Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-5kk97.tmp\is-52242.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-tmbqc.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-3e3ci.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-pumip.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-86ha1.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-qm4nk.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-afipp.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-9e1rt.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-820qm.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-0c5pq.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-pbpfp.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-cca0r.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-g988a.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-v6b6f.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-51cc9.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-q8fmc.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-4bbl4.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-iaoc2.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-k24h2.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-al858.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-nf4ie.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-p4dtk.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-23d3r.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-kr3a6.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\unins000.dat
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-05m4n.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-c0agp.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\is-2cceb.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\is-tc03b.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-b75f6.tmp
- %TEMP%\is-ftlrv.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-ftlrv.tmp\_iscrypt.dll
- %ProgramFiles(x86)%\swmole clone remover 3.9\is-mu1pb.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\is-i43ae.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\is-qtgn2.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\is-s3oag.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\is-92tgt.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\is-5brb9.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\is-tsbid.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-2dc65.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-ej4q6.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\cloneremover.exe
- %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-2m1jn.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-hsjkm.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-15iru.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-67c8a.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-oiv1h.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-kt87s.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-simgr.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-2p7bv.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-soiqr.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-nu89f.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-2j87o.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-3kn9d.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-18n50.tmp
- %TEMP%\is-ftlrv.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-ribmm.tmp
- %TEMP%\gwqsaf.txt
Moves the following files
- from %ProgramFiles(x86)%\swmole clone remover 3.9\is-mu1pb.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\unins000.exe
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-c0agp.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\10.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-tmbqc.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\11.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-3e3ci.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\12.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-pumip.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\13.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-86ha1.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\14.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-qm4nk.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\15.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-afipp.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\16.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-9e1rt.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\17.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-820qm.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\18.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-0c5pq.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\19.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-cca0r.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\20.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-23d3r.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\8.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-v6b6f.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\21.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-2m1jn.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\22.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-51cc9.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\23.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-q8fmc.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\24.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-4bbl4.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\25.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-iaoc2.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\3.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-k24h2.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\4.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-al858.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\5.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-nf4ie.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\6.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-p4dtk.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\7.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-05m4n.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\1.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-pbpfp.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\2.gif
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\is-2cceb.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\index.html
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-ribmm.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\english.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\is-i43ae.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\cloneremover.exe
- from %ProgramFiles(x86)%\swmole clone remover 3.9\is-qtgn2.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\homepage.url
- from %ProgramFiles(x86)%\swmole clone remover 3.9\is-s3oag.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\license.txt
- from %ProgramFiles(x86)%\swmole clone remover 3.9\is-92tgt.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\readme.txt
- from %ProgramFiles(x86)%\swmole clone remover 3.9\is-5brb9.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\delzip179.dll
- from %ProgramFiles(x86)%\swmole clone remover 3.9\is-tsbid.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\unrar.dll
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-2dc65.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\brazilian.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-ej4q6.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\bulgarian.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-hsjkm.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\chinese.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-g988a.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\dutch.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-15iru.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\french.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-b75f6.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\swedish.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-67c8a.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\french2.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-oiv1h.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\german.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-kt87s.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\hungarian.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-simgr.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\italian.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-2p7bv.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\persian.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-soiqr.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\portugues.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-nu89f.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\romanian.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-2j87o.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\russian.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-3kn9d.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\slovak.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\language\is-18n50.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\language\spanish.mlg
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\is-tc03b.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\index-ru.html
- from %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\is-kr3a6.tmp to %ProgramFiles(x86)%\swmole clone remover 3.9\help\img\9.gif
Network activity
Connects to
- 'id###angede.cf':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########
HTTP POST requests
- http://id###angede.cf/new/net_api
UDP
- DNS ASK id###angede.cf
Miscellaneous
Searches for the following windows
- ClassName: '{E94137E0-92ED-4579-9251-18AF2A08CCD1}' WindowName: ''
Creates and executes the following
- '%TEMP%\is-5kk97.tmp\is-52242.tmp' /SL4 $14001E "<Full path to file>" 5173215 52224
- '%ProgramFiles(x86)%\swmole clone remover 3.9\cloneremover.exe'
- '%ProgramFiles(x86)%\swmole clone remover 3.9\cloneremover.exe' 14924df485b1f21029e56e648770ee6d
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Query
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "CloneRemover 3.9"
