ASK go#####agmanager.com
- DNS ASK go#####analytics.com
- 'google.com':443
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /all' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get deviceid, name, numberofcores, maxclockspeed' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c wmic memorychip get BankLabel, DeviceLocator, MemoryType, TypeDetail, Capacity, Speed' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM chrome.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c start chrome https://apps.extensionmedia.net/clk/b4385f0e-b420-48b2-820c-7d7302244c66' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /all
- '%WINDIR%\syswow64\ipconfig.exe' /all
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get deviceid, name, numberofcores, maxclockspeed
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get deviceid, name, numberofcores, maxclockspeed
- '%WINDIR%\syswow64\cmd.exe' /c wmic memorychip get BankLabel, DeviceLocator, MemoryType, TypeDetail, Capacity, Speed
- '%WINDIR%\syswow64\wbem\wmic.exe' memorychip get BankLabel, DeviceLocator, MemoryType, TypeDetail, Capacity, Speed
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM chrome.exe
- '%WINDIR%\syswow64\cmd.exe' /c start chrome https://apps.extensionmedia.net/clk/b4385f0e-b420-48b2-820c-7d7302244c66
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' https://apps.extensionmedia.net/clk/b4385f0e-b420-48b2-820c-7d7302244c66
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="2620.0.777269047\873798039" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --gpu...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptivePo...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptiveP...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="*BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/Captive...
