Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-kv979.tmp\is-hgfda.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-us90d.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-0sqvl.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-dj8r9.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-1cq1j.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-lvjee.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-pibgs.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-q298b.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-a00lr.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-rrbim.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-36n13.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-5j10f.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-8rhtv.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-1hehg.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-vlka3.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-61q4d.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-c7do9.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-l78cp.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-iig9j.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-k5d8u.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-v0hhu.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-7bfs4.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-5ns1c.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-fs7mq.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\unins000.dat
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-obuci.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-6grl0.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\is-u3mnn.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\is-inqtq.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-k4jk9.tmp
- %TEMP%\is-m0ufl.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-m0ufl.tmp\_iscrypt.dll
- %ProgramFiles(x86)%\tbmole clone remover 4.9\is-gojsp.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\is-jt10k.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\is-v3kv4.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\is-iasfp.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\is-qdssd.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\is-iocpo.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\is-bsa3k.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-vs99a.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-omcav.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\cloneremover.exe
- %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-ha4bs.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-t97dj.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-06nr8.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-f1kq0.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-tho2s.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-h9crg.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-0nik0.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-srd0k.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-7pcr3.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-18v7m.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-e73ft.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-o0a79.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-q1b3d.tmp
- %TEMP%\is-m0ufl.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-46tvv.tmp
- %TEMP%\gwqsaf.txt
Moves the following files
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\is-gojsp.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\unins000.exe
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-6grl0.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\10.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-us90d.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\11.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-0sqvl.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\12.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-dj8r9.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\13.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-1cq1j.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\14.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-lvjee.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\15.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-pibgs.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\16.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-q298b.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\17.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-a00lr.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\18.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-rrbim.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\19.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-5j10f.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\20.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-5ns1c.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\8.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-1hehg.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\21.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-ha4bs.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\22.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-vlka3.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\23.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-61q4d.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\24.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-c7do9.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\25.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-l78cp.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\3.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-iig9j.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\4.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-k5d8u.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\5.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-v0hhu.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\6.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-7bfs4.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\7.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-obuci.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\1.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-36n13.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\2.gif
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\is-u3mnn.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\index.html
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-46tvv.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\english.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\is-jt10k.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\cloneremover.exe
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\is-v3kv4.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\homepage.url
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\is-iasfp.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\license.txt
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\is-qdssd.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\readme.txt
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\is-iocpo.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\delzip179.dll
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\is-bsa3k.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\unrar.dll
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-vs99a.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\brazilian.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-omcav.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\bulgarian.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-t97dj.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\chinese.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-8rhtv.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\dutch.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-06nr8.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\french.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-k4jk9.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\swedish.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-f1kq0.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\french2.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-tho2s.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\german.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-h9crg.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\hungarian.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-0nik0.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\italian.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-srd0k.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\persian.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-7pcr3.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\portugues.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-18v7m.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\romanian.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-e73ft.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\russian.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-o0a79.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\slovak.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\language\is-q1b3d.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\language\spanish.mlg
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\is-inqtq.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\index-ru.html
- from %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\is-fs7mq.tmp to %ProgramFiles(x86)%\tbmole clone remover 4.9\help\img\9.gif
Network activity
Connects to
- 'id###angede.cf':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########
HTTP POST requests
- http://id###angede.cf/new/net_api
UDP
- DNS ASK id###angede.cf
Miscellaneous
Searches for the following windows
- ClassName: '{3E4917E0-92ED-4579-9251-2A108ACF8CD1}' WindowName: ''
Creates and executes the following
- '%TEMP%\is-kv979.tmp\is-hgfda.tmp' /SL4 $12002A "<Full path to file>" 5261429 52224
- '%ProgramFiles(x86)%\tbmole clone remover 4.9\cloneremover.exe'
- '%ProgramFiles(x86)%\tbmole clone remover 4.9\cloneremover.exe' a1d63d2c9e882a5d44b3a7c7e494cf3e
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Query
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "CloneRemover 3.9"
