Technical Information
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\ds3.exe
- %APPDATA%\windowscertification\is-3841n.tmp
- %APPDATA%\windowscertification\is-qa12p.tmp
- %APPDATA%\windowscertification\is-1rhpd.tmp
- %APPDATA%\windowscertification\is-hkb0m.tmp
- %APPDATA%\windowscertification\is-ikdkc.tmp
- %APPDATA%\windowscertification\is-q0p33.tmp
- %APPDATA%\windowscertification\is-c8nu3.tmp
- %APPDATA%\windowsupdate\is-fqbbm.tmp
- %APPDATA%\windowscertification\is-kg1uc.tmp
- %APPDATA%\windowscertification\is-de181.tmp
- %APPDATA%\windowscertification\is-ij81i.tmp
- %APPDATA%\windowscertification\is-ub5fg.tmp
- %APPDATA%\windowscertification\is-0e9se.tmp
- %APPDATA%\windowscertification\is-s6u1b.tmp
- %APPDATA%\windowsupdate\is-jmehi.tmp
- %APPDATA%\windowsupdate\is-f61lc.tmp
- %APPDATA%\windowsupdate\is-jj9rc.tmp
- %APPDATA%\windowsupdate\is-ud6tk.tmp
- %APPDATA%\windowsupdate\is-pkkeu.tmp
- %APPDATA%\windowsupdate\is-t8gn2.tmp
- %APPDATA%\windowsupdate\is-h1r54.tmp
- %APPDATA%\windowsupdate\is-i0sjc.tmp
- %APPDATA%\windowsupdate\is-3p2r3.tmp
- %APPDATA%\windowscertification\is-pei9s.tmp
- %APPDATA%\windowsupdate\is-6cls8.tmp
- %APPDATA%\windowsupdate\is-t6a27.tmp
- %APPDATA%\windowsupdate\is-jr5s8.tmp
- %APPDATA%\windowsupdate\is-5b5kg.tmp
- %TEMP%\is-crm10.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-crm10.tmp\_isetup\_setup64.tmp
- %TEMP%\is-er32g.tmp\ds3.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\windowscertificate.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\windowsupdate.lnk
Sets the 'hidden' attribute to the following files
- %APPDATA%\windowsupdate\audiocapture.dll
- %APPDATA%\windowscertification\pcicl32.dll
- %APPDATA%\windowscertification\pcichek.dll
- %APPDATA%\windowscertification\pcicapi.dll
- %APPDATA%\windowscertification\nsm_vpro.ini
- %APPDATA%\windowscertification\nsm.lic
- %APPDATA%\windowscertification\nsm.ini
- %APPDATA%\windowscertification\nskbfltr.inf
- %APPDATA%\windowscertification\msvcr100.dll
- %APPDATA%\windowscertification\htctl32.dll
- %APPDATA%\windowscertification\client32.ini
- %APPDATA%\windowscertification\client32.exe
- %APPDATA%\windowscertification\audiocapture.dll
- %APPDATA%\windowsupdate\tcctl32.dll
- %APPDATA%\windowsupdate\remcmdstub.exe
- %APPDATA%\windowsupdate\pcicl32.dll
- %APPDATA%\windowsupdate\pcichek.dll
- %APPDATA%\windowsupdate\pcicapi.dll
- %APPDATA%\windowsupdate\nsm_vpro.ini
- %APPDATA%\windowsupdate\nsm.lic
- %APPDATA%\windowsupdate\nsm.ini
- %APPDATA%\windowsupdate\nskbfltr.inf
- %APPDATA%\windowsupdate\msvcr100.dll
- %APPDATA%\windowsupdate\htctl32.dll
- %APPDATA%\windowsupdate\client32.ini
- %APPDATA%\windowsupdate\client32.exe
- %APPDATA%\windowscertification\remcmdstub.exe
- %APPDATA%\windowscertification\tcctl32.dll
Deletes the following files
- %TEMP%\is-crm10.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-crm10.tmp\_isetup\_setup64.tmp
- %TEMP%\is-er32g.tmp\ds3.tmp
- %TEMP%\rarsfx0\ds3.exe
Moves the following files
- from %APPDATA%\windowsupdate\is-5b5kg.tmp to %APPDATA%\windowsupdate\audiocapture.dll
- from %APPDATA%\windowscertification\is-ub5fg.tmp to %APPDATA%\windowscertification\pcicl32.dll
- from %APPDATA%\windowscertification\is-ij81i.tmp to %APPDATA%\windowscertification\pcichek.dll
- from %APPDATA%\windowscertification\is-de181.tmp to %APPDATA%\windowscertification\pcicapi.dll
- from %APPDATA%\windowscertification\is-kg1uc.tmp to %APPDATA%\windowscertification\nsm_vpro.ini
- from %APPDATA%\windowscertification\is-c8nu3.tmp to %APPDATA%\windowscertification\nsm.lic
- from %APPDATA%\windowscertification\is-pei9s.tmp to %APPDATA%\windowscertification\nsm.ini
- from %APPDATA%\windowscertification\is-q0p33.tmp to %APPDATA%\windowscertification\nskbfltr.inf
- from %APPDATA%\windowscertification\is-ikdkc.tmp to %APPDATA%\windowscertification\msvcr100.dll
- from %APPDATA%\windowscertification\is-hkb0m.tmp to %APPDATA%\windowscertification\htctl32.dll
- from %APPDATA%\windowscertification\is-1rhpd.tmp to %APPDATA%\windowscertification\client32.ini
- from %APPDATA%\windowscertification\is-qa12p.tmp to %APPDATA%\windowscertification\client32.exe
- from %APPDATA%\windowscertification\is-3841n.tmp to %APPDATA%\windowscertification\audiocapture.dll
- from %APPDATA%\windowsupdate\is-jmehi.tmp to %APPDATA%\windowsupdate\tcctl32.dll
- from %APPDATA%\windowsupdate\is-f61lc.tmp to %APPDATA%\windowsupdate\remcmdstub.exe
- from %APPDATA%\windowsupdate\is-jj9rc.tmp to %APPDATA%\windowsupdate\pcicl32.dll
- from %APPDATA%\windowsupdate\is-ud6tk.tmp to %APPDATA%\windowsupdate\pcichek.dll
- from %APPDATA%\windowsupdate\is-pkkeu.tmp to %APPDATA%\windowsupdate\pcicapi.dll
- from %APPDATA%\windowsupdate\is-t8gn2.tmp to %APPDATA%\windowsupdate\nsm_vpro.ini
- from %APPDATA%\windowsupdate\is-h1r54.tmp to %APPDATA%\windowsupdate\nsm.lic
- from %APPDATA%\windowsupdate\is-i0sjc.tmp to %APPDATA%\windowsupdate\nsm.ini
- from %APPDATA%\windowsupdate\is-3p2r3.tmp to %APPDATA%\windowsupdate\nskbfltr.inf
- from %APPDATA%\windowsupdate\is-fqbbm.tmp to %APPDATA%\windowsupdate\msvcr100.dll
- from %APPDATA%\windowsupdate\is-6cls8.tmp to %APPDATA%\windowsupdate\htctl32.dll
- from %APPDATA%\windowsupdate\is-t6a27.tmp to %APPDATA%\windowsupdate\client32.ini
- from %APPDATA%\windowsupdate\is-jr5s8.tmp to %APPDATA%\windowsupdate\client32.exe
- from %APPDATA%\windowscertification\is-0e9se.tmp to %APPDATA%\windowscertification\remcmdstub.exe
- from %APPDATA%\windowscertification\is-s6u1b.tmp to %APPDATA%\windowscertification\tcctl32.dll
Network activity
Connects to
- 'ge#.####upportsoftware.com':80
UDP
- DNS ASK co#####k.duckdns.org
- DNS ASK ge#.####upportsoftware.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'NSMWClass' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\ds3.exe' /VERYSILENT /SP-
- '%TEMP%\is-er32g.tmp\ds3.tmp' /SL5="$1023C,2809640,780800,%TEMP%\RarSFX0\DS3.exe" /VERYSILENT /SP-
- '%APPDATA%\windowsupdate\client32.exe'
- '%APPDATA%\windowsupdate\client32.exe' ' (with hidden window)
